Privacy policy

Who we are

Tulivu is made by Darkwolf (darkwolfai.com), based in Ontario, Canada. Questions or requests: hello@darkwolfai.com.

What stays on your phone

Tulivu runs a small filter on your phone using Android's VPN feature. It only looks at site names (DNS lookups), never page contents. The filter checks each name against block lists stored on your phone. The sites you visit, and the ones that get blocked, are not sent to us. Your phone keeps only counts (for example "12 blocked").

To look up names that aren't blocked, the filter asks a family-safe DNS service: CleanBrowsing, or Cloudflare for Families as a backup. Like any DNS service, they see the names your phone looks up and your IP address. Their own privacy policies apply. The block lists are downloaded each day from their public sources, which see your IP address.

What we keep on our servers

• Account: your email address and the name you choose.
• About you: your year of birth and sex (used to keep Tulivu 18+ and for anonymous totals).
• Your lock: who your key holder is, your plan, breaks and unlock requests, password checks (the password itself is stored only as a one-way hash).
• Your progress: streaks, your "why", daily check-ins (mood, how the day went, an optional note) and urge SOS sessions (urge ratings and the step you chose).
• Your devices: device name, app version, whether protection is on, and when it last checked in, so your key holder can be told if protection stops.
• Alerts and notifications: the alerts sent between you and your key holder, and a notification token for your phone or browser.
• Security records: a log of important account actions (like approvals and changes), used to keep accounts safe.

Your key holder sees your name, your streak, whether protection is on, and the requests and alerts meant for them. They never see your why, your mood, your check-ins or your urge sessions.

We don't use advertising or analytics trackers.

Services that help run Tulivu

• Supabase: our database and sign-in. Data is stored in Canada (Montréal).
• Google Firebase Cloud Messaging: delivers phone notifications.
• Resend: sends sign-in codes and important alert emails.
• Vercel: hosts this website.
• Cloudflare Turnstile: checks that sign-ins come from a person, not a bot.
• CleanBrowsing and Cloudflare for Families: family-safe DNS (see above).

Some of these services may process data outside Canada, including in the United States. They only get what they need to do their job.

How long we keep it

We keep your data while you have an account. When you delete your account, we erase it, including your email, profile, lock, progress, devices and alerts. Two things remain, with nothing that identifies you: one anonymous row with an age range (like 25–34), sex and the months you started and stopped, and a note that an account was deleted. If you were someone's key holder, their protection stays on and they're told to choose a new key holder. Your key holder keeps the short message saying your account was closed. Service logs at our providers are kept for a short time.

Your choices and rights

• See and edit your details in the app under Settings.
• Delete your account in the app: Settings → Delete my account. How deletion works.
• Ask us for a copy of your data, a correction, or deletion by emailing hello@darkwolfai.com.
• Turn off notifications in your phone's settings at any time.

You can also contact the Office of the Privacy Commissioner of Canada if you have a concern we haven't resolved.

Age

Tulivu is for adults 18 and over. We don't knowingly collect data from anyone under 18.

Security

Data is encrypted in transit and stored with access rules so each person can only reach their own data. Passwords are stored only as one-way hashes, never on your phone.

Changes

If we change this policy, we'll update the date above and tell you in the app if the change matters.