Privacy policy

Effective 8 October 2026 · Applies to the Collared app and collared.app

Collared is built on a simple idea: what happens in your dynamic is yours. This page says, in plain words, what the app stores, who can see it, what your phone checks for you, and what we will never do with any of it.

What we store

Your account. Email address, a username you choose, an optional display name and avatar, your role, and the date you confirmed you are 18 or older. If you sign in with Apple, Google, or Discord, or link Discord to your account, we receive the identifier, email, and display name those services share; we never see your password for those services. When you sign up with email, we send you a code and a link to confirm it.
Your dynamics. Who you are connected to, the terms you both accepted (roles, honorifics, structure, rights, and which checks a phone may make), and the history of pauses, changes, and endings.
Tasks, points, rewards, punishments. Everything assigned, completed, reviewed, redeemed, or issued inside a dynamic, including proof notes and proof photos, plus the points ledger. Tasks you set for yourself are stored the same way.
Your journal. Entries, photos, voice recordings and their transcripts, and who you chose to share each entry with. If a photo you add knew roughly where it was taken, the entry keeps a pin rounded to about a street, never a doorstep, so it can sit on your map. If you add a place, it is the name you type.
Agreements. Files or text you upload as your contract, and who has acknowledged each version.
Messages and glimpses. Stored end-to-end encrypted, so we hold them without being able to read them. What we can see is who is in a conversation, who sent something to whom, and when. See "Messages and glimpses" below.
Held. That you breathed together with your partner, when, and for how long, and the one word you chose to send, encrypted. See "Held" below.
Your Home. How you arranged it: which cards, their sizes and order, and the row of shortcuts. A note pinned there and a countdown's name and line are encrypted, so only the two of you can read them. See "Your Home" below.
What your phone checked. For a task checked by your phone, that it was done and when. The section "Checks your phone makes" lists exactly what each check sends.
Social. Posts you share with Everyone, warms (a count, never a list of who), the challenges you join, the switches that decide how people can find you, and an optional broad region you pick from a list.
Devices and preferences. For each device you sign in on: a push notification token, the push tokens Apple gives each Live Activity, the public half of its encryption key, a random id for that install of the app, and the day it was last seen, which only you can see. Also your notification choices, theme, widget choices, and whether app lock is on.
Invite links. Which invite link a new account arrived through, so we can credit the person who shared it. Only the account owner and the person who invited them can see this.
Feedback you send us. What you write in "Tell us what you think", plus the build you were on, the screen you came from, and your device and its version. Never anything you have written elsewhere in the app. If you choose to attach a screenshot or a screen recording, whatever is on screen in it comes with it, which is why the app says so before you attach one.

Who can see what

Your partner in a dynamic sees what the dynamic's rights allow: tasks and proof they assigned or review, what a check found, the points ledger, the reward shop, punishments, agreements, and the journal entries you choose to let them read. A Dominant is told when their submissive posts to Everyone.
Messages and glimpses with friends. If you are in a dynamic that includes the "reads my friend messages" term, your Dominant can read your conversations with friends in Collared, in both directions, and see the glimpses you and your friends send each other. In a total power exchange this term is on from the start; in any other dynamic it is on only if you both agreed to it. Nothing inside those conversations marks it in a total power exchange. You can see whether the term is on from the dynamic's agreement, and it can be changed through a proposal like any other term. Turning it off works from that moment on; what was already read stays read.
Friends see counts: tasks done, points, journal entries written, and not even those if you turn off "Show my counts to friends". They see the content of a journal entry only when you set that entry's audience to friends or to them specifically, and you can change that at any time.
Everyone on Collared. A post you share with Everyone can be read by any member, under your name and username, until you take it back. When you join a community challenge, other members see only how many people joined; your friends can see your face on it, and you can turn that off.
Being found. People can find you by your exact username, and by your exact email address, which is never shown to them. Both are on by default and each has its own switch. Finding you by a linked Discord account is off until you turn it on. "Who can find me" narrows all of these to friends of friends or to invite only.
Suggestions. If you turn on "Suggest me to people" (off by default), Collared may suggest you to other members who also turned it on, based on what you said you are here for, Discord rooms you share, whether you have warmed each other's entries, and a broad region if you chose to share one. A region is only mentioned when at least 25 people picked it. Collared never uses your exact location, your city, your distance from anyone, or your contacts.
Who is here. While the Social tab is open, the app notes that your account was active in the last few minutes, to show a rounded count of members around. It never names anyone, and you can opt out of being counted. Friends see a dot while you are active only if you choose to show it.
Everyone else sees nothing of your dynamics, tasks, journal, or messages.
Blocking is silent. The person you block is not told.

Messages and glimpses

Messages, and the photos and voice notes in them, are sealed on your phone before they are sent. We store them with no key that can read them. The name of a group chat is the one exception: it is stored readable so your list can show it.
A glimpse is sealed on your phone the same way. We know who sent it to whom, when, and whether it was everyday or private. We cannot see the picture, its caption, or its place. The picture leaves your phone with no location or camera details inside it.
A glimpse can carry one caption: your own words, a mood, the weather, or the time. Whichever you pick is sealed with the picture, so we cannot read it either.
If you leave the place chip on, your phone turns its location into the name of a neighbourhood or town using your phone's own maps service (Apple's or Google's), and only that name travels, sealed with the glimpse. We never receive a coordinate.
If you pick the weather, your phone asks Open-Meteo once, with your location rounded to about a kilometre and no account or identifier, and only the answer (like "72° and sunny") travels, sealed with the glimpse. Like any website, Open-Meteo sees the request arrive from your phone's internet address.
Anyone you send a glimpse to can save it to their phone's photos, private ones included, and so can you. The saved copy is made again from the picture's pixels, so it carries no location, camera, or time details. Once saved, it is theirs, like any photo on their phone.
Your glimpse streak with someone is counted on our servers from the days glimpses were sent between you, which we already know. It never looks at a picture or a caption. A streak that breaks simply starts again.
A link preview is made by the sender's phone, which visits the page. The person you send it to never contacts that site.
Typing indicators travel live and are never stored.
A new device of yours opens your messages only with your recovery phrase, your Apple or Google keychain, or a yes from a device you already have. Signing in with a password alone opens nothing. If you keep a copy of your key in iCloud Keychain or your Google backup (on by default, with a switch in Settings), that copy lives in your Apple or Google account, never on our servers. If you lose all of these, we cannot bring your messages back.
When someone new is asked into a group with history off, they see nothing from before they joined.

Sharing where you are

You can share where you are with the person who leads you in a dynamic, and only with them: never with a friend, a group, or Collared. Where you are is stored on our servers, readable by us, and shown only to the person who leads you. It is signed by your phone so nobody can plant a place in your name. We never sell it or use it for ads. Messages, glimpses, photos, journals and agreements stay end-to-end encrypted, and this does not change that.

Always. Sharing all day, even when Collared is closed, like sharing your location with family. It is part of what you agreed when your dynamic began: in a total power exchange it is on, and in any other dynamic it is on only if you left it ticked. Your phone sends where you are when you move, and now and then while you stay put, with your battery if your agreement includes it. On iPhone it needs iOS's Always permission, which you give once.
When you choose. Whether or not Always is on, you can answer when you are asked where you are, share your way home until you arrive, check in at a place, or share your place when you ask to be Held.
Your places. Where your agreement includes it, the places you name on your phone (a name, where it is, and how big) are shared with the person who leads you. Either of you can give a place a nickname. Places found by search for a task are stored the same way.
Your days. Where your agreement includes it, your phone shares the places you stopped at today and when, shown the same way, so the two of you can look back at the day. With Plus, and where you agreed to it, the last 30 days are kept. Nothing is kept longer, and there is never a route except your way home while you share it.
Runs and walks. Each workout you finish is saved as one record: its route, splits, distance, time, pace, heart rate, steps and climb, and the app it came from. It is stored readable on our servers and shown only to you and the one person you share it with; the energy you burned is kept for you alone. What reaches the person you share with is set when your dynamic begins: in a total power exchange, every run and walk, when you head out and when you are home, and where you are while you are out; in any other kind of dynamic, each of these is its own choice, and runs with no task set stay off until you both agree. Your heart rate is never shared while you are out, only with the finished run. To notice that you headed out, your phone watches the area around your place named Home, only while a run or walk task is open or you are out, and reads your phone's own motion to tell a run or a walk from a drive; that reading never leaves your phone. While you are out, and only if you agreed to it, the places your phone already shares are also kept as your trail for the person you share with, and deleted the moment you are home. Your runs are kept until you remove one: Remove this run takes it from your history and theirs, on every phone. Ending a dynamic keeps both copies.
Arriving and leaving. The person who leads you can choose a few places to be told when you arrive or leave. You are not sent a notice when they add one, but your page always lists the places they watch.
Turning it off. In a total power exchange, turning Always off is on the page with Pause, Block and End. In any other dynamic it is a switch on your page. Your phone stops first, before anything reaches the network, and the person who leads you is told. The last place they saw stays for 24 hours with its time, then it is deleted. If your phone dies, loses signal, or you turn location off in your phone's settings, they see that your location is off and nothing else follows.
What we can see. Where you share, because we store it: your latest place, the places you named and their nicknames, the places you stopped at, your trail while you are out, and your runs and walks. We also see who you share with, whether Always is on or off and when it changed, and the minute of each update. We do not see your battery. Like any app, the providers that carry our traffic see your IP address, which gives a rough area such as a city, and under Always that is all day.
Maps. On iPhone, maps are drawn by Apple Maps, so Apple sees which area is being drawn, as for any maps app. A run's map is drawn on your phone from the area around the route, kept in memory and never saved.
When it ends. A pause deletes the last place, your places, the places being watched and your days. Ending a dynamic or blocking deletes everything location sharing kept for it, except that ending a dynamic keeps both copies of your runs. Closing your account deletes it too. The person who leads you can take a screenshot, as with anything on a screen.

Held

Held is for the moments you need the person who leads you. When you ask with Hold me, we send them a notification saying you need to be Held, and it may break through a Focus or a quiet hour, as a safeword does. While the two of you breathe together, your phones exchange the breathing pace, a few words, a hand held, and short voice clips, end-to-end encrypted: Collared cannot read any of it. The pace, the words and the hand are never written down. A voice clip is stored, encrypted, only while the session is open: when it ends neither of you can open it any more, and it is deleted from our servers within a day.

Afterwards we keep that you breathed together: who asked whom, when it started, when your partner joined (or that they couldn't that time), when it ended, and the one word you chose to send, which is encrypted so only the two of you can read it. Each ask, invitation and joining also leaves a notification in the other person's list, with its words (for example Luna needs you). They are kept like any other notification.
Nothing about Held is tallied or shown as a number, to you, your partner or us. To decide whether to show you where to find help, your phone looks at your own recent asks (for example, a third within two hours); it keeps nothing about that and tells nobody.
Recordings, words, and a heartbeat your partner prepares for you are encrypted on their phone before upload, can be heard only by the people they choose, and can be deleted by them at any time. Only the name they give that prepared session, like For when I can't come, is stored readable. Also encrypted are the words you write under What helps me and the line your phone sends when you answer Breathe with me with Not now.
The Hold me Control (and the Android Quick Settings tile) sends without unlocking your phone, so it can reach them fastest. It sends only that ask. You can remove it from Control Center at any time, and turning off Let me ask to be Held in Held stops every way of asking.
If you choose to keep a line about it afterwards, it goes into your journal like any entry, with when you breathed together and for how long.
This version of Held reads no heart rate. If a later version does, it will ask you first, and this page will say how.
Held is not medical care, and it cannot tell if something is wrong.

Your Home

Your Home keeps how it is arranged, never what you do with it. Nothing records a tap, an open, or a view.

The layout is stored readable: the kinds of card, their sizes and order, the row of shortcuts, and which person, group, countdown or challenge a card shows.
Someone who leads you can arrange your Home only while your dynamic is active, and only in a total power exchange or when you agreed to let them. What they change is kept for you as a short list of what moved, with your layout from before, so you can put yours back. They can read that list only while they may still arrange your Home.
A note they pin to your Home, and a countdown's name and line, are sealed on the writer's phone, end-to-end encrypted so only the two of you can read them. A countdown's day and symbol are stored readable.
The How are you? card writes a private journal entry, which stays private unless you share it.
When a dynamic ends, the cards about that person are put away, never deleted, and they can come back if the two of you are together again. When a dynamic pauses, nothing moves.

Checks your phone makes

Some tasks can be checked by your own phone instead of ticked by hand. A check only ever looks at your own task, and it can finish a task but never fail one. When your phone cannot tell, the task goes to your word. A check your Dominant sets runs only when your dynamic allows that kind of check. Each check asks for its permission the first time it is needed, and you can turn any permission off in your phone's settings.

Tasks you set yourself. You can have your own phone check a task you set for yourself: steps, a workout, asleep by, the alarm, time off the phone, the charger, or a shortcut, and inside a dynamic a tag or arriving somewhere. Your phone's permission is your yes. In a dynamic, your Dominant sees the task and that your phone finished it, as with your other own tasks, unless you mark it Just for me. With no dynamic, or for a task that is Just for me, we store only that it was done and the minute; nothing else leaves your phone.
Health. For a task like thirty minutes of movement or asleep by a set time, Collared reads from Apple Health or Health Connect on your phone: your workouts, wheelchair pushes, whether Health says you use a wheelchair, and when you fell asleep. On iPhone it also reads your steps, which Health totals across your iPhone and an Apple Watch. It reads only, and never writes anything to Health. Your phone sends us that the task was done and the minute, and one line such as "Run, 32 min", which is end-to-end encrypted so only you and your partner can read it. No Health sample, sleep stage, or history leaves your phone for these checks. A finished run or walk is different: its route, pace and heart rate are stored readable on our servers and shown only to you and the person you share it with, as described under Sharing where you are. Weight and cycle can never be a check. Health data is used only to finish a task. It is never used for advertising or marketing, never sold, never shared with any third party, and never stored on our servers or in iCloud as Health data.
Steps. Your phone counts your steps: on iPhone, the larger of Apple Health's total (an Apple Watch included) and the phone's own Motion & Fitness count; on Android, the phone's own step counter. Only that a step task was done, the minute, and the day's count once reached leave your phone, and the count is end-to-end encrypted. A count that fell short never leaves.
Arriving somewhere. For a task like Be there by eleven, or Get home safe, you name a place on your own phone while you are there. Your phone keeps the place outside every backup and watches for it only around the task's time. For the task itself it sends only that the task was done and the minute you arrived; for Get home safe, also the moment it saw you leave, which is kept for the check and shown to no one. Where your dynamic includes sharing your places (a total power exchange does), your phone also shares the place, its name and where it is, with the person who leads you. We store it readable on our servers and only they see it.
Arriving at a place found by search. The person setting the task can search for a store, an address, or a town instead. The place they pick is stored readable on our servers and travels to your phone, and your phone watches it as it would one of your own. For a task that any branch of a store will do, your phone looks up that store near you during the task's time only and watches the closest few. On iPhone that lookup goes to Apple Maps, as it would from any maps app. On Android your phone sends a point rounded to about a kilometre to our search service, which asks Photon, an OpenStreetMap search run by komoot, and does not keep or log your search or your point. For any branch of a store, which branch you arrived at is shared with the person who set the task. It is stored readable on our servers and shown only to the two of you.
A photo's time. For a task checked by the time on a photo, your phone reads the photo you picked: when it was taken, where it came from, which camera took it, and whether it was edited or is a screenshot. Only whether it counts is sent. The photo itself still leaves without its location or camera details.
Your voice. A spoken step listens for your line using recognition that runs on your phone. Where your phone cannot recognise speech on its own, it does not listen at all. No audio is recorded for a step and nothing you say is sent; only that the step was done. iOS shows its own standard notice about speech data when it asks for permission; Collared never turns on sending your speech to Apple.
Time off your phone. For a task like an hour off your phone, which you start yourself, Collared uses Apple's Screen Time on your own iPhone, or usage access on Android. It notices only whether that one stretch was kept. It never learns which apps you use or for how long, and nothing outside the stretch is read. We receive only that the task was done.
The alarm, the charger, a shortcut, and a tag. An alarm Collared sets on your phone, being on the charger by a set time, a shortcut you run, or a tag you tap each send only that the task was done and the moment. A tag carries one link to Collared and nothing else.
Proof it came from your phone. When your phone finishes a task, it asks Apple (App Attest) or Google (Play Integrity) to confirm the request came from the real Collared app. We keep one word per check (attested or not) and, on iPhone, one key made for this install, which is deleted when you remove the device or sign out on it.

Notifications, widgets, and your lock screen

Notifications show the sender's name, face, and what happened, and a new message's text can be opened on your phone and shown on your lock screen. A reminder names its task, like the one nudge at 8 pm for a task due by end of day, and the evening reminder that keeps a glimpse streak going names the person. Discreet mode replaces all of it with neutral words, such as "You have an update.", that name nobody and say nothing about what happened.
Widgets show first names by default; you can switch to a nickname, an honorific, or no names. Task titles appear on the lock screen widget only if you turn that on. The Glimpse widget can show your streak and both of your faces. Widgets never show message text, points, agreements, or punishments. Discreet mode applies to widgets too.
A private glimpse on a widget stays blurred until you tap it, and the picture is opened in your phone's memory, never saved unsealed.
Your day, on an iPhone's lock screen and Dynamic Island, shows your next task and up to four more for today, with their times and how many you have done. Task names show by default. Turn off Settings › Widgets › Task titles on the Live Activity and it shows only times. A Dominant's What's due shows each person they lead, in the name form they chose, their next time and count, and the next task's name while titles are on.
When Collared is closed, our server starts and updates these Live Activities with a push through Apple's push service. Such a push carries the same words you would see, including task names while titles are on, and Apple delivers it to your phone. With titles off, no task name is in it. Under Discreet mode it says only "Something is due", with no names, rows, or counts. On Android, the same list is an ongoing notification made on your phone.

What we never do

We never read your journal or your agreements. Nothing on our servers reads them, and they are encrypted where they are stored. They are not end-to-end encrypted yet, so for now this is our promise and our team policy rather than a lock. The same is true of proof photos and journal voice recordings.
We cannot read your messages or glimpses. They are end-to-end encrypted. Where you are, if you share it, is stored on our servers and shown only to the person you share it with.
We never sell, rent, or share your data with advertisers or data brokers, and nothing about you is used for advertising.
We run no analytics or tracking software in the app. The only diagnostic data we collect is a crash report when the app crashes, which contains technical details about the failure, never your account and never the content of your dynamic.
We never show your email to anyone.

Reports and moderation

You can report a person, a message, a glimpse, a post, or a quote. If you report messages or a glimpse, you choose which; your phone opens them and seals them again to a key that only Collared's founder holds. They are opened only on the founder's own phone, and every opening is logged. The person you report is never told who reported them. A post you share with Everyone is different: if someone reports one, a member of the Collared team reads that post, its words and its photos, only while the report is open, and every read is logged. When three different members report the same post, it is hidden until the team has looked. Removing a post makes your entry private again. Posts shared with Everyone are checked against a list of blocked words before they publish; your journal never is.

Who helps us run Collared

Collared runs on Supabase (database, file storage, and sign-in, hosted in the United States). Push notifications go through Expo's push service, which hands them to Apple and Google to deliver; Live Activities go straight to Apple. Emails, like your sign-up code and a password reset, are sent by our email provider, Resend. Crash reports go to Sentry, with your account taken out, so they are not linked to you. Apple and Google also confirm that a check came from the real app. These providers process data only to run the service for us. Sign in with Apple, Google sign-in, and Discord sign-in are provided by Apple, Google, and Discord under their own terms.

A few features talk to others straight from your phone. Naming a glimpse's place uses your phone's own maps service. On iPhone, the journal's map is drawn by Apple Maps; on Android the journal lists your places without a map, and nothing is fetched. If you turn on journal weather (off by default), your phone sends that entry's rounded pin, and nothing else, to Open-Meteo to ask what the weather was. A glimpse's weather caption does the same, once, only when you pick it, with a location rounded to about a kilometre. A link preview is fetched by the sender's phone from the site itself. Searching for a place for a task uses Apple Maps on an iPhone; on Android the search goes through our server to Photon (OpenStreetMap data, © OpenStreetMap contributors) with no account details and, if you allow location, a point rounded to about a kilometre so the nearest results come first.

Our Discord

Collared runs a public Discord server. Replies posted in its public channels may be summarised by AI and quoted inside the Collared app. The summaries are written by Anthropic's Claude from public Discord replies only; nothing you write inside Collared is ever sent to it. Alongside a quote we may keep the full text of the reply it came from, and the app shows that full reply when someone taps the quote. We only keep a full reply that passes the same checks as a quote: nothing explicit and nothing personal, such as names, places or contact details. Otherwise we keep the quote alone.

A quote shows who wrote it only if that Discord account is linked to a Collared account, and then it shows their Collared name and username, not their Discord name. If it is not linked, the quote and its full reply appear without a name. Replies in a room for one role are shown with a name only to members of that role; anyone else who looks in sees them without a name. We keep the Discord account id and display name of the people we quote, sealed away from the app, so a name can appear if they link later and so a quote can be removed on request, including for people who do not use Collared.

We keep quotes and full replies so earlier questions can be shown again. When a reply is edited in Discord, the copy we keep is updated to match, and when it is deleted in Discord, the quote and the full reply are removed from Collared at once. To have one removed, delete the message in Discord or contact us. The app can open a reply in Discord for you; if we do not know that you are in our server, it opens our invite first. Collared does not record whether you follow that link.

You can link your Discord account by signing in with Discord, or by typing your Discord username so our bot can send you a message to approve. Linking keeps your Discord id and username with your account, and the Discord rooms you are in, so suggestions can say you share one. You can unlink at any time.

Retention

Proof photos are kept as part of your dynamic's record: full size for 30 days, then a small compressed copy. Either person can delete one at any time. When a dynamic ends, its proof photos are deleted 30 days later. Nothing is blurred and nothing is destroyed when a task is approved.
Messages stay until a conversation's disappearing timer removes them, the sender unsends them, or the sender's account is deleted. An open once photo can be opened once. Ending a dynamic keeps its conversation. When you unfriend someone, your conversation with them stops at once and is deleted 30 days later.
Glimpses are kept until the person who sent one deletes it, or an account is deleted. Deleting one removes it for everyone it went to, though not a copy someone already saved to their photos. Someone you sent one to can hide it on their own phone, and you are not told. Ending a dynamic keeps its glimpses. Blocking someone removes the glimpses between you, unfriending removes them with the conversation, and reporting one removes it for the person who reported it. A glimpse sent as proof stays with its task.
When a dynamic ends, your Home's cards about that person are put away, not deleted.
A voice clip sent during Held can be opened only while that session is open, and is deleted from our servers within a day of it ending.
Deleting a journal entry removes it from your journal, and nobody you shared it with can read it any more. Its words stay on our servers, unread, until you close your account.
Reports, and any messages attached to them, are deleted after 90 days.
Screenshots and recordings attached to feedback are deleted after 90 days. What you wrote in the message is kept, so a decision we made about it still has its reason.
The "who is here" record is kept for at most ten minutes. Who was suggested to whom is kept for 30 days, and a "Not now" for 90.
A closed account is fully deleted 30 days after you close it. Until then nothing is destroyed and you can restore it yourself.
Our database provider keeps backups. Something deleted can remain in those backups until they are replaced in the normal course.
Everything else stays until you delete it or delete your account.

Your controls

Take a copy. Settings › Take a copy makes your record, or your journal, as a PDF on your phone. Nothing is uploaded to make it. If you need your data in another form, write to us and we will help.
Delete. Settings › Close my account closes your account straight away: your dynamics pause, you disappear from the app, and nobody can find you. Nothing is deleted for thirty days. Sign in any time in those thirty days and you can have all of it back exactly as you left it. After thirty days every photo, message, glimpse, recording, your Home, your Held settings and prepared sessions, and everything you wrote is deleted for good and cannot be recovered by you or by us. Three things remain: your partners keep the points history they could already see, shown as "Deleted user"; our team's log of staff actions; and any reports, until their 90 days are up. If you revoke Sign in with Apple, the same deletion runs.
Sharing. Every journal share can be changed or taken back at any time.
Your devices. Settings › Your devices shows every device on your account. Removing one takes away its keys and stops its notifications, so it can no longer open your messages.
Signing out. Sign out signs out only the phone in your hand, never your other devices. It takes that phone off Your devices and stops its notifications and widgets. Its key stays in that phone's own keychain, so signing back in on the same phone opens your history again. Your sign-in is kept in the phone's keychain and never copied into a backup, so a phone restored from a backup asks you to sign in once. Each install of Collared also keeps a random install id in the keychain, which stays through signing out (and on iPhone, through deleting and reinstalling the app). Its only use is to show one phone as one row on Your devices; no one else can read it.
Notifications. Per-type toggles, quiet hours, snooze, and Discreet mode.
Widgets and Live Activities. Settings › Widgets chooses the name form, turns task titles on or off for the lock screen widget and for Live Activities, and turns each Live Activity off.
App lock. Face ID, Touch ID, or your device passcode, with nothing shown in the app switcher. On Android, Discreet mode also keeps Collared out of the app switcher.

Adults only

Collared is for people 18 and over. Every account confirms it is 18 or older before it can use the app. We do not knowingly keep accounts for anyone younger, and we remove any we find. You can report an account you believe belongs to someone under 18.

Changes and contact

If this policy changes in a way that matters, we will tell you in the app before it takes effect. Questions and requests go to hello@collared.app.