ST Replay Privacy Policy

Last updated: 29 September 2026

The short version

ST Replay turns your Apple Screen Time into a story. It does not turn it into our data.

Your Screen Time report is generated on your device using Apple's Screen Time frameworks. Volani Limited does not receive or store your Screen Time totals, app or category names, device names, generated stories, dashboard contents, assessments or exclusions.

We do process a smaller amount of information to run the app: an anonymous app identifier, purchase and entitlement information, optional analytics and crash diagnostics, and—if you opt in—notification registration information. This policy explains exactly what that means.

Who we are

ST Replay is provided by Volani Limited ("Volani", "we", "us" or "our"), a company registered in England and Wales under company number 12103390.

Volani Limited is registered with the UK Information Commissioner's Office under registration number ZB581020.

Registered office: Little Plummerden Ardingly Road, Lindfield, Haywards Heath, West Sussex, England, RH16 2QY.

For privacy questions or requests, email help@streplay.app.

Volani Limited is the controller of the personal data described in this policy.

Information we process

Screen Time information

With your permission, Apple makes Screen Time information available to ST Replay's Device Activity report extension. That information is processed and displayed on your device.

We do not upload, receive or store:

• Screen Time totals or activity history;
• app, website or category usage;
• pickups, notifications or first-use times;
• device names;
• generated stories, comparisons or assessments; or
• apps or categories you exclude.

Revoking Screen Time permission prevents ST Replay from producing reports until permission is granted again.

Anonymous app and service identifiers

After you acknowledge the privacy notice, Firebase creates an anonymous user identifier. It is not your name, email address or Apple Account, but it lets the app associate functional records—such as notification registration and purchase access—with the same anonymous app account.

Firebase and related services may also process installation identifiers, IP addresses, user-agent information and basic device or app information to provide, secure and operate their services. We do not use these identifiers for advertising or cross-app tracking.

Purchases

If you view, buy or restore the lifetime unlock, Apple and RevenueCat process information needed to offer products, validate the transaction and restore access. This can include:

• the anonymous app user identifier;
• product and entitlement identifiers;
• localized price and currency information;
• transaction, receipt and purchase-status information; and
• dates associated with a purchase, restoration, refund or entitlement change.

Apple handles payment details. We do not receive your card or bank details. We do not send Screen Time information to Apple or RevenueCat.

Analytics and diagnostics

ST Replay offers separate privacy controls in the app:

• Basic app analytics record a limited set of fixed product events without attaching the anonymous app account identifier. These help us understand whether major screens and flows work.
• Expanded analytics, if you expressly accept them, associate the same limited product events with the anonymous app account so we can understand journeys across sessions.
• Crash diagnostics send limited technical crash and operational information, such as crash traces, app and operating-system versions, device model and timestamps, so we can find and fix faults.

Analytics and diagnostics never include Screen Time information, app names from your Screen Time report, dashboard values, generated story content, your name or contact details. They are not used for advertising or cross-app tracking. You can change these choices in ST Replay's Privacy choices screen.

Notifications

Notifications are optional. If you choose to allow reminders, we process:

• a locally generated installation identifier and a Firebase installation identifier;
• notification authorization status;
• locale and time zone;
• app version, build number and environment; and
• the time the registration was last refreshed.

Notification payloads contain routing information needed to open the relevant part of the app. They do not contain Screen Time information, app names, dashboard values, your anonymous user identifier, purchase status or a hard-coded price.

If you decline the in-app notification prompt, that choice remains on your device so we do not immediately ask again. If you allow notifications, you can later turn them off in iOS Settings.

Information stored only on your device

ST Replay stores settings and progress locally, including onboarding and privacy choices, notification-prompt state, appearance, story-access counters and purchase-journey state. Purchase entitlement itself is checked through RevenueCat and is not treated as authoritative merely because a local setting says so.

Deleting the app normally removes this local information, subject to Apple's own device and backup behaviour.

Website and support

When you visit streplay.app, our website host may process standard request information such as your IP address, browser or device type, requested page and request time to deliver and protect the site. We do not use the website for behavioural advertising.

The website may use cookies or similar storage that are strictly necessary for delivery, security and basic operation. We will not add non-essential website analytics or advertising cookies without providing any consent choice required by law.

If you contact us, we receive the information you choose to provide, such as your email address and message. Please do not send Screen Time screenshots or other sensitive information unless it is necessary for your support request.

We do not intentionally collect special-category data, such as health, biometric, religious or political information. Screen Time usage could reveal sensitive habits, which is one reason the report remains on your device. If you include sensitive information in a support request, we will use it only as necessary to handle that request and delete it when it is no longer needed.

Why we process information

We rely on the following UK GDPR and, where applicable, EU GDPR bases:

Our legitimate interests are to provide a reliable product, understand whether its non-sensitive flows work, prevent misuse, protect purchases, support users and improve the app. We minimise the information used for those purposes and provide controls for analytics and diagnostics.

Where processing relies on consent, you may withdraw consent at any time without affecting processing that was lawful before withdrawal. Expanded analytics and diagnostics controls are available in ST Replay's Privacy choices; notification permission is controlled in iOS Settings.

We do not use solely automated decisions that produce legal or similarly significant effects on you.

Where the information comes from

Information described in this policy comes from:

• you, when you make privacy choices, enable notifications or contact support;
• the app and your device, when they generate anonymous identifiers and limited technical events;
• Apple, when it supplies product, transaction, restoration and entitlement information;
• RevenueCat, when it validates and reports purchase and entitlement status; and
• Firebase and our website host, when they provide app, messaging, diagnostic, configuration, security and website services.

Apple supplies Screen Time information to the on-device report extension, but that report information is not supplied to Volani or the service providers listed in this policy.

Is the information required?

There is no statutory requirement to provide personal data to ST Replay.

Some processing is necessary to provide particular features. Without the anonymous app identifier and essential service requests, we may not be able to initialise the app's online configuration or associate purchase access. Without purchase information, we cannot validate or restore the lifetime unlock. Without notification registration, we cannot send reminders. Analytics and diagnostics are not required to use ST Replay and can be declined or disabled.

Service providers and disclosure

We use:

• Apple, for App Store distribution, Screen Time permission and frameworks, in-app purchases, purchase restoration and push-notification delivery;
• Google Firebase, for anonymous authentication, Remote Config, Analytics, Crashlytics, Cloud Messaging and Firestore notification registration;
• RevenueCat, for product offerings, purchase validation and lifetime-entitlement management; and
• Squarespace, for website hosting and delivery.

These providers process information under their own terms and, where applicable, on our instructions. You can read the Firebase privacy and security information, RevenueCat privacy policy and Apple privacy policy.

We may also disclose information to professional advisers, regulators, courts or law-enforcement bodies where reasonably necessary and legally permitted, or in connection with a sale or restructuring of the business subject to appropriate safeguards.

We do not sell personal data. We do not share it for third-party advertising, and we do not track you across other companies' apps or websites.

International processing

Some providers process information outside the United Kingdom, including in the United States and on global infrastructure. Where required, those transfers are covered by adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, contractual safeguards such as the UK International Data Transfer Addendum, or another lawful transfer mechanism made available by the provider.

You may contact us for more information about the safeguards relevant to your data.

Retention

We keep information only for as long as needed for the purposes above:

• We do not retain your Screen Time report information on our systems.
• Local preferences remain on your device until you change them, reset them or delete the app.
• A current notification registration is removed after the app detects that notifications are no longer permitted, when the registration is explicitly removed, or when the messaging provider reports it as invalid. Firebase may take up to 180 days to remove installation data from live systems and backups after deletion is requested.
• Firebase Crashlytics generally retains crash traces and associated identifiers for 90 days before beginning deletion.
• Anonymous identity and purchase records are retained for as long as needed to operate and restore lifetime access, resolve disputes, prevent fraud and meet legal or accounting requirements. Relevant transaction records may be kept for up to six years after our relationship or the relevant transaction ends, and longer where law requires.
• Analytics event-level information is retained according to our Firebase project settings for the period needed to understand and improve the app. Aggregated statistics that no longer identify an installation may be retained for longer.
• Support correspondence is retained while we handle your request and afterwards only for as long as reasonably needed for follow-up, security, disputes or legal obligations.
• Website security logs are retained by our host according to its operational retention periods.

Deletion from backups and processor systems may take additional time.

Your rights

Depending on the circumstances, UK data-protection law may give you rights to:

• access personal data we hold about you;
• correct inaccurate information;
• ask us to erase information;
• restrict or object to processing;
• receive certain information in a portable format; and
• withdraw consent without affecting processing that was lawful before withdrawal.

Because ST Replay uses an anonymous identifier, we may need information from the app or a purchase record to locate the correct data. We will not ask for more information than reasonably necessary to verify and complete a request. Some information may need to be retained where required by law or to establish, exercise or defend legal claims.

Send requests to help@streplay.app. We normally respond within one month, although the law permits an extension for particularly complex or numerous requests. You may also complain to the UK Information Commissioner's Office at ico.org.uk, although we would appreciate the opportunity to address your concern first.

Your right to object: where we rely on legitimate interests, you have the right to object to that processing based on your particular situation. You can disable basic analytics and crash diagnostics in the app at any time, or contact us about any other objection. We will stop the processing unless we have compelling legitimate grounds to continue or need the information for legal claims.

If EU GDPR applies to you, you may also complain to the data-protection supervisory authority in the EU or EEA country where you live or work, or where you believe an infringement occurred.

Children

ST Replay is not designed to collect a child's name or contact details. If you are not old enough to agree to these terms or privacy choices under the law where you live, a parent or guardian must make those choices for you. If you believe a child has provided personal data to us improperly, please contact us.

Security

We use reasonable technical and organisational measures designed to protect the limited information we process. No internet or storage system is completely secure, so we cannot promise absolute security.

Changes to this policy

We may update this policy when ST Replay, our providers or the law changes. We will publish the revised policy at streplay.app/privacy and update the date above. If a change materially affects a choice that requires consent, we will ask again where required.

Contact

Questions, requests or privacy concerns can be sent to help@streplay.app.