Night Bandit
Privacy policy
Last updated: 25 September 2026
The short version
- Night Bandit works on your phone. What it records to guard your apps (your settings, your screen time, the photos of your spot) stays on your phone.
- Today there's no account, no ads, no analytics and no crash reporting. We, the makers, receive none of that data.
- Uninstalling the app deletes everything it stored.
- If this changes, we'll update this page before the change reaches your phone, and tell you in the app.
1. Who we are
Night Bandit is made by Martin Michaux, Avenue Maurice 24, 1050 Ixelles, Belgium, which is the controller of the personal data described here, as defined by the EU General Data Protection Regulation (GDPR).
Contact for anything about privacy: hello@nightbandit.app.
This policy covers the Night Bandit app for Android and for iPhone, and the website nightbandit.app.
2. What the app keeps on your phone
To lock the right apps at the right time and count your streak, the app keeps the following in its private storage on your phone. None of it is sent to us or to anyone else.
| What | Why | How long |
|---|---|---|
| Your choices | The apps and websites you block, your curfew, your daily scroll budget, your language. | Until you change them |
| App use | Which app is on screen and for how long, and when the screen is unlocked. The app reads this from your phone's own usage log to lock apps, spend your scroll budget and show the Screen time tab. | Android keeps its usage log for a limited time. The app's own log of blocks, unlocks, walks and focus sessions is kept until you uninstall, because your streak and history are built from it. |
| Website names | Only if you turn on website blocking (Android): the name of the site your browser shows, such as example.com, with the time and the browser. Never the full address, never the page content. It's used to block the sites you listed and to show which sites your time went to. | 8 days |
| Photos of your spots | When you register a spot (a "target"), the app keeps small grey-scale pictures of it and the visual features computed from them, plus the phone's tilt at that moment, to recognise it later. When a scan struggles, it may keep a few frames from that walk and ask whether to add them to the target. If you say no, or don't answer, they're deleted. | Until you swap or remove the target, or uninstall |
| Location and Wi-Fi (optional) | If you allow location: the position of each place where you registered targets, and the identifiers of nearby Wi-Fi access points (not their passwords). When an app is blocked, the phone compares where you are with your places, so you're only sent to a spot nearby. | Until you remove the target or place |
| Your answers | The names you give your targets and places, your "Why now?" answers and how you felt after an unlock. | Until you uninstall |
| Game progress | Streak, hearts, XP, levels and badges, all worked out from the log above. | Until you uninstall |
| Diagnostics | The app's own notes about when blocking stopped working (a permission turned off, the service stopped), so it can tell you instead of pretending to protect you. | Until you uninstall |
Why we're allowed to use it (GDPR, Article 6). The app uses this data to provide the service you asked for (Article 6(1)(b)). Location and website blocking are optional, and are only used if you turn them on. You can turn them off at any time in your phone's settings.
Because this data never leaves your phone, we can't see, copy or delete it. You're in control: the app shows it to you, and you delete it by uninstalling the app, or on Android in Settings → Apps → Night Bandit → Storage → Clear storage.
3. What leaves your phone
Nothing, automatically. Only what you choose to share yourself:
- Share my week makes a picture of your week (your grade and a few figures) and hands it to your phone's share menu. It goes wherever you send it.
- Export as CSV (Android) hands a file of your event log to your phone's share menu, in the same way.
On Android, the app's data is excluded from the phone's backup to Google. On iPhone, your own iCloud or computer backup of the phone may include it, as it does for other apps. That backup is yours, under Apple's terms.
4. On iPhone: Apple's Screen Time
On iPhone, Night Bandit blocks apps through Apple's Screen Time framework (Family Controls), with your permission, which you give with Face ID, Touch ID or your passcode. You pick the apps, categories and websites in Apple's own picker. Night Bandit only receives private tokens from Apple: it can't see the names of the apps you picked, and your usage data stays inside Apple's framework, on your iPhone.
Screen Time usage data is used only to manage your own device usage. It is never shared, never used for advertising or ad measurement, and never sold or passed to data brokers.
Because of how Screen Time works, some Android features don't exist on iPhone: there's no time per website and no "Last night" card.
5. Permissions, one by one
Android
- Usage access: to see which app is on screen, so Nox can lock the ones you chose and count your screen time.
- Display over other apps: to show the block screen on top of a blocked app.
- Accessibility (optional): only for website blocking. Night Bandit reads the address bar of the browsers on your phone, and nothing else. If you leave it off, every browser is blocked during the curfew instead.
- Camera: to scan your spot when you register it, and when you walk to it to unlock. The pictures are processed on your phone.
- Location and Wi-Fi state (optional): to recognise which of your places you're at (see section 2).
- Notifications: for the protection status, the unlock countdown and the end of a focus session.
- Alarms, start at boot, battery optimisation, foreground service: so the curfew starts on time and Nox keeps guarding after a restart or overnight.
- List of installed apps: so you can pick which apps to block.
iPhone
- Screen Time (Family Controls): to let you pick apps and websites, and to lock them (see section 4).
- Camera: to scan your spot. The pictures are processed on your phone.
- Notifications: for reminders and the unlock countdown.
6. If you write to us
If you email us, we receive your email address and what you write. We use them only to answer you and fix what you report (our legitimate interest in supporting the app, Article 6(1)(f)). We delete the conversation 12 months after it ends, unless the law requires us to keep it longer.
7. The website nightbandit.app
The website uses no cookies and no analytics, and loads no fonts or scripts from other companies. Our host, Vercel Inc., processes technical data it needs to deliver the pages and keep them secure, such as your IP address, your browser and the pages requested, and keeps it for a short time (our legitimate interest, Article 6(1)(f)). Vercel is based in the United States and may process this data there. It is certified under the EU–US Data Privacy Framework and also relies on the EU Standard Contractual Clauses for these transfers. The logs we can see are kept for one day.
8. Google Play and the App Store
Downloads and updates go through Google Play or Apple's App Store, which process data under their own privacy policies. They show us anonymous, aggregated statistics, such as the number of installs, crash rates and phone models. On iPhone, crash reports are shared only if you allowed sharing with app developers. We can't identify you from these statistics.
9. Your rights
Under the GDPR you can ask us for access to your personal data, and for correction, deletion or a copy of it. You can also object to its use, ask us to restrict it, and withdraw any consent you gave. For data on your phone, you exercise these rights yourself in the app and by uninstalling it, because we don't hold that data. For anything else, write to hello@nightbandit.app. We answer within one month.
You can also complain to a data-protection authority: in Belgium, the Data Protection Authority (Rue de la Presse 35, 1000 Brussels), or the authority where you live, such as the CNIL in France.
10. Children
Night Bandit is for people aged 13 and over. It isn't designed for children. We don't knowingly collect data from children. If a child under 13 has written to us, tell us and we'll delete the conversation.
11. Security
The app's data lives in its private storage, which the operating system keeps away from other apps. Keep your phone locked with a PIN, a password or biometrics: anyone who can unlock your phone can open the app.
12. Changes to this policy
When we change this policy, we update the date at the top. If a change affects what happens to your data, for example if the app starts sending anything off your phone, we'll say so in the app before the change applies.
13. Contact
Martin Michaux, Avenue Maurice 24, 1050 Ixelles, Belgium
hello@nightbandit.app