Privacy Policy

Not Yet: Checkout Blocker · Last updated: September 15, 2026

The short version: Not Yet has no server, collects nothing, and sends nothing anywhere. Everything it does happens entirely on your own device. This policy explains exactly what that means and why.

No servers, no collection

Not Yet does not have a backend. There is no company server, no database, no analytics service, and no third-party SDK anywhere in this app. The extension makes no network requests of its own at all: not to us, not to any analytics or advertising company, not to anyone. We have no way to see how you use the app, what sites you visit, what you almost bought, or anything else, because nothing is ever sent to us. There is nothing to breach, nothing to subpoena, and nothing to sell, because nothing leaves your device in the first place.

The one exception is described fully under "Cross-device sync (Safari)" below: on Safari, some settings sync between your own devices through Apple's iCloud, not through anything we operate.

What's stored, and where

Everything Not Yet remembers is stored locally on your own device, using the browser's standard on-device extension storage, and is never sent to us or to any server we operate. This includes:

• Your settings — which categories or sites you've chosen to pause, your chosen theme, your unlock method and its settings, and similar preferences. On Safari, these sync across your own devices through Apple's iCloud — see "Cross-device sync (Safari)," below.
• A few local counters — how many times a checkout page has been paused, how many times you've chosen to go somewhere calmer instead, and a running total of money you've told the app you skipped spending (only ever added when you actively choose to enter an amount and decide not to buy — see "The savings total," below). These stay on the one device that recorded them and do not sync.
• A PIN, if you turn on Guard Mode — stored only as a one-way cryptographic hash (SHA-256), never in plain text. Not Yet can check whether a PIN you enter matches, but the actual PIN is never stored or recoverable, including by us. On Safari, this hash is included in the same cross-device sync as your settings, so the same PIN works on each of your own devices.

If you delete the extension or use its "Reset everything" option, this data is erased. We have no copy of it anywhere, because we never had one to begin with.

Cross-device sync (Safari)

On Safari (iPhone, iPad, and Mac), Not Yet syncs your settings and blocklists across your own devices through Apple's iCloud, using Apple's own CloudKit framework — the same underlying mechanism Apple's own apps like Notes and Reminders use to sync your own data across your own devices. This is the one exception to "no network requests of its own" described above, so it deserves its own precise explanation rather than a footnote:

• It moves only between devices signed into your own Apple ID, through your own private iCloud account. We never see this data, have no server of our own involved anywhere in the process, and have no way to access your iCloud account or what it stores.
• What syncs is the same list above marked as syncing: your settings and blocklists, and your Guard Mode PIN's hash (never the PIN itself). Your local counters (times paused, amount saved, and similar) do not sync — each device keeps its own.
• Chrome has no access to iCloud at all, so none of this applies there. Chrome's storage stays exactly as local as everything else in this policy describes.
• iCloud syncing for any app, including this one, can be turned off at any time in your device's own Settings app, under your name, then iCloud — this is a background convenience Not Yet uses, not a separate account or sign-in you have to set up inside the app itself.

The savings total

Not Yet's "actually saved" total is not a guess or an estimate pulled from your spending. It only ever changes when:

• You add to it yourself — by typing an amount on the "are you sure you want to buy this?" screen and choosing "somewhere calmer" instead of completing the purchase. If you enable the experimental "subtract completed purchases" setting, landing on a real order-confirmation page can also subtract an amount from this total, using the same on-device pattern matching described below — no data about the purchase is sent anywhere to make that calculation.

This number lives in the same local, on-device storage as everything else here, and is never sent anywhere.

About the browser permission

When you turn Not Yet's extension on, your browser shows a standard warning that the extension can "read and alter the pages you visit" and similar language, including a mention of passwords and payment information. This is the browser's own standard wording for any extension with this level of access — every extension capable of acting on a page you visit shows this same warning, regardless of what that extension actually does with it. It is not language we chose, and it does not describe what Not Yet actually does.

In practice, Not Yet's content script only ever:

• Checks the current page's web address (URL) and nearby button text against a built-in list of patterns, to recognize a checkout, payment, or (if you turn on the experimental setting above) order-confirmation page.
• Optionally reads a nearby dollar amount on the page, only when you are on the confirmation screen described above, so it can suggest a number instead of asking you to type one from memory.

Not Yet never reads, stores, or transmits anything you type into a page, including passwords, card numbers, addresses, or any other form field. It has no way to see your keystrokes at all; it only ever looks at text and structure that's already rendered on the page for anyone to see, the same way a browser's built-in "Find on Page" feature does.

No accounts, no tracking, no third parties

Not Yet has no sign-in, no user accounts, and does not set or read tracking cookies. It does not use any advertising, analytics, or crash-reporting service. Apple's own App Store purchase and diagnostic systems (if you buy the app, or if you've opted into sharing device analytics with Apple) are governed by Apple's own privacy policy, not this one; Not Yet itself has no visibility into that data either way.

Children's privacy

Not Yet is not directed at children and does not knowingly collect information from anyone, of any age, because it does not collect information from anyone, full stop, regardless of age.

Changes to this policy

If this policy ever changes, the "Last updated" date above will change, and any material change will be reflected in the app itself. Given that Not Yet has no server and no way to reach you directly, checking this page is the only way to stay current with any updates.