Privacy Policy
Last updated: October 13, 2026
XBlock (“the App”) for Android and iOS is made by InnoxApps (“we”, “us”), Noida, India. It blocks adult content and offers optional tools for building better habits. Because what you browse is deeply personal, the App is built so that it never needs to tell us. Questions: ava@innoxapps.com.
The short version
- No account and no sign-in. We never ask for your name, email or phone number.
- Your browsing never leaves your phone. The App checks web addresses and the words you choose to block on your device, and it does not keep a history of them. We never receive the sites you visit, the sites that were blocked, your keywords, screenshots or anything on your screen.
- Your streak, relapse log, journal, reasons and lists stay on your device.
- We use Google Firebase to count how features are used (never which site was blocked) and to receive crash reports, configured not to collect your advertising identifier.
- No ads. We do not sell or share your information, and we do not track you across apps or websites.
- Payments are handled entirely by Google Play or the App Store.
Information stored on your device
- your protection settings, block and allow lists, custom keywords and lock settings (for a partner lock, only what is needed to check the code you enter);
- your streak, milestones, relapse log, journal entries, the reasons you wrote and lesson progress;
- your preferences, such as notifications and theme.
None of this is sent to us. Deleting the App deletes it. On Android, the App opts out of cloud backup; a direct phone-to-phone transfer may copy this data to your new phone. On iOS, if iCloud Backup or a computer backup is on, iOS includes the App's data in that backup, which Apple handles under its terms.
Permissions and what they are used for
Android
| Permission | Why the App asks for it |
|---|---|
| Accessibility service | To read the web address and page title in supported browsers, the search results title in the Google app, and which app is open; with Pro (on by default, and you can switch each one off), whether the Reels, Shorts or Spotlight screen is open in Instagram, YouTube, Facebook or Snapchat, and the search on YouTube and Instagram results pages; and, while a lock you set is on, the titles of the Settings pages you open. The App uses this to block what you chose to block, to turn on SafeSearch in search engines and, while your lock is on, to close Settings pages that would weaken it. This happens on your device: what it reads is not stored as a history and is not sent to us or anyone else (we only count that a block happened; see below). The App asks for your consent before you turn this on. |
| Display over other apps | To show the block screen over a blocked page or app. |
| Device admin (only if you turn on uninstall protection) | Used solely to stop the App being uninstalled while a lock you chose is active. It is not used to control or monitor your device. |
| App list | To show your installed apps if you choose apps to block, and to find installed browsers the App can't read. The list stays on your device. |
| Private DNS (optional) | The App shows you how to set Android's Private DNS to a family-filter service (CleanBrowsing or Cloudflare for Families), and reads which Private DNS host is active to show its status. Once you set it, Android sends its DNS lookups (the names of sites and services it connects to) to that service, whose privacy policy applies. We do not receive them. |
| Notifications | For the daily check-in and streak milestones, if you turn them on. |
| Battery optimisation settings | We may guide you to these settings so Android does not stop protection. The App only opens the settings screen; you decide. |
iOS
| Feature | How it works |
|---|---|
| Screen Time | The App asks Apple's Screen Time to turn on its adult-website filter and, if you choose, to block apps you pick. Apple applies these on your device and does not tell the App which sites you visit or which apps you open. |
| Safari content blockers | Safari applies the App's block rules itself. Safari does not tell the App which pages you visit. |
| Encrypted DNS (optional) | If you turn this on, your device sends its DNS lookups (the names of sites and services it connects to) to the filtering resolver you choose — CleanBrowsing or Cloudflare — instead of your network's default. Their privacy policies apply to those lookups. We do not receive them. |
| Notifications | For the daily check-in and streak milestones, if you turn them on. |
The block page (Android)
When a page is blocked in a browser on Android, the App sends that browser tab to
www.innoxapps.com/xblock/blocked.html, a static page with no scripts or analytics. The
request does not contain the blocked address or anything about it. Like any web server, the host
(Google Firebase Hosting) records the request's IP address and time in standard server logs.
Usage analytics and crash reports
We use Firebase Analytics to count events such as “protection turned on”, “a page was blocked” (without the page), “SafeSearch applied” (only which search engine), “urge screen opened”, “a relapse was logged” (never its date, note or trigger), “lesson opened”, which path you chose during setup, or “paywall shown”, and purchases (which product and its price). They come with your device model, operating-system version, app version, language, approximate location (such as country or city, which Google derives from your IP address), a random identifier Firebase creates for this installation and, on iPhone, Apple's identifier for vendor. It never receives web addresses, hosts, keywords, search terms, journal or log text, your age band or quiz answers, or your advertising identifier. Firebase Crashlytics receives technical details when the App crashes. Google processes this data under the Firebase privacy terms and the Google Privacy Policy. Event-level analytics data is deleted automatically after the retention period set in our Google Analytics property (no longer than 14 months).
Purchases
Subscriptions, free trials and one-time purchases are processed by Google Play or the Apple App Store, which share with the App only which product you bought and whether it is active. Your payment details stay with Google or Apple.
Reports you choose to send
If you report a wrongly blocked site or write to us, the App opens an email that you can read and edit before sending; it contains only what you choose to include. We use it only to reply and to fix the lists, and keep it only as long as needed.
What we do not do
- We do not collect browsing history, screenshots or screen content, and we do not monitor you.
- We do not access your contacts, location, photos, camera or microphone (calling or texting the person you chose opens your phone's own dialer or messages app).
- We do not show ads, use advertising SDKs, or sell or share personal information.
Children
The blocker can be used by anyone. The App's recovery features are intended for adults 18 and over. We do not knowingly collect personal information from anyone, including children.
Your rights
Depending on where you live, you may have the right to access, correct, delete or obtain a copy of your personal information, to object to or restrict its processing, and to complain to your data-protection authority. Because the App has no accounts and keeps your data on your device, the data we receive is not linked to you; deleting the App removes what it stored. To exercise a right or ask a question, write to ava@innoxapps.com.
Security and international processing
All network requests the App makes use encrypted connections (HTTPS). Google's services may process data outside your country, including in the United States, with appropriate safeguards where the law requires them.
Changes to this policy
If we change this policy, we will update the date at the top of this page, and for significant changes we will also tell you in the App.
Contact
InnoxApps, Noida, India · ava@innoxapps.com