Privacy

What Mast keeps.

Last updated 24 October 2026

Mast locks your phone and computer at the times you set. To do that it keeps a few things. This page says what, where, and who sees them.

On your devices only

• The apps you block. On iPhone you pick them in Apple’s Screen Time, and Mast never learns which apps they are. On Android the list stays on the phone.
• Time in apps on your computer: which app is in front and for how long, kept up to 90 days. Mast also reads window titles there, to spot sites like YouTube during a to-do. None of this is sent.
• Your Google sign-in on the computer, if you connect Google Calendar there, encrypted by the computer’s operating system.
• The content filter, a founder feature on the computer. While Instagram, X, Reddit or TikTok is in front, Mast looks at a picture of the window, on the computer, for nudity and faces. The pictures are not saved or sent. It keeps only the gender you gave it and which sites it has blocked, and until when.

In your Mast account

You sign in with Google or Apple. There is no password. Your account lets your phone and computer lock together, so Mast keeps these on its servers:

• Your account: your email address and the name your Google or Apple account gives.
• Your devices: a name for each (on a computer, the computer’s own name), phone or computer, the platform, and when it was last seen.
• Your locks: prayer, bedtime, your own locks and quick locks, calendar settings, how each eases in, and changes waiting their 24 hours. If you pause prayer locks for a period, when the pause began.
• Locks from your phone: when a lock you start for your computer begins and ends.
• Your calendars: see Google user data below.
• Where you are, if you allow location on your phone: the latitude, longitude and city used for prayer times, so your computer uses the same times.
• Your friends: the email, name and phone number you add for each, and whether they accepted.
• Asking to be let out: which lock, when it ends, any note, reason or evidence you write, how many minutes you asked for, how you were let out (a friend, Mast support, or the week’s emergency), each friend’s answer, and when.
• Going around a lock: Screen Time access turned off, a lock your computer missed, or the week’s emergency used.
• Your to-dos, a founder feature: each title, day, time and length, and when it was done.

Each account can read only its own records. One exception: anyone who has your account’s ID can ask whether a single lock was let out, and get a yes or no. Your computer uses this to keep bedtime without signing in.

We don’t sell any of this, use it for ads, or use it for anything but running Mast.

What your friends see

A friend is someone with a Mast account who accepted your friend request in the Mast app. When you add a friend, Mast emails them the request, or an invite to join if they aren’t on Mast yet. You can also text them from your own phone.

When you ask to be let out, your friends see your name, the lock’s name, when it ends and any note you wrote, in their Mast app and by email. They answer in the app, confirming with Face ID or a fingerprint on their own phone; Mast never receives their face or fingerprint. They also see how many friends have said yes.

Your friends are emailed if Screen Time access is turned off, if your computer misses a lock, or if you use your weekly emergency.

If you ask Mast support to let you out, the people who run Mast see your email, the lock, the minutes you asked for, and the reason and evidence you wrote.

Your location

Prayer locks need prayer times. If you allow location, your phone’s position is used. If not, Mast guesses your city from your internet address. Either way the latitude and longitude are sent to AlAdhan for the times. Location is used for nothing else.

Google user data

Mast uses Google in two ways: to sign you in, and, if you choose, to lock during events in your Google Calendar.

What Mast asks Google for.

• Signing in (openid, email, profile): your Google account’s email address and name, to create and sign in to your Mast account.
• Google Calendar, only if you connect it, read-only: calendar.calendarlist.readonly, to show you your calendars so you can pick which ones lock, and calendar.events.readonly, to read the titles and times of events in those calendars.

Mast never creates, changes or deletes anything in your Google account or calendar, and never reads your email, contacts, files or anything else.

How Mast uses it. Calendar data is used only to lock your phone and computer while the events you chose are on, and to show you those events in Mast (Home, Locks, and when you pick which events lock). Mast reads events from yesterday to a few days ahead to lock, and, while you pick events, up to a few months ahead so you can see what repeats.

Where it’s kept.

• If you connect Google Calendar on your computer, the Google sign-in stays on that computer, encrypted by its operating system. The computer also asks Google to tell Mast when a chosen calendar changes, so the locks follow at once.
• If you connect it on your phone, Google’s permission (a refresh token) is kept on Mast’s servers, never sent back to any device, and used only to read your chosen calendars for your locks, every half hour.
• The titles and times of upcoming events in the calendars you chose are kept in your account, so your phone and computer lock for them together. They are replaced as they are read again.

Who sees it. Only you, in Mast on your own devices. Google data is never sold, never used for advertising, never shared with your friends or anyone else, and never used to train AI or machine-learning models. No person at Mast reads it, unless you ask us to for support, or the law requires it.

Removing it. Take a calendar out of your locks and the events read from it are deleted. Disconnect Google Calendar in Mast, or remove Mast’s access at myaccount.google.com/permissions, and Google’s permission and the events read with it are deleted too (after removing it at Google, the next time Mast tries to read). Deleting your Mast account deletes everything kept with it.

Mast’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you add a calendar by its private address instead, the same applies to the events read from that address.

Services Mast uses

• Supabase hosts your account and runs Mast’s servers.
• Resend sends Mast’s emails: sign-in codes for Mast’s own admin page, and the emails to your friends.
• Google, to sign in and, if you connect it, Google Calendar. Apple, to sign in with Apple.
• Cloudflare. On Windows and Mac, once you allow it, Safe Web (which blocks adult sites) makes the computer look up web addresses through Cloudflare for Families, so Cloudflare sees the names of sites the computer visits. It also turns on SafeSearch in your browsers.
• Location. ipwho.is, GeoJS or ipapi.co, to guess your city from your internet address. AlAdhan, for prayer times.
• The adhan and recitation. Adhan sounds, verses and recitations load from alquran.cloud, Quran.com, QuranicAudio, EveryAyah, GitHub and IslamCan. These requests carry nothing about you.
• Updates. The phone app checks Expo for updates; test builds come through Apple’s TestFlight. The computer app checks GitHub.

Every service Mast connects to sees your internet address, as any website does. Mast has no ads, analytics or tracking tools.

Deleting your data

To delete your account and everything kept with it, open You → Account → Delete my account in the Mast app on your phone. It is deleted at once and can’t be undone. You can also email hello@usemastapp.com from the address you signed in with, and we will delete it. Deleting Mast from a device removes what it kept there.

If you are someone’s friend, your email stays in their list until they remove you or you turn the request down.

Children

Mast accounts are not meant for children under 13, and we don’t knowingly keep their data.

Changes and questions

If this changes, the date at the top will too. Questions are welcome at hello@usemastapp.com.