Last updated: November 1, 2026Applies to: the Lesso app for AndroidTerms of Use
Lesso is an app that helps reduce scrolling time on social media using a system of time tokens.
This document explains in plain language what data is collected, what it is used for, and who it is shared with.
01 What data is collected
Data stored in the user's account
Type of data
Purpose
Email address, name, encrypted password
Creating an account and signing in to the app
Usage events (session start, token use, end of browsing)
Running the token system and showing personal summaries
Device token for push notifications
Sending reminders and updates from the app
Device type and operating system
Technical support and improving app compatibility
Anonymous in-app usage events (for example opening the app, onboarding steps, taps on main buttons, and which social media apps were chosen for supervision from the supported list)
Understanding general usage patterns and improving the app, via Firebase Analytics. These do not include a name, email address or screen content
Crash reports and technical errors (error description, device model, operating system version and app version)
Finding and fixing bugs and improving app stability, via Firebase Crashlytics. These do not include a name, email address or screen content
02 Special Android permissions
Lesso asks for two sensitive permissions that are required for blocking to work, plus one optional permission, and uses them only for the purposes described:
Accessibility Service: used to detect when one of the apps the user chose to block (such as Instagram or TikTok) is opened, and to return the user to Lesso's pause screen when the allotted time is up. The service does not read, record or analyze screen content in any other app. It only checks which app is currently open.
Display over other apps: used to show the floating timer bubble over the blocked app, so the user can see how much time is left.
Usage Access (optional): if the user allows it, the app reads how much time was spent in the supported social networks and in apps added for blocking, to show the statistics. In addition, the "More apps" window shows each app's weekly usage time, to help choose which apps to add. All of this data stays on the device and is not sent to the server.
03 Who the data is shared with
The data is not sold and is not shared for advertising. It is processed by the following providers, solely to operate the service:
Supabase: database storage (user account, usage events, notification token). All data is stored only in a secure database with restricted access permissions, and is not shared with spreadsheets or any other external tools.
Firebase Analytics (Google): receives anonymous in-app usage events (for example opening the app, completing onboarding steps, tapping main buttons), as well as which social media apps (from the fixed list the app supports) the user chose to supervise, in order to analyze general usage patterns and improve the app. It does not receive a name, email address, password or screen content, and the data is not used for advertising.
Firebase Crashlytics (Google): receives crash reports and technical errors (error description, device model, operating system version and app version) so that we can find and fix bugs. It does not receive a name, email address, password or screen content, and the data is not used for advertising.
Pexels: an external video library that provides calming nature videos on the "soft landing" screen at the end of a session. It does not receive any identifying data about the user.
04 Data retention and deletion
Data is kept for as long as the Lesso account is active. To request deletion of the account and all data associated with it:
Send an email to support@lessoapp.com from the email address registered to the account, with the subject "Lesso account deletion request".
The request will be handled within up to 14 business days, and a confirmation email will be sent once the deletion is complete.
Once the request is approved, the email address, name, password (encrypted) and notification token associated with the account are permanently deleted. Usage events (session history and token use) are not deleted. Instead, they are permanently disconnected from your identity and kept in anonymous form only, with no way of linking them back to you, in order to preserve the research value of the aggregated data. There is no additional retention period beyond the time needed to handle the request itself.
05 Security
Communication between the app and the servers is encrypted (HTTPS), and user passwords are stored as an encrypted value (hash), not as plain text.
Access to the database is restricted using row-level access policies (Row Level Security).
06 Changes to this policy
If this privacy policy is materially updated, the "Last updated" date at the top of this page will change accordingly.
We recommend checking this page from time to time.