Privacy

Elutha is built so that it knows as little as possible. It blocks sites on your phone; it doesn't watch what you do. This page explains exactly what we store, why, and who can see it.

Who we are

Elutha is operated by LiLo Development (“we”, “us”). We are responsible for the personal data described here.

What we never store

• Your browsing history. Blocking happens on your phone. We don't receive the sites you visit.
• Which sites you tried to open. When Elutha holds a site back, that moment isn't sent to us.
• Counts of blocked attempts. There is no feed or tally of attempts on our side, and your anchor never sees one.

What we store if you use the app

• Your account: your email address and the display name you choose, plus sign-in details handled by our authentication provider (a password, or a Google or Apple sign-in).
• Your blocklist: whether the adult-content category is on, and the sites you add yourself (for example example.com), with the date each was added.
• Your anchor, if you invite one: the name you give them, their email address if you or they provide it, the invitation message if you write one, and whether they accepted, declined or stepped down (including an optional note if they decline).
• Unlock requests: what you asked to unlock (one site, adult content, everything, or stepping away from your anchor), for how long, the note you wrote, the answer, and any reply your anchor wrote.
• Protection status per device: for each phone, the platform (iOS or Android), a device name, whether protection is on, off or unknown, when that last changed, and when the app last checked in.
• A short history of changes: protection turned on or off, requests sent and answered, and anchor changes — with dates. This is what powers the calm timeline in the app and on your anchor's page. It never names the sites you visited.

What we store if you are someone's anchor

You don't have an account. We store the name the other person gave you, the email address you use for Elutha, your answers to their requests and any replies you write, and a private link to your page. Anyone with that link can open your page, so please keep it to yourself — you can always ask us to email it to you again.

Who can see what

• You can see your own account, blocklist, requests and history in the app.
• Your anchor can see the requests you send them, their own answers, and whether protection is on or off. Their page shows a short activity list that never names sites. They can't see your blocklist, your browsing, or anything else about your phone.
• We can technically access the database to run and fix the service. We don't sell your data, use it for advertising, or share it with anyone except the service providers below.

Emails

We send emails only when something happens that you need to know about: an invitation, a request, an answer, protection coming off, an anchor stepping down, or a link you asked for. Emails are sent through Resend. An email contains only what it needs — for example the name of the person asking and the note they wrote.

Where your data lives

Our database and backend run on Supabase, hosted in the European Union (Frankfurt, Germany). This website has no analytics, no advertising and no third-party tracking scripts. It sets one small functional cookie only if an anchor chooses to hide a protection-off notice.

Why we process it

We process this data to provide the service you asked for: holding the sites you chose, running the unlock and anchor features, and sending the emails those features depend on. The legal basis is the performance of our agreement with you. For anchors, it is our legitimate interest in running the feature that the other person set up and that you agreed to take part in — and you can step down at any time.

How long we keep it

We keep your data for as long as your account exists. You can delete your account in the app once nothing is blocked any more (this keeps account deletion from becoming a way around your own friction). Deleting your account removes your profile, blocklist, anchor details, requests, device status and history. If you had an active anchor, they receive one last email saying your account was closed.

Separately, we keep a log of the emails we send (the recipient and the content of each email) in our email queue. It isn't removed automatically when an account is deleted yet.

Your rights

Under the GDPR you can ask for access to your data, a copy of it, correction, deletion, or restriction of processing, and you can object to processing. You can also lodge a complaint with your data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).

Changes

If we change how Elutha handles data, we'll update this page and the date at the top.