ClearHour · Cerevio Technologies

ClearHour Privacy Policy

Last updated: October 23, 2026

Effective date: 30 August 2026

This update explains optional product analytics in versions where the feature is enabled and you give permission. Advertising measurement is not enabled by this update.

1. Who we are and what this policy covers

ClearHour: Dumbphone OS ("ClearHour", Android application ID io.clearhour) is provided by Wei Zhang, a sole proprietor trading as Cerevio Technologies (Einzelunternehmen), with a business address at Gertrud-Grunow-Str. 20, 80807 Munich, Germany ("Cerevio Technologies", "we", "us", or "our"). ClearHour is intended for worldwide distribution to people aged 18 or older.

This policy explains how the ClearHour Android app accesses, uses, stores, transmits, shares, and deletes information. It does not govern Android, Google Play, phone manufacturers, Firebase, Google Cloud, WhatsApp, email providers, or other apps and services that have their own privacy policies.

This policy also covers the limited technical data processed to deliver the public ClearHour website at clearhour.cereviogroup.com.

For privacy questions or requests, contact support@cereviogroup.com.

2. Privacy at a glance

ClearHour is designed to work primarily on the user's phone.

• ClearHour checks installed apps and selected system-package facts on the phone so it can show launcher apps, recognize reviewed phone features, and apply the rules chosen by the user.
• The installed-app inventory, app rules, schedules, Accessibility observations, Recovery records, and detailed My Stats history stay on the phone. Optional analytics uses separate information about ClearHour, as explained under Optional analytics.
• ClearHour does not read typed text, passwords, messages, notifications, screen contents, or the contents of other apps through Accessibility.
• When enabled and with your permission, private product analytics helps us improve setup and understand how ClearHour features, trials and purchases are used. ClearHour contains no advertising SDK or remote crash-reporting SDK, and this private analytics service sends nothing to advertising companies.
• A ClearHour account is optional for Free use and is required only to purchase or restore paid access.
• ClearHour uses the internet for optional account and purchase operations, signed compatibility information, a narrowly scoped phone-function compatibility report that the user explicitly reviews and submits, and optional product analytics when enabled and allowed.
• ClearHour does not sell personal or sensitive information.

3. Information ClearHour handles on the phone

3.1 Installed apps and phone features

ClearHour uses Android package visibility, including the QUERY_ALL_PACKAGES permission, to perform its core app-control function. It may access:

• installed package identifiers, application labels, icons, versions, enabled state, and current launcher entries;
• for specifically reviewed phone and system features, component identity, signer or signing lineage, installer and system provenance, exported/enabled state, Android roles or defaults, and the result of narrowly defined capability checks; and
• limited migration history recording a package identity and installation generation, its former ClearHour state, the reason for a change, and whether the user acknowledged that change.

ClearHour may prepare app information when you open the welcome screen, but applies your rules only after you continue setup. The installed-app inventory and migration history stay on the phone and are not uploaded to our services.

3.2 Accessibility and foreground-app evidence

If the user enables ClearHour's Accessibility service, ClearHour processes the current foreground package and window-class identity, event and elapsed times, service-connection state, and limited evidence needed to decide whether to display ClearHour's interruption screen and to verify that protection is operating.

ClearHour does not use Accessibility to read or store node text, typed text, passwords, messages, notifications, URLs, screenshots, or the contents of another app. Accessibility observations are not transmitted off the phone.

3.3 Rules, reliability, and proof information

ClearHour stores app-private information needed to operate the product, including:

• the Clear Hour schedule, apps selected under Your Apps (Utility Slot), Timed Access settings, quota and grants, activation time, and optional Uninstall Protection choice;
• permission and reliability evidence, such as notification status, battery-optimization status, OEM startup confirmation, Accessibility health, interruption proof, and Device Administrator status;
• Recovery Pass allowance, timestamps, and the reason entered by the user;
• Weekly Proof events, including an event identifier and type, time evidence, process and boot identity, relevant package identity, duration, and completeness or gap evidence;
• signed compatibility-catalog revision and update information; and
• local release diagnostics consisting only of a fixed diagnostic code and a coarse hour. These diagnostics contain no stack trace, app/package identity, user text, or network upload.

Current versions use My Stats in place of Weekly Proof. Its per-app opening evidence and screen-time history remain on the phone. Optional private analytics can collect separate daily totals of confirmed blocking screens and Timed Access starts, plus weekly pause-duration totals. These summaries contain no app/package names, individual opening timestamps, selected-app lists or screen time for particular apps. Analytics permission does not authorize uploading the My Stats database or Accessibility observations.

3.4 Support preview and user-directed sharing

When the user opens Setup Support, ClearHour can build a temporary, editable preview containing the user's problem description, ClearHour permission-health results and issue codes, and device facts such as manufacturer, brand, model, device code, OEM and Android versions, security/update level, ClearHour version, build type, time zone, and timestamp.

This preview excludes the installed-app inventory, foreground-app history, ClearHour rules and schedules, notification content, URLs, screen contents, serial number, Android ID, device name, and stable advertising identifiers. ClearHour does not retain or send the preview automatically. The user must review it and choose to copy it or pass it to an email or messaging app.

The user may also choose to share selected Weekly Proof aggregates through Android's share sheet. The default share text excludes app/package names, exact event times, schedules, Recovery reasons, permission history, and account identity. The receiving app and the Android clipboard apply their own privacy and retention practices.

4. Information collected when an account is used

ClearHour Free works without an account. If the user chooses to purchase or restore paid access, ClearHour supports Google sign-in and passwordless verified email-link sign-in through Firebase Authentication.

For account operation, ClearHour and its service providers process:

• a random internal ClearHour user identifier;
• the Firebase Authentication subject and verified Google or email-link provider association;
• the verified email address supplied by the authentication provider, which may be displayed in the app;
• for Google sign-in, profile information returned by Google and held by Firebase Authentication, which may include a display name and profile-photo URL even though ClearHour does not use those fields for product decisions;
• authentication and session-security information needed to verify, link, revoke, and delete the account; and
• minimal account creation, provider-linking, and deletion state.

Email is not used as the primary ClearHour database key, and ClearHour does not merge accounts merely because two providers report the same email address. Raw sign-in tokens and magic links are not logged by ClearHour.

ClearHour accounts do not synchronize installed apps, rules, schedules, Recovery records, detailed My Stats history, Accessibility observations or activity in other apps. If product analytics is enabled and allowed, the limited ClearHour configuration and interaction data described below may be used for private reporting. Signing in alone does not give that permission.

With analytics permission, information from an installation may be linked to your account to understand trials and purchases. We also use this link to recognise deleted accounts and remove their linked analytics, as explained in Section 10.4.

5. Purchases and subscriptions

Purchases are processed by Google Play Billing under Google's terms and privacy policy. ClearHour does not receive or store the user's full payment-card or bank-account details.

To verify and restore paid access, the app sends an opaque Google Play purchase token to the ClearHour billing service together with an authenticated ClearHour session. The service verifies the purchase with Google Play and associates the verified product, base plan, subscription status, trial status where applicable, and entitlement with the random ClearHour user identifier. The raw purchase token is not logged; the service keeps a token-derived ownership record so that a purchase cannot be claimed by multiple ClearHour accounts.

Deleting a ClearHour account does not cancel a Google Play subscription. Subscriptions must be managed separately in Google Play.

Necessary purchase verification and paid access work independently of analytics permission. With analytics permission, verified trial and payment history may also be used in private reports. Analytics does not include your sign-in credentials, raw purchase tokens, email address or payment-card details.

6. Compatibility information and optional reports

6.1 Signed compatibility information

ClearHour may download a signed compatibility catalog from an HTTPS endpoint controlled by Cerevio Technologies. The catalog contains reviewed phone and system-component rules. The request exposes ordinary network metadata to the service, such as IP address, request time, and app user-agent. It does not include the phone's installed-app inventory or ClearHour rules.

6.2 User-submitted phone-function reports

If ClearHour may have blocked a basic phone function, the user may choose to create one technical compatibility report. Before submission, ClearHour shows a specific disclosure and asks the user to select the affected function and confirm submission. Reports are never created or sent merely because the user views an ordinary app, and they are never submitted automatically without this choice.

A submitted report may contain:

• a random report identifier, consent time, and selected phone-function category;
• ClearHour version and compatibility-catalog revision;
• phone manufacturer, brand, model, Android API level, and build fingerprint;
• the single affected app's label, package and component, version, system-app status, enabled/exported/resolvable state, signer digests, and matching reviewed Android actions;
• the relevant local recognition proof and ClearHour policy decision; and
• a restricted transition containing only the affected component and, when available, its immediately preceding system component.

The report does not contain the complete installed-app inventory, Accessibility text, screenshots, messages, notifications, URLs, typed text, ClearHour schedules, Recovery reasons, or Weekly Proof history.

When a report is received, a private operational alert may be sent to the ClearHour support team. That alert is limited to the report identifier, device model, affected package, function category, system-app flag, and a protected internal review link. It does not contain the raw report or its private deletion proof.

6.3 Report responses and optional email

In versions supporting report responses, ClearHour stores a private response credential on the reporting phone. When ClearHour or Clear Home is opened or resumed, it may check for responses to that phone's reports, with a cooldown between checks. A report number alone cannot retrieve a response. No account or email is required for in-app responses.

You may separately select Email me when a fix is available and supply an editable email address. That option starts unchecked for each report. A prefilled address does not give consent or send it. If you submit with email updates selected, your address and consent time are stored separately from the technical report, without linking the report to your ClearHour account. The phone can remember your chosen support address locally for the next report.

Brevo delivers these requested report-update emails. They contain the response, report reference and update instructions, rather than raw diagnostics or private response/deletion credentials. Each email includes a report-specific unsubscribe link; stopping email updates leaves the report and in-app response available. Deleting the report also stops future report emails. A message already being sent may still arrive. Delivered copies remain subject to the recipient's mailbox settings and the delivery provider's processing practices.

7. How we use information

We use information only as needed to:

• provide the app-control, schedule, Timed Access, Recovery, Weekly Proof, local app search, and permission-health features requested by the user;
• recognize reviewed essential phone functions and keep package decisions accurate after installs, updates, launcher changes, and removals;
• authenticate accounts, prevent unsafe account merging, verify purchases, restore paid access, and handle account deletion;
• provide signed compatibility updates and investigate a compatibility report the user chose to submit;
• secure, maintain, troubleshoot, and defend ClearHour and its services; and
• comply with applicable legal obligations.

ClearHour does not use installed-app or Accessibility information for advertising, marketing profiles, or sale to data brokers.

Optional analytics

When this feature is enabled, we ask your permission to use analytics to understand what works and improve ClearHour. This includes information about:

• How you use ClearHour, such as setup progress, settings, feature use and technical issues. Feature use includes totals of blocking screens, Timed Access starts and pause duration.
• Your app and device, such as app version, device type, language and randomly generated identifiers. These identifiers distinguish installations and interactions without using hardware or advertising IDs.
• Trials and purchases, including subscription, payment and refund history linked to your account where you allow it.

Your installed-app list and activity inside other apps are not included in these analytics. We do not share this analytics information with advertising companies. The records use codes rather than your name, but may be linked to your account; they are not anonymous.

Analytics is optional. You can turn it off anytime in Settings → Analytics and continue using ClearHour. We then stop new collection and remove the earlier analytics history as explained in Section 10.4. Allowing analytics later does not restore that history.

Our providers, retention periods and your rights are explained in Sections 8–13 below.

Referral information

Separately, versions with Cerevio referral tracking enabled use Google Play Install Referrer to recognise referred installations. We process installation and referral information, such as a random installation identifier, ClearHour version, referral code and click/install times. If you sign in, a verified referral may be linked to your ClearHour account.

This uses Google Cloud and is separate from optional analytics permission. It does not include your installed-app inventory or activity inside other apps. The analytics retention periods below do not apply to this separate system. For questions or deletion requests, contact support@cereviogroup.com.

8. Service providers and disclosure

Depending on the features used, information may be processed by:

• Google Firebase Authentication, for Google and passwordless email-link authentication;
• Google Cloud services, for ClearHour's account, billing, compatibility, and support backend;
• Google Play, for purchases, subscriptions, purchase verification, and entitlement status; and
• Cloudflare, to deliver and protect the public ClearHour website. Cloudflare may process ordinary request metadata such as IP address, request time, requested URL, user-agent information, and security information. The website does not use analytics, advertising trackers, or non-essential cookies in this implementation; and
• Brevo, for private operational report alerts and the report-update emails you separately requested; and
• an email, messaging, clipboard, or share-sheet destination selected by the user for an explicit support or Weekly Proof share.

When optional private product analytics is enabled, Google Cloud also provides its receiving, storage and reporting infrastructure under Cerevio Technologies' instructions. Cloudflare can deliver protected reporting pages and proxy approved requests to Google Cloud on the ClearHour website domain. The website has no separate analytics database. Those private routes do not add advertising or visitor-analytics tracking to the public marketing pages.

These providers process information under their own terms or under agreements with Cerevio Technologies, as applicable. We may also disclose information where required by applicable law, a valid legal process, or to protect users, ClearHour, Cerevio Technologies, or others from fraud, abuse, or security threats.

We do not sell personal or sensitive information and do not share it for cross-context behavioral advertising.

9. Retention

• Installed-app evidence, ClearHour settings, permission/reliability state, Recovery records, and non-authorizing migration history remain locally until replaced by current evidence, reset by the user, cleared through Android, or deleted when the app is uninstalled.
• Legacy Weekly Proof events retain their previous 35-day/10,000-event limit before migration. Current My Stats retains local detail for 14 calendar days and summaries for 365 days, with a 50,000-raw-attempt cap. Per-app records stay local.
• Analytics waiting to be sent is kept on the phone for up to seven days.
• Detailed analytics is scheduled for deletion after 90 days from receipt. Verified financial information used for analytics is scheduled for deletion after 400 days from receipt.
• A limited summary of setup progress, together with installation, account-linking and consent records, is scheduled for deletion after 400 days of inactivity. This includes limited information needed to respect withdrawn permission and count installations where analytics ended; it is not a full activity history.
• Turning analytics off removes its earlier history from reporting and starts deletion. Deletion is processed in stages, so outages may delay removal of stored copies. The phone keeps your latest consent choice until you change it, clear app data or uninstall ClearHour.
• Local release diagnostics retain no more than 50 distinct diagnostic-code/coarse-hour entries.
• A compatibility report waiting to be sent remains on the phone until accepted by the service, deleted by the user after a failed submission, Android app data is cleared, or ClearHour is uninstalled. A rejected report is shown as Not submitted and is not treated as received.
• An accepted compatibility report is retained by Cerevio Technologies for no more than 90 days unless the user requests earlier deletion from ClearHour Settings. The reporting phone stores a private deletion token and payload proof until deletion succeeds, app data is cleared, or ClearHour is uninstalled.
• Report responses, optional email/contact consent and delivery records in ClearHour's backend expire with the associated report within its 90-day period and are removed on earlier report deletion. Stopping emails removes the contact address for that report. The locally remembered support address remains until replaced, app data is cleared or ClearHour is uninstalled. Delivered email copies are subject to recipient mailbox and delivery-provider practices.
• Account and verified-provider mappings are retained until the ClearHour account is deleted.
• Billing purchase-ownership claims, entitlements, upgrade offers, and promotional authority are removed from ClearHour's active datastore when confirmed account deletion completes.
• Promotional-code redemption throttles are retained only until the end of their 15-minute rate-limit window and are then removed through an active datastore expiry policy. They use a pseudonymous document key, and any throttle associated with an account is also removed during account deletion.
• When an account that redeemed a promotional code is deleted, the code record is detached from the internal user identifier. The resulting digest-based code record may be retained for no more than 180 days for campaign reconciliation and abuse prevention. It contains no email, raw code, or ClearHour user identifier and is removed through an active datastore expiry policy.
• Promotional operator-audit records may be retained for no more than 180 days for security and campaign accountability. They may identify the authorized operator but contain no app user's identifier or email, raw promotional code, or code digest, and are removed through an active datastore expiry policy.
• Google Play real-time billing-delivery metadata used for deduplication and reliable entitlement updates is retained for no more than 30 days through an active datastore expiry policy.
• Ordinary application and request logs in the production Google Cloud project's default log bucket are retained for 30 days. Google-required administrator and system audit logs are retained for 400 days. ClearHour does not intentionally log raw authentication, deletion, or purchase tokens.
• The active Firestore database uses a European multi-region and has no configured backups or point-in-time recovery. With point-in-time recovery disabled, historical database versions may remain available to the service provider for up to one hour after a write or deletion.
• Firebase Authentication may retain sign-in security logs, including IP addresses, for a few weeks. After Cerevio Technologies deletes a Firebase Authentication user, Google states that the associated authentication information is removed from live and backup systems within 180 days.
• Privacy or support correspondence and the minimal case record needed to document the request and response may be retained in a restricted mailbox for up to 24 months after the case is closed, then deleted unless a longer period is required for a legal claim or obligation.
• We may retain a record longer only where required to comply with law, establish or defend legal claims, or respond to fraud or security abuse. If that applies, access is restricted and the record is removed when the exception no longer applies.

Android cloud backup and device-to-device transfer are disabled for ClearHour app data. No backups or exports are currently enabled for the separate private analytics database. Any private analytics infrastructure backup has a separate retention/deletion process; deleting an active record does not itself erase an already retained backup.

10. Deletion and user choices

10.1 Delete local ClearHour data

Users can delete local ClearHour data by clearing ClearHour's storage in Android Settings or by uninstalling ClearHour. If optional Uninstall Protection is active, the user must first disable ClearHour as a Device Administrator through the authorized in-app flow and Android settings. Clearing storage removes local rules, schedules, Recovery records, permission confirmations, Weekly Proof, diagnostics, and locally pending compatibility reports. Android permissions and special access may need to be removed separately in Android settings.

10.2 Delete a compatibility report

A user can delete a failed, not-submitted report locally. For an accepted report, the reporting phone can request early remote deletion from Settings → Phone-function reports while its private deletion token is still available. Accepted reports are removed automatically after no more than 90 days even if that token has been lost by clearing app data or uninstalling.

10.3 Delete a ClearHour account

Users can request permanent account deletion in Settings → Account → Delete account or through the public account-deletion section. Deletion requires recent authentication and removes the ClearHour account, authentication-provider mappings, and Firebase Authentication user. It does not delete local settings from the phone and does not cancel a Google Play subscription.

During confirmed deletion, ClearHour deletes active purchase-ownership claims, entitlements, upgrade offers, promotional authority, and promotional redemption throttles. Redeemed promotional code records are revoked and detached from the internal user identifier. The limited deidentified and operational-retention exceptions, including service-provider deletion periods, are described in Section 9.

Linked analytics is deleted separately, as explained below, and may take longer than deleting the account itself.

10.4 Optional private analytics

Turn off Improve ClearHour under Settings → Analytics to stop new collection, clear analytics waiting on the phone and request removal of the earlier history from our service. The request needs an internet connection; stored copies may take longer to delete during an outage. Limited consent records remain as described in Section 9.

We also check whether linked ClearHour accounts have been deleted or are no longer active. Once confirmed, their linked analytics is excluded from reports and scheduled for deletion. These checks and deletion take time. Information that can no longer be linked to the account follows its own analytics retention period.

Uninstalling, clearing app data or signing out does not by itself delete analytics already on our servers. You do not need an account to make a privacy request: contact support@cereviogroup.com. We may need information to locate and verify your records. Never send sign-in, payment or private deletion credentials by email.

11. Security

ClearHour stores local information in Android app-private storage protected by Android's application sandbox. Android backup and device transfer are disabled. Cleartext network traffic is disabled, and supported network operations use HTTPS. Compatibility catalogs are cryptographically verified before use. Authentication and deletion operations require verified sessions, and sensitive raw authentication, deletion, and purchase tokens are not intentionally logged.

We use access controls and service boundaries intended to restrict remote information to authorized operations and personnel. No storage or transmission method is completely secure. A compromised, rooted, ADB-authorized, or physically unlocked device may expose local information.

12. Legal bases and privacy rights

Where the EEA, United Kingdom, or another jurisdiction requiring a legal basis applies, we expect to rely on:

• performance of a contract or steps requested by the user to provide accounts, purchases, and paid entitlements;
• the user's consent for optional product analytics, compatibility-report submission, separately requested report emails and user-directed sharing;
• legitimate interests in operating, securing, and improving compatibility of ClearHour, where those interests are not overridden by the user's rights; and
• compliance with legal obligations where required.

Optional product analytics also follows applicable consent requirements for access/storage on the phone. Necessary account authentication, purchase verification and security remain independent of that choice. The separate referral mechanism described above is not granted permission by accepting product analytics.

Depending on local law, users may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent, and to complain to a competent data-protection authority. To exercise a right, contact support@cereviogroup.com. We may need to verify the requester's identity. Withdrawing consent does not affect processing already carried out lawfully. We aim to acknowledge privacy inquiries within seven business days. Applicable legal deadlines govern the complete response.

Users may also lodge a complaint with a competent supervisory authority. For Cerevio Technologies in Bavaria, this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

13. International processing

ClearHour's production Firestore database is configured in Google's eur3 European multi-region, and its account, billing, compatibility, and support services run in europe-west1 (Belgium). Firebase Authentication is operated by Google from the United States, and Google Cloud logging, support, security, and subprocessor operations may process information in other countries.

Where European data-protection law applies to a restricted international transfer, Cerevio Technologies relies on the safeguards in Google's Cloud Data Processing Addendum, including applicable Standard Contractual Clauses or another recognized transfer solution. Google Play and other user-selected apps may process information under their own privacy terms and transfer safeguards.

Optional private analytics, when enabled, uses Google Cloud under Cerevio Technologies' control and the applicable Google data-processing terms. Its receiving API and scheduled maintenance service run on Cloud Run in europe-west1 (Belgium), and its separate Firestore database uses the eur3 European multi-region. Cloudflare delivers the protected website pages and proxies requests; the analytics database remains in Google Cloud. These regional settings do not limit all provider support, security or subprocessor operations to those regions. No advertising provider is introduced by this amendment. Brevo processes requested report-email delivery under its applicable privacy and processing terms; its provider-held delivery records and copies are separate from ClearHour's report storage.

14. Children's privacy

ClearHour is intended only for people aged 18 or older. It is not a parental-control service, is not directed to children, and is not designed to monitor another person's device. Official Google Play distribution selects Ages 18 and over as the only target audience and enables Restrict Minor Access. We do not knowingly collect personal data from anyone under 18. Anyone who believes that a person under 18 has provided personal data to ClearHour may contact support@cereviogroup.com to request its deletion.

15. Changes to this policy

We may update this policy when ClearHour's features, service providers, or legal obligations change. We will update the date at the top of the policy and, where required, provide additional notice in the app or through the store listing before a material change takes effect.

16. Contact

ClearHour privacy contact and data controller

• Controller: Wei Zhang, sole proprietor trading as Cerevio Technologies (Einzelunternehmen)
• Address: Gertrud-Grunow-Str. 20, 80807 Munich, Germany
• Email: support@cereviogroup.com