Scrollfluent — Privacy Policy

Effective: 27 September 2026 · Version 2 · Earlier versions

Scrollfluent is an iPhone app that puts a short Spanish session in front of apps you choose. This policy explains exactly what information the app and our website collect, why, who else handles it, how long we keep it, and what you can do about it.

Who we are. Scrollfluent is operated by Isaac Fobi, doing business as Scrollfluent, a sole proprietor based in Oregon, United States ("we", "us"). Contact: [email protected].

Where it's offered. Scrollfluent is offered only in the United States.

The short version

• We never learn which apps you lock or what you do in them. Apple doesn't tell us.
• You don't give us a name, email address or password unless you choose to add a guardian or accountability partner. Your account is a random ID.
• Your learning progress syncs to our server so you don't lose it. It's statistics about flashcards.
• On a phone set up for a child, progress stays on the phone. Only an account ID and subscription status reach us.
• Speech recognition runs on your phone. Audio never leaves it.
• We don't sell or "share" personal information, we show no ads, and we use no third-party analytics or tracking.
• Delete your data at any time: Settings → Delete account.

1. What we collect, and why

What we do not collect: which apps you lock or how you use them; your contacts, photos, location or advertising identifier; your typed quiz answers (they are checked on your phone); your voice or audio; your payment card. We do not use your information to make automated decisions about you that have legal or similarly significant effects.

Nothing free-form. What syncs is numbers and fixed labels. There is no free text in it.

2. The apps you lock (Screen Time)

Scrollfluent uses Apple's Screen Time frameworks (Family Controls, Managed Settings, Device Activity). When you pick apps in Apple's picker, Apple gives the app a sealed token that only Apple can read. We cannot tell which apps you chose. That token stays on your phone, in storage shared only with Scrollfluent's own Screen Time extensions. It is never sent to us or anyone else. Apple gives us no information about how long you spend in those apps or what you do there.

3. The microphone and speech

Some questions ask you to say a word in Spanish. While you hold the speak button, the app uses Apple's speech recognition with on-device processing required. Audio is processed on your phone and is never uploaded, not to us and not to Apple. The recognised text is used only to mark that one answer, then discarded. The microphone is on only while you hold the button.

4. The guardian PIN

If a guardian PIN is set, only a salted one-way hash of it is stored, in your phone's keychain. The PIN is never stored and the hash never leaves the phone.

5. Guardian and accountability-partner emails

Both are optional and off by default.

• A guardian can reset the PIN. We store their address to send them a reset link or a one-time code when asked.
• An accountability partner is told when you turn your protection down: when you lower the lock, change which apps are locked, remove the PIN, unlock with the PIN, or delete your account. We store their address and the first name you give us for yourself. We never tell them anything about what you do inside your apps, because we don't know. If you remove or replace a partner, we send that partner one last email saying so.

If you enter someone else's address, you are telling us they have agreed to it. Every email we send them says why they received it and how to stop. If you are that person and want the emails to stop, reply STOP or write to [email protected]. We will add your address to a permanent do-not-email list, which holds even if someone enters it again.

These addresses are stored so that the app on the phone cannot read them back. It only ever sees a masked form such as i***@gmail.com. We never use these addresses for marketing.

6. Phones set up for a child

Scrollfluent can be set up by a parent on a child's phone ("My kid. I'm setting up their phone"). In that mode:

• Learning progress, session records and setup steps stay on the phone. They are not sent to us.
• The child is never asked for a name, email address or any other contact detail, and nothing the child types or says leaves the phone.
• Accountability partners are not available on a phone set up for a child.
• What does reach us is limited to what the service needs to run: the random account ID; the subscription status for that ID, through Apple and RevenueCat; and the technical data any connection carries (see "Technical logs" in section 1), including checks for app updates. We use these only to operate the app. We do not use them for advertising, profiling or anything else.
• The only email address involved is the parent's own, if the parent adds one as the guardian address for PIN resets. Those emails go to the parent.

A parent can delete everything at any time from Settings → Delete account on the child's phone (behind the PIN), or by emailing [email protected]. Deleting the app also removes everything stored on the phone.

Scrollfluent is not directed to children under 13, and we do not knowingly collect personal information from a child under 13 except as described in this section. If you are under 13, ask a parent to set Scrollfluent up for you. If you believe we hold a child's personal information we should not, email us and we will delete it.

7. Who else handles your information

We use a small number of service providers. They process information only on our instructions and under written terms that require them to protect it.

We do not sell personal information and we do not share it for cross-context behavioural (targeted) advertising. We have no advertising partners, analytics companies or data brokers.

We may also disclose information:

• if the law requires it, for example a valid subpoena or court order;
• to protect the safety, rights or property of anyone, or to investigate fraud or abuse; or
• to a successor if Scrollfluent is sold or transferred. The successor would be bound by this policy for information collected under it.

8. Tracking, Do Not Track and Global Privacy Control

Scrollfluent does not track you across other companies' apps or websites, and the app contains no third-party tracking. Our website is hosted by HighLevel, which may set cookies needed to run and secure the site; we don't add advertising or analytics trackers to it. Because we don't track you, there is nothing for a Do Not Track signal to switch off. We treat a Global Privacy Control signal as a request to opt out of any sale or sharing, which we do not do in the first place.

9. How we protect it

• Data travels encrypted (TLS) and is encrypted at rest by our providers.
• Row-level security means an account can read only its own rows.
• Guardian and partner addresses cannot be read back by the app.
• Access to our provider dashboards is limited to the operator.
• We keep a written information security program and review it at least once a year.

No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.

10. Your choices and rights

Wherever you live in the United States, you can:

• Access or export a copy of the information tied to your account.
• Correct it.
• Delete it: Settings → Delete account removes it immediately (see section 11).
• Stop partner emails by removing the partner in Settings. A guardian address can be changed or removed only with a reset link sent to the current guardian, or by writing to us.

To make a request, email [email protected] and include the Account ID shown at the bottom of Settings. Because accounts are anonymous, that ID is how we find yours. We may ask for more detail so we don't give someone else's data to you. We will respond within 45 days. We will not charge you or treat you differently for asking.

Appeals. If we decline a request, you can appeal by replying with "Appeal" in the subject line. We will respond within 60 days and explain our decision. If you are still not satisfied, you can contact your state attorney general.

California residents. You have the rights above under California law. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it.

11. Deleting everything

Settings → Delete account removes from our database, immediately and permanently:

• every flashcard progress row, session record and daily log;
• your statistics and setup records;
• your guardian and partner addresses and the email send log;
• your subscription record; and
• the account itself.

It cannot be undone. Copies in our providers' backups and logs expire on their normal schedules, typically within days to weeks. RevenueCat and Apple keep the purchase records they need for billing and tax. Deleting your account does not cancel an Apple subscription. Cancel that in Settings → your name → Subscriptions, or Apple will keep billing you.

Deleting the app removes the data stored on the phone and your app selection. iOS does not always lift a lock when the app is deleted mid-lock, so finish a session or turn off Scrollfluent's Screen Time access first. Reinstalling and opening the app clears any leftover lock, and clears the PIN. Deleting the app does not delete your server data. Use Delete account for that, or email us and we will delete your account within 30 days.

12. Changes to this policy

When we change this policy we update the effective date and version above and keep the earlier version listed below. If a change is material, for example we start collecting something new or using it in a new way, we will tell you in the app before it takes effect. Where the law requires your consent, we will ask for it.

13. Contact

Isaac Fobi, doing business as Scrollfluent · Oregon, United States · [email protected]

Version history

• Version 2, 27 September 2026. Offered in the United States only. Phones set up for a child sync only an account ID and subscription status, and can't use accountability partners. Added a do-not-email list, Expo as a provider, the Account ID for requests, retention for each kind of data, technical logs, website hosting, security, rights and appeals, Do Not Track, and third-party email opt-out.
• Version 1, 25 September 2026. First published policy.