Privacy Policy

1. Introduction

Doom Counter (“we”, “us”, “the app”) is an Android app that estimates how many short-form videos you watch in Instagram Reels, YouTube Shorts, TikTok, Facebook Reels and Snapchat Spotlight, and shows that against a daily goal. This policy applies to the app and to this website. Contact details are in section 16.

2. Summary

3. Information we process

3.1 Stored only on your device

• Usage sessions and daily summaries: for each closed short-form session, the platform (for example Instagram or YouTube), the app package name, start and end times, duration, number of reels, and a detection-confidence label. Sessions that cross midnight are split by local date.
• Goals and settings: daily reel and time goals, per-app and session limits, notification and overlay preferences, language, onboarding choices, and focus-session history.
• Sign-in tokens: stored in Android's secure storage (Keystore-backed), not in the general app database.

Uninstalling the app or clearing its storage deletes this local data. You can also delete usage history or reset the app in Settings.

3.2 Account information stored on our server

• Email address (always) and a password hash if you register with email. Passwords are hashed with Argon2id; we do not store your password in readable form.
• If you sign in with Google: your Google account identifier, the email on that account, and, if Google provides them, your display name and profile photo address.
• Session records: refresh tokens stored only as one-way hashes, and single-use password-reset tokens stored as hashes.
• Sign-in attempt records: email, IP address, time and whether the attempt succeeded. These are used to detect abuse and to lock an account after repeated failures, and are deleted after 30 days.
• Profile photo (optional): if you choose or take a photo, it is uploaded and stored so that friends can see it in battles. You can remove it in Settings.

3.3 Usage and social data stored on our server

• Daily totals: for each local date, your total reels and total seconds. The app sends today's totals when you are signed in and your data changes. This is best-effort and is used for Scroll Battle scoring.
• Scroll Battle: battle invite codes, the date, each participant's reel count, and the winner. Your opponent can see your display name, photo and reel count for that battle.
• Invites and referrals: your referral code and records of who joined using it.
• Offers: records of promotional offers (such as Lucky Box) shown to or redeemed by your account.

3.4 Subscription information

Your Premium status (trial, active, cancelled, expired, grace or hold), the product identifier, trial and period dates, whether it will renew, and the Google Play purchase token and related purchase details used to verify the purchase with Google. We do not receive or store your card or other payment details; payments are handled by Google Play.

3.5 Information you send us

If you email us, we process your email address and the contents of your message to respond.

3.6 Server and hosting logs

Our web server may keep short-lived access logs, which include IP addresses, as is standard for hosting. The application itself is configured to log warnings and errors only, not individual requests.

4. Accessibility service disclosure

Counting requires Android's Accessibility service, because Android gives ordinary apps no other reliable way to tell a short-form player apart from the rest of an app. The app shows an in-app disclosure and asks for your agreement before it opens Android's Accessibility settings. You enable the service yourself and can disable it at any time.

• What it reads: for Instagram, YouTube, TikTok, Facebook and Snapchat only, including regional TikTok variants and Instagram Lite, Facebook Lite and TikTok Lite: the foreground app name, on-screen view identifiers and a few short content labels, so it can tell when a short-form player is visible and when you move to the next video.
• What it does not do: it does not read your messages, passwords or other content, does not take screenshots or record the screen, and does not upload what is on screen.
• What is kept: only the session records described in section 3.1, stored on your device.
• Overlays: the service can draw a floating counter and warning or interruption screens. These use the accessibility overlay and do not capture screenshots or keystrokes.

The service is used only for this purpose. It is not used for advertising, profiling or sale of data.

5. Permissions

The app does not request microphone access or the “display over other apps” permission.

6. How we use information

• To create and secure your account and keep you signed in.
• To show your reel count, goals, charts and streaks (computed on your device).
• To run Scroll Battle, invites and referrals.
• To determine Premium access, verify purchases with Google Play, and handle renewals, cancellations and refunds.
• To send account emails such as password-reset links.
• To prevent abuse, enforce rate limits and keep the service secure.
• To respond to support requests and meet legal obligations.

7. Sharing and service providers

We do not sell your personal information and do not share it for advertising. We share or expose it only as follows:

• Google: if you use Google Sign-In, Google processes your sign-in under its own privacy policy and we verify the token it issues. Google Play handles purchases and subscriptions, and we exchange purchase verification and notification data with Google Play (including its subscription-event notifications) to keep your Premium status accurate. If you use a Google profile photo, it is loaded from Google's servers.
• Other users: opponents in a Scroll Battle you join can see your display name, photo and reel count for that battle. People you invite see only what the invite flow shows them.
• Infrastructure providers: our server and database are hosted on infrastructure we operate or rent, and an email service may be used to deliver password-reset emails. These providers process data only to provide those services.
• Legal and safety: where required by law, or to protect rights, safety and the security of the service.

8. Advertising, analytics and tracking

The app contains no advertising SDKs, no advertising identifier use, no analytics SDKs and no crash-reporting SDKs (including no Firebase). The website does not use cookies or third-party scripts. Google Play may separately provide us aggregated diagnostics from users who opted in on their device; that is controlled by Google.

9. Security

• Passwords are hashed with Argon2id; refresh and reset tokens are stored as hashes; access tokens are short-lived.
• Sign-in tokens on your device are kept in secure storage.
• Requests are rate limited, repeated failed sign-ins lock the account temporarily, and refresh tokens are rotated.
• The production server is accessed over HTTPS.

No system is perfectly secure, and we cannot guarantee absolute security.

10. Retention and deletion

• Account and server data: kept while your account exists.
• Sign-in attempt records: deleted after 30 days.
• Local data: kept on your device until you delete it, reset the app, clear app storage or uninstall.

How to delete your account and data

1. In the app, open the account screen and choose Delete account. If your account has a password you will be asked to confirm it. This removes your server account and the data linked to it: sign-in sessions, reset tokens, subscription record, referral records, battles you created, daily totals and offer records.
2. To delete local history on your phone, use Delete usage history or Reset app in Settings, or uninstall the app. Deleting the server account does not delete local history, and deleting local history does not delete the server account.
3. You can also email tkxendhs@gmail.com from the address on your account to request deletion, including removal of any uploaded profile photo. This page is public and needs no sign-in.

Subscriptions: deleting your account does not cancel a Google Play subscription. Cancel it in Google Play first (see the Refund Policy). We may keep limited records where the law requires.

11. Children

Doom Counter is not directed at children and is not intended for children under 13 (or the higher minimum age of digital consent in your country). We do not knowingly collect personal information from children below that age. If you believe a child has created an account, contact us and we will delete it.

12. International processing

Account and usage data are processed on our server, which may be located in a different country from you. Google processes sign-in and purchase data in the countries where it operates. Where required, we rely on appropriate safeguards for international transfers.

13. Your rights

Depending on where you live (for example under the GDPR/UK GDPR or US state privacy laws), you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can delete your account in the app (section 10) and manage permissions in Android settings. For other requests, email tkxendhs@gmail.com. We may need to verify your identity. You may also complain to your local data-protection authority. We do not sell or share personal information for cross-context behavioral advertising, and we do not discriminate against users who exercise their rights.

14. Android backup

Android's backup feature may copy app data to your Google account depending on your device settings. That is controlled by Android and Google, not by us.

15. Changes to this policy

We may update this policy when the app or the law changes. The effective date above shows the latest version. If a change is material we will tell you in the app or by another suitable means before it takes effect where required.

16. Contact

Questions or requests about privacy: tkxendhs@gmail.com. See also our contact page.