1. Who we are
Tiny Vow is an Android app for setting phone-use boundaries, reviewing reports, focusing offline, and accessing Pro features. Rorolo is the public brand used for Tiny Vow.
For Google Play users, the data controller is the verified developer identified on the Tiny Vow Google Play listing. Privacy and data-rights requests can be sent to rrrr.zhao@qq.com.
2. Data we process
Tiny Vow is local-first. App groups, limits, usage history, blocks, points, steps, focus sessions, daily plans, plan category names and colors, foreground usage intervals, themes, achievements, rewards, media history, and similar activity data stay on your device by default. Daily plans and focus notes stay local and are included in manual backups, privacy summaries, and local data clearing. Tiny Vow does not sell this data, use it for advertising profiles, or upload it to its own service.
If you choose Google sign-in, the Google account profile returned to the app is used to show sign-in status and maintain a local session. The Google Play edition does not send that profile or your local activity data to a Tiny Vow server.
Google Play processes subscription and lifetime-purchase transactions, renewals, cancellations, refunds, and related payment information. Tiny Vow reads the purchase status returned by Google Play only to determine Pro access and does not receive your payment-card number.
Usage access calculates foreground app time, limits, reports, and reminders. Accessibility is used to identify the foreground app and show a blocking overlay for limits you set. When you enable flip to focus, the service also uses the system lock-screen action after starting an unlimited focus timer and opening its details. The timer continues while locked. Motion sensor data is used locally to detect the flip only while the app is open and is not stored or uploaded. Tiny Vow does not read screen text, capture screen content, click for you, or change system settings. Notification, media-notification, battery, startup, Health Connect, and activity-recognition access support the local features described immediately before permission is requested and can be declined where optional.
If you configure WeRead synchronization and provide an API key, the app contacts WeRead directly to retrieve the reading statistics you authorized. The key is encrypted on the device and is not uploaded to Tiny Vow.
If you submit website feedback or an account or data deletion request, the website receives the information you enter, such as the category, message, rating, contact email, optional user ID, requested scope, interface language, submission time, and processing status. It is used only to handle the request, respond to you, prevent abuse, and retain necessary processing records. Feedback is displayed publicly only when you explicitly allow it.
When a signed-in user submits an eligible first Experience or Feature idea, the service creates a reward-eligibility record and may grant the published Pro reward; each eligible category can be rewarded only once. The website also keeps hourly and daily aggregate download-request counts for each release, without storing a downloader IP address, device identifier, account, or individual download record. These aggregates are not installation or unique-user counts.
The separately distributed China edition may process account profiles, protected password hashes, optional avatars, trusted-device sessions, login history, activation redemptions, payment orders, and Pro entitlements through the Tiny Vow service. Registration is optional and does not upload local usage data.
3. Purposes and legal bases
Information needed to provide requested features and administer Pro access is processed to perform our agreement with you. Optional permissions, Google sign-in, WeRead synchronization, and public feedback display are used only after your action or consent. You can withdraw by disabling the feature, signing out, removing the permission, or contacting us.
Security checks, fraud and abuse prevention, support records, and privacy-preserving aggregate website statistics are processed for our legitimate interests in keeping Tiny Vow reliable and protecting users. Payment, tax, dispute, and compliance records may be retained where necessary to meet legal obligations.
4. Recipients and international processing
Depending on the feature you choose, Google may process Google sign-in and Play Billing data; email, payment, hosting, and support providers may process only the information needed to deliver their service; and WeRead receives direct requests initiated with your API key. These providers process data under their own terms and privacy commitments.
Some providers may process information outside the European Economic Area. Where Tiny Vow is responsible for such processing, we use the provider only for the stated purpose and rely on the transfer mechanism or safeguard applicable to that provider and service. Contact us for information about a specific transfer.
5. Retention, security, and deletion
Local data remains on your device until you clear it, uninstall the app, or restore a different backup. Tiny Vow uses platform protections and limits service-side access to people and providers who need it for the stated purpose.
Website feedback is kept until handled or no longer needed. Account and data deletion requests are normally processed within 30 days. Request content and contact details are retained while processing and for no more than 180 days after completion or rejection for verification, disputes, and compliance, then deleted unless law requires a different minimum period.
You can export or clear local data and sign out or delete your account from the app. See the account deletion page or data deletion page. Google Play retains its own subscription, payment, refund, and legally required transaction records under Google's policies.
6. Your rights in the EEA and United Kingdom
Subject to applicable law, you may request access, correction, deletion, restriction, or portability of personal data we control, and you may object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.
Send a request to rrrr.zhao@qq.com or use the deletion pages above. We may request information needed to verify your identity. You also have the right to complain to the data-protection authority in the country where you live, work, or believe an infringement occurred.
7. Automated functionality
Tiny Vow automatically calculates limits, points, reports, and reminders from rules you configure on your device. These local functions do not produce legal or similarly significant effects and are not used for advertising or credit, employment, insurance, or eligibility decisions.
8. Children
Tiny Vow is not directed to children under 13. Contact us if you believe a child has provided personal information.
9. Updates
We will update this policy when product features or data practices materially change and provide notice when required.
Versions using a unified Rorolo account
These versions use the Rorolo account center for passwords, email verification and verification codes. Account identity and display name are shared across products. When continuous sync is enabled, the Tiny Vow server sends product entitlements, device names, platform, last activity and credential revocation status to the account center for display. Installation identifiers and device credentials are not transferred. App devices are displayed separately from central sign-in sessions and must be managed in the corresponding app. Memberships, orders and business data remain scoped to each product. Tiny Vow usage history, vows, points, steps and focus records remain local and are not uploaded by this integration.
Deleting an account inside Tiny Vow deletes only Tiny Vow server profile projections, avatars, devices, sessions, memberships, redemptions, orders, linked payment records and feedback. It does not delete your Rorolo credentials or other products. A durable request tracks deletion, and success is not reported before cleanup completes. Signing in again starts with empty Tiny Vow product data without restoring deleted memberships or orders. Delete the entire Rorolo account separately in the account center.
Minimal identity mappings, operation identifiers and deletion receipts are retained to prevent duplicate operations and resurrection of deleted data. These receipts do not contain plaintext passwords. References below to deletion of independent email credentials apply to older versions that have not switched to unified accounts.
App privacy blocking
Pro members can block selected apps in App settings. Tiny Vow stops recording their usage and excludes them from limits, reminders, usage points, statistics, and sharing, while clearing saved local usage details. Previously earned points retain their value with the app source anonymized. Focus interruption rules still apply, but the blocked app identity is not saved. Privacy choices stay on the device. Existing blocks remain after Pro expires and can be removed at any time. Removing a block resumes recording from that moment without backfilling old usage. This feature does not delete Android system records or recall exported files. Restoring an older backup preserves stricter privacy choices to prevent erased history from reappearing.
Local usage continuity after reinstalling a managed app
To keep reinstalling a managed app from resetting observed usage toward a limit, Tiny Vow stores up to 35 days of observed foreground intervals locally and merges overlapping intervals by package name for limits and reports. These records are not uploaded and are included in manual backups, privacy summaries, and local data clearing. Blocking an app for privacy deletes its checkpoints; removing the block resumes recording from that moment. Clearing Tiny Vow data or uninstalling Tiny Vow itself deletes the checkpoints.
China-edition app updates
China-edition versions with in-app updating can read public version information from tinyvow.rorolo.com when opened, at most once daily after a successful check, with later retries after failures. You can disable automatic checks or check manually in Me → App version. Requests do not attach an account, device identifier or usage records, and no push SDK is used. Ordinary website access logs may contain the requesting IP address under the existing website security and log-retention rules. APKs are downloaded only after your confirmation, checked for file hash, package name, version and signing certificate, and then installed through Android confirmation. The updater does not uninstall the app, clear local data or install silently. Downloads use temporary on-device cache; check settings stay on the device and are not included in manual backups. This feature is absent from Global and Google Play builds.