Privacy Policy

Last updated: June 17, 2026

ScrollJail is built to fight manipulation, not practice it. This policy explains what data we collect, why, and what we do with it.

What we collect

When you set up ScrollJail:

• Email address - to verify your account.
• First name - so the AI can address you personally.

Each time the Shortcut runs:

• App name - which app triggered the Shortcut.
• Your reason - what you typed when asked why you're opening the app.
• Device time - the timestamp from your device.
• AI decision and response - the decision (allow/deny/challenge), message, and timing metadata.

Additionally, our infrastructure collects:

• IP address - used for rate limiting to prevent abuse. Cloudflare processes your IP as part of routing requests. We do not store IP addresses in our database, but Cloudflare may retain them in server logs subject to Cloudflare's privacy policy.

How we use your data

• Email - account verification, essential service emails, and marketing emails (product updates, re-engagement, and similar). You can opt out of marketing emails at any time via the unsubscribe link in each email. We don't sell your email address.
• Attempt data (app, reason, decision) - to power the AI's context-aware responses. The AI uses your recent attempts to adjust its behavior (e.g., getting stricter if you keep coming back).
• IP address - rate limiting only. Not linked to your account or attempt data.

Third-party services

ScrollJail relies on the following services to function:

• Cloudflare - hosts the backend. Processes your IP address and request metadata. See their privacy policy.
• Neon - database hosting. Stores your account and attempt data. See their privacy policy.
• Anthropic, Google (Gemini), OpenAI - AI processing. Your reason may be sent to one of these providers' APIs to generate a response, depending on which model is active. See their respective privacy policies: Anthropic, Google, OpenAI.
• Resend - sends emails. Receives your email address for delivery. See their privacy policy.

Legal basis for processing (GDPR / DSGVO)

• Contract performance (Art. 6(1)(b)) - processing your email, name, and attempt data to provide the ScrollJail service.
• Consent (Art. 6(1)(a)) - sending marketing emails. You give this consent when you tick the checkbox at sign-up and can withdraw it at any time.
• Legitimate interest (Art. 6(1)(f)) - IP-based rate limiting to protect the service from abuse.

What we don't do

• We don't sell or share your personal data with advertisers
• We don't use cookies or cross-site tracking
• We don't access your contacts, photos, or browsing history
• We don't collect data from apps you haven't blocked

Analytics

We collect two types of analytics data:

• Cloudflare Web Analytics — provides aggregate traffic data (page views, referrers, device types). No cookies, no cross-site tracking, no personal data. See Cloudflare Web Analytics.
• Custom site analytics — we record page views and button clicks on scrolljail.com ourselves. Each page view stores the URL path, referrer, country (derived from your IP by Cloudflare, not stored directly), and a short-lived fingerprint used only to count unique visitors per day. No cookies are used. This data is aggregated and retained for 1 day before being rolled up into anonymous daily totals.

Data retention

Your account and attempt history are retained as long as you use ScrollJail. If you want your data deleted, email privacy@scrolljail.com and we'll wipe everything within 7 days.

Your rights

You can request a copy of all data we hold about you, ask us to correct it, or ask us to delete it entirely. Email privacy@scrolljail.com.

Children

We do not knowingly collect data from anyone under 16.

Changes

If we change this policy, we'll update the date at the top. For significant changes, we'll notify you by email.

Data controller

Moritz Schultz — privacy@scrolljail.com

Contact

Questions? Email privacy@scrolljail.com.