Privacy policy

Last updated: 2 September 2026

This policy explains what Broc collects, why, and what you can do about it. Broc ("we", "us") makes a habit app that blocks chosen apps on your phone until you finish your daily habits. Broc was previously published under the name Veto; this policy covers the same app and service.

If anything here is unclear, email us at developer@getbroc.app.

Who runs Broc

Broc is provided by Shay Gavan (Broc). We are the data controller for the information described below.

What we collect

Your account. When you sign in with email, Google, or Apple, we store the account identifier and email address that provider gives us and, where available, your display name. Apple may provide a private relay address instead of your personal email. This is how your habits sync across devices.

Your habits and progress. The habits you create, your daily completions, unlock activity, and settings such as reward mode and which apps you block.

Your blocked-apps list. On Android, the package names and labels of the apps you choose are stored with your account so they can be restored. On iPhone, Apple keeps app identities private: the opaque Screen Time selection stays in Broc's App Group on your device and is not sent to our servers.

Purchase status. If you subscribe to Broc, our payments provider tells us whether your subscription is active. We never see your card details.

Diagnostics. If the app crashes, we receive a crash report so we can fix the problem. It does not contain your habit content.

Product analytics. The app uses PostHog, hosted in the EU, for events such as "habit created" or "first unlock", plus device model and app version. It never includes habit names, photos, or content from other apps. This website uses PostHog in cookieless mode only for explicit App Store and Google Play clicks, and GoatCounter for cookieless page counts. Website session recording, autocapture, advertising profiles, and analytics cookies are disabled.

We do not show ads and we do not sell your data.

Android blocking permissions

Broc uses Android's Usage Access permission only to detect which app is open right now and compare it against your block list, on your device. We do not record, store, or send a history of the apps you use.

Android's "Appear on top" permission lets Broc show its lock screen over a blocked app.

iPhone Screen Time access

On iPhone, Broc uses Apple's Family Controls picker, Managed Settings shields, and Device Activity monitoring. Apple gives Broc opaque tokens rather than app names. Those tokens and the lock timer stay in the shared App Group used by Broc's iPhone extensions. We do not record or send a history of the apps or websites you use.

Notifications

If you enable daily reminders, Broc stores a device notification token, your time zone, and reminder time in Firebase so it can send the reminder you chose. We do not use reminders for third-party advertising. On Android, the active blocking service also shows an ongoing status notification so you know it is running.

Photos for AI verification

If you turn on photo verification for a habit, the photo you take is sent securely to our server and then to our AI provider (OpenAI) to check whether it matches the habit. We use the result (a pass or fail) to mark the habit done. We do not save the photo on our servers after the check, and the AI provider does not use API images to train its models. If you would rather not share photos, simply leave photo verification off.

Where your data lives

Your account and habit data are stored with Google Firebase (Cloud Firestore, Authentication, Crashlytics) and may be processed on Google's servers. Subscription status is handled by RevenueCat and the app store. Analytics events are processed by PostHog on servers in the EU. These providers process data on our behalf under their own security and privacy terms.

How long we keep it

We keep your data while your account exists. If you delete your account, we remove your habits, completions, blocked-apps list, and settings. Crash reports and aggregate diagnostics may be retained for a limited period by our providers.

Your choices and rights

You can:

• See and change your habits and settings in the app at any time.
• Turn photo verification off.
• Ask us to export or delete your data by emailing developer@getbroc.app.

If you are in the UK or EU, you have rights under the UK GDPR / GDPR, including access, correction, deletion, and the right to complain to the ICO (or your local authority).

Children

Broc is not intended for children under 13 (or the minimum age in your country). We do not knowingly collect data from children.

Changes to this policy

If we change this policy, we will update the date above and, for significant changes, let you know in the app.

Contact

Questions or requests: developer@getbroc.app.