What RANSOM knows about you, and what it doesn't

Applies to the RANSOM app (vn.ransom.app) on Android and iPhone, plus ransom.uranashel.com. Effective 15 November 2026.

1. Who runs RANSOM

RANSOM is built and run by an indie developer in Vietnam under the studio name uranashel. On this page, "RANSOM", "we", or "us" refers to the app and its developer.

Any privacy questions or requests can go straight to uralab95@gmail.com.

2. Signing in without an account

The first time you open RANSOM, your phone creates a random device ID and an Ed25519 signing keypair. Your private key stays on your device. Every request to the server is signed with that key, so there is nothing to register or log into.

Because there is no login, switching phones or wiping the app starts fresh: active locks and old friend links can't transfer over. If you paid for RANSOM Pro, you can bring it back under the same Apple ID or Google account via Restore purchase.

3. What leaves your phone

This is the full list. Nothing outside it is sent to our server:

Device ID & public key

Your phone's random UUID, public verification key, OS platform (Android or iOS), app version, and chosen language (vi or en).

Why: lets the server check that requests genuinely come from your phone.

Display name

Whatever name you type, up to 30 characters. It doesn't need to be your real name.

Why: helps friends recognize who is asking them to hold a key.

Chôm avatar or optional photo

You can pick a built-in Chôm face or upload a photo. Before anything uploads, the app crops it square, shrinks it to at most 256 px and 48 KB, and strips EXIF tags like GPS location and camera model.

Why: only people sharing a lock or group with you can load it. Uploaded photos aren't reviewed before friends see them; anyone in a lock can report or block abusive images.

Lock details (without app names)

The lock name you write (such as "Exam prep"), the count of locked apps, lock type, start time, release time, repeating schedule (days, hours, timezone) if set, and how the lock ended.

Why: lets key keepers see how long a lock runs and when it opens.

Signature strokes

The strokes you draw when starting a lock, agreeing to hold a key, or allowing a friend to lock you remotely.

Why: shown on the shared pledge card for you and your friend.

Key keepers, invite codes & groups

Which device ID holds a key for which lock, temporary 6-digit invite codes, and memberships in group locks (up to 4 friends).

Why: routes rescue requests to the right people and keeps group timers synced.

Call for help requests & replies

Your short note, requested minutes, friend responses (minutes granted, refusal, or a task), written task answers, and signed unlock tokens.

Why: so your friend sees what you asked and your phone verifies the unlock is authentic.

Banter & lock timeline

Short messages up to 80 characters, built-in stickers, reactions, pokes, and timeline events (lock started, keeper joined, rescue sent, unlocked, auto-released, emergency unlock started).

Why: visible to people inside that same lock or group.

Focus proof (Pomodoro)

Uploaded only if you attach it to a rescue or complete a "Do 1 pomodoro" task: round length, start and end times, clean/not-clean status, and your goal line only if you turn on Send my goal too.

Why: proves a completed focus round without naming any apps.

Remote lock invitations, dares & limits

Invite or dare title, minutes, short note, plus the limits you set for one friend: app count, max minutes per lock and per day, allowed hours, expiry date, whether adding time is allowed, signed orders, and whether your phone accepted or turned it down (for instance, if the blocker was off).

Why: enforces the exact rules you chose and lets the sender know if the request didn't go through.

Daily totals (opt-in)

Off by default. If you switch on Share my daily blocked count in the Me tab, your phone uploads two daily totals: blocked attempts and estimated minutes saved. Never broken down by app.

Why: powers optional weekly totals. Turning it off deletes previously sent daily totals right away.

Push notification token

Your FCM (Google) or APNs (Apple) token and any quiet hours you set. Notification payloads carry only event types and IDs. No display names, lock titles, or chat messages travel through Apple or Google push servers.

Why: lets your phone ping when a friend asks for or answers a rescue.

RANSOM Pro receipts

Store purchase references (Google Play purchase token or Apple original transaction ID), product ID, entitlement state, and expiry date tied to your random device ID.

Why: verifies Pro access with Apple and Google. RANSOM never sees your card number, bank details, or billing address.

Crash reports (opt-out)

On by default and switchable off anytime under Me → Send crash reports. Sent to Google Firebase Crashlytics: stack traces inside RANSOM code, app version, phone model, OS version, free RAM/storage, and a Firebase installation ID. Never includes names, lock titles, chat text, or app names.

Why: helps track down and fix crashes quickly.

Feature counts (opt-in)

Off unless you opt in, and toggleable under Me → Share usage numbers. Sends basic feature events to Google Firebase Analytics (such as lock started with app count, keeper joined, rescue sent/answered, emergency unlock, paywall opened/purchased, plus Firebase basics like install ID, OS/app version, device model, language, and rough country). No ad ID, names, lock titles, messages, or app names.

Why: shows which features actually work well and what breaks.

Reports & blocks

The reason you picked and optional note when reporting a person, message, or photo, plus device block pairs.

Why: lets us step in on harassment and keep blocked users apart.

Technical traces

IP addresses pass briefly through memory/proxy rate limiters to stop invite-code guessing and spam. Technical request logs (time, device ID, endpoint, status code) rotate and overwrite automatically.

Why: keeps the server stable and blocks abuse.

4. What never leaves your phone

• The names of apps you lock, package names, Apple bundle IDs, or websites.
• Which apps you open, when you open them, or how many minutes you spend in each.
• Screen contents, anything typed outside RANSOM, contacts, library photos, microphone audio, or GPS location. RANSOM never asks for Contacts, Location, Microphone, or SMS permissions.
• Local Pomodoro logs and personal goals (unless you explicitly send focus proof as described above).
• Your device's private signing key.

None of this goes into crash reports, feature counts, or server logs.

5. What friends see about you

Key keepers and people in the same group lock see your display name, Chôm face or avatar photo, lock title, number of apps in that lock, release time, lock status, rescue notes/replies/tasks, emergency unlocks, any focus proof you send, and banter inside that lock or group.

The 30-day "Who's toughest" board shows up only among friends who already share locks or groups with you. There are no public profiles, and strangers cannot search for you.

6. Permissions on your phone

Android: AccessibilityService API

RANSOM asks for Android Accessibility access for just one job: checking which app just moved to the front so Chôm's block screen can cover apps inside an active lock. It does not read screen contents, capture keystrokes, inspect other apps, or tap anything for you. Package checks happen locally on your phone and never leave the device.

When you let a trusted friend lock you remotely, that same local service enforces the limits you approved. You can revoke lock permission or switch off Accessibility in Android Settings anytime without internet, and active locks stop enforcing immediately.

Phone calls, SMS, emergency numbers, Settings, banking apps, e-wallets, maps, ride-hailing apps, and RANSOM itself are never blocked.

iPhone: Apple Screen Time (Family Controls)

RANSOM requests Screen Time / Family Controls access strictly for your own iPhone. You pick apps inside Apple's system picker, which hands RANSOM opaque system tokens we cannot decode into app names. Those tokens stay inside your phone's local storage and App Group container.

Optional permissions

• Notifications: alerts when friends ask for or answer a rescue, plus live countdown timers.
• Photos (system picker): only opened if you choose a custom avatar from your gallery; RANSOM cannot browse your photo library.
• Camera (QR scanner): used purely in memory to scan a 6-digit invite QR code; camera frames never leave your phone.

7. Third-party services & hosting

Apple (APNs) & Google (FCM)

Delivers push alerts using your push token and ID/event-only payloads.

Apple App Store & Google Play Billing

Handles Pro purchases and renewals; our server checks entitlement status directly with Apple and Google APIs.

Google Firebase Crashlytics & Analytics

Collects crash traces (opt-out) and optional usage counts (opt-in). Google keeps Crashlytics logs for 90 days and Analytics event details for 2 months. Ad personalization is turned off and Android AD_ID is removed.

Server hosting

Data listed in section 3 lives on dedicated infrastructure in Malaysia (ransom-api.uranashel.cloud).

Apple and Google process their services outside Vietnam (mainly in the US or regional data centers). We never sell data or share it with advertisers.

8. How long data stays

• Locks, messages & groups: kept until you wipe your data in the app.
• 6-digit invite codes: expire after 24 hours.
• Call for help requests: expire after at most 2 hours.
• Daily blocked totals: removed from the server right away if you toggle sharing off in the Me tab.
• Uploaded photo: deleted from the server immediately when you tap Remove photo; new uploads overwrite the previous file instead of archiving it.
• Unlinked Pro purchase records: after you wipe your data, store transaction references stay unlinked from any deleted device ID so Restore purchase keeps working on a future install, until the plan expires or you ask us by email to delete them.
• Database backups: encrypted backups rotate automatically and purge after 14 days.

9. Your choices

• Delete everything: open Me → Delete all data, or follow the data deletion guide.
• Edit profile details: change your display name or remove your photo anytime in the Me tab.
• Turn off permissions or toggles: switch off daily totals, usage counts, crash reports, revoke remote-lock access, or disable Accessibility / Screen Time in system Settings.
• Ask for a copy or help: email uralab95@gmail.com. We reply within 72 hours (since there are no emails stored in the app, we may ask for display-name or lock clues to make sure it's your phone).

10. People under 16

RANSOM is made for people aged 16 and older. It is not meant for children under 16 and isn't a parental-control tool. If you're a parent and think someone under 16 is using RANSOM, email uralab95@gmail.com and we will erase that device's records promptly.

11. Security

• Traffic between the app and backend always goes over HTTPS/TLS.
• Requests from your phone are signed with your device's private key, and unlock grants are signed by the server before lifting shields on-device.
• Remote-lock commands are signed directly by the granting friend's device; the server alone cannot lock anyone without friend signature checks and your approved limits.

12. Changes & Contact

When we update this policy, we change the effective date above. Any meaningful change to how your data is handled will be shown inside the app beforehand.

Developer: The RANSOM developer (indie developer, Vietnam) · Studio: uranashel
Email: uralab95@gmail.com