Privacy Policy

Effective 15 October 2026

DocUs: USMLE App Blocker ("DocUs", "the app") is an iPhone app for students preparing for USMLE Step 1. It keeps the apps you choose blocked until you answer a study question correctly. This policy explains what data the app keeps, what it sends, who receives it, and the choices you have. It also covers the website docus.themartian.app.

The short version

• No account. DocUs never asks for your name, email address or phone number.
• Your study record lives on your iPhone. Your full history of answers, your progress, your exam date and your settings are saved on the device. If usage sharing is on, DocUs also sends usage events, such as "a Renal question was answered correctly", under a random ID (details below).
• Blocked apps stay on your iPhone. Apple's Screen Time gives DocUs opaque tokens for the apps you block. App names are shown on the block screen by an extension running on your iPhone; they and the tokens are never sent anywhere.
• Usage analytics, on by default, off in one tap. Events go to PostHog in the European Union under a random ID that isn't linked to your name or email. Turn it off in Settings › Share usage data.
• No ads and no tracking. No advertising networks, no advertising identifier, no cross-app tracking. We do not sell or share your data for advertising.
• Apple handles payments. We never see your card or payment details.

Who we are

DocUs is developed and provided by Jerry Fanelli ("we", "us"). We decide how the data described here is used. For any privacy question or request, write to [email protected].

Data stored on your iPhone

To work, DocUs saves the following on your iPhone, in the app's private storage and in an app group shared only with its own Screen Time extensions:

• your answers to questions (which question, whether it was right, the subject, the time), the daily skips and unlocks you used, your streaks, which questions are due again and when (spaced repetition), and your wrong answers in a row, which set the wait before the next question;
• your onboarding and settings choices: exam date or rough exam window, daily phone time estimate, the apps you said distract you (picked from a list during onboarding, used only to personalise the app), weakest subjects, unlock time and reminder preferences;
• your subscription status, as reported by Apple;
• the Screen Time selection of apps to block, as opaque tokens (see below);
• block-screen activity: which blocked app you last asked to unlock (as a token), when you asked, when the current unlock ends, and the times you chose not to open a blocked app (entries older than 30 days are removed the next time you make that choice);
• if usage sharing is on: the analytics library's random ID, your sharing choice, and events waiting to be sent.

Apart from the usage events described below, this data is not sent to us or anyone else. Deleting DocUs deletes it. iPhone backups (iCloud or a computer) may include it, under your Apple account's settings.

Screen Time

DocUs uses Apple's Screen Time (Family Controls) with your permission. When you pick apps to block, iOS gives DocUs tokens that stand for those apps. The DocUs app cannot read which apps the tokens are, see what you do in them, or see how long you use them; it can only ask iOS to block or unblock them. To show the app's name on the block screen ("Instagram is sleeping"), iOS gives DocUs's block-screen extension that app's name or the website's domain while the block screen is shown. The extension uses it only for that text, on your iPhone; app names, website domains and tokens are never stored by us or included in analytics. You can withdraw the permission at any time in iPhone Settings › Screen Time.

Notifications

When you tap "One question" on the block screen, iOS 26.5 and later opens DocUs directly. On earlier versions, DocUs shows a local notification ("One question to unlock") instead, if you allowed notifications. Notifications are created on your iPhone. DocUs does not use push notifications and does not register a push token.

Usage analytics

What and why

To learn which parts of the app work, where people stop during setup, and whether the paywall and offers are clear, DocUs sends usage events to PostHog (PostHog Inc.), our analytics provider, through its European service at eu.i.posthog.com. Sharing is on by default. You can turn it off at any time in Settings › Share usage data. Turning it off stops recording new events right away; from the next time you open DocUs, the analytics library isn't started at all.

The events

These are the only events DocUs sends, with everything the app attaches to them:

• Onboarding: a step was shown or completed, or you went back (step name and number). Completed steps include your answer in coarse form only: days until your exam as a range (under 30, 30 to 90, 91 to 180, over 180) or the exam window you picked, your daily phone hours, and how many apps or subjects you selected. Onboarding finished.
• Paywall and purchases: the paywall was shown (and from where in the app); the one-time offer was shown, accepted or dismissed; a plan was selected; a purchase was started, completed, cancelled, pending or failed (plan, product ID, the price and currency you were shown, and a failure category); restore was tapped and its result; the Terms or Privacy page was opened.
• Setup: a setup step was shown; Screen Time permission granted or not; how many apps and categories you chose to block (counts only); the unlock time you chose; setup finished.
• Daily use: a question was opened (from the block screen or from Home); a question was answered (right or wrong, its subject, its question ID from our bundled question set, and seconds taken); apps were unlocked (minutes); a wait started after a wrong answer (seconds); the daily skip was used; the full explanation was opened; App guard was turned on or off; a tab was opened; the streak calendar was opened or closed; a setting was changed (unlock time, exam date as a range, or notifications on or off).
• Subscription status: whether your subscription is active changed.
• App lifecycle: the app was installed, updated, opened or sent to the background (added by the analytics library).

Every event also says whether it came from an App Store, TestFlight or development build, and the app build number.

With these events the app keeps a few summary values for your random ID: subscribed or not, plan, whether onboarding and setup are finished, current and best streak, days to your exam as a range, unlock time, and how many apps are blocked.

Technical details the library adds

The PostHog library adds technical properties to events and to the summary for your random ID: device manufacturer, type and model, operating system and version, app name, identifier, version and build, the library's name and version, language and region setting, time zone, screen size, whether you are on Wi-Fi or cellular, whether the app runs on a simulator, a Mac or a foldable, whether it came from TestFlight or was sideloaded, a session ID, and a random installation ID. We switched off location lookup from your IP address. PostHog still receives your IP address as part of the internet connection, as any server does.

What is never sent

Your name, email or Apple account; the names, domains or tokens of apps you block; the text of questions or anything you type; your exact exam date; your contacts, photos or location; payment details or receipts; the advertising identifier. DocUs does not record your screen and does not capture taps automatically.

The random ID

The installation ID is created on your iPhone and isn't linked to your name, email, Apple account or advertising ID. It is pseudonymous rather than anonymous: events from the same installation can be grouped together. Deleting the app (or its data) starts a new ID.

Delivery and retention

Events are sent as they happen. If your iPhone is offline, they wait on the device and are sent when a connection returns. Turning sharing off stops recording new data; data recorded while sharing was on may still be uploaded, including after you reconnect. We keep analytics events for no longer than 12 months.

Purchases

DocUs is a subscription app. Purchases, renewals, cancellations and refunds go through Apple's App Store under your Apple account, and Apple's privacy policy applies to them. We never receive your payment details. The app checks your subscription directly with Apple on the device (StoreKit) and learns the product, its status and its dates. If sharing is on, purchase events are included in analytics as described above. We do not use any other payment or subscription service.

Emails to us

If you write to us, we receive your email address and what you send, and use it only to answer you. We keep the conversation as long as needed to help you and delete it on request.

The website

docus.themartian.app is a static site. It sets no cookies and runs no analytics, and our server keeps no access logs for it. It is delivered through Cloudflare, which processes your IP address and technical request details to deliver and protect the site, under Cloudflare's privacy policy. Cloudflare also adds a small script that hides our email address from spam bots.

Who receives data

We share data only with these service providers, who process it on our behalf:

• PostHog Inc. (analytics, European Union servers): usage events described above. See posthog.com/privacy.
• Apple Inc.: App Store purchases, Screen Time and notifications, under Apple's own privacy policy.
• Cloudflare, Inc.: delivery of the website.

We do not sell personal data and do not share it for targeted advertising. We may disclose data if the law requires it.

Legal basis (EEA, UK and similar laws)

We process usage analytics on the basis of our legitimate interest in understanding and improving the app, with a simple way to object (the Settings switch). We process purchase information to provide the subscription you bought. Data that stays on your iPhone is processed by the app on your device and isn't received by us; the usage events described above are the exception.

International transfers

Analytics events are stored in the European Union. Apple and Cloudflare operate worldwide; where data leaves your country, they rely on recognised safeguards such as the European Commission's standard contractual clauses.

Your choices and rights

• Stop analytics: Settings › Share usage data.
• Stop Screen Time or notifications: iPhone Settings › Screen Time, or Settings › Notifications › DocUs.
• Delete data on your iPhone: delete the app.
• Access, correction, deletion, objection and complaint: depending on where you live, you may have these rights. Because analytics use a random ID that we can't connect to you, we usually can't find which events are yours; we will help as far as we can if you contact us. You may also complain to your data protection authority.

Children

DocUs is made for medical students and is not directed to children under 13. We do not knowingly collect data from children. If you believe a child has used DocUs with sharing on, contact us.

Security

Data on your iPhone is protected by iOS. Analytics are sent over encrypted connections (HTTPS). No method is perfectly secure, but we limit what leaves your device to the list above.

Changes

If we change what DocUs collects, we will update this policy before the change ships and change the date at the top.

Contact

Jerry Fanelli · [email protected]