LightsOut OBP privacy policy.

Last updated: 30 October 2026

Developer and privacy contact

This notice applies specifically to LightsOut OBP, operated by Odd Bear Productions Ltd (registered in Scotland, company number SC906219), trading as Odd Bear Productions. For privacy requests, contact support@oddbear.co.uk.

What LightsOut does

LightsOut places a user-controlled black or minimal-information overlay above other Android apps. It does not switch off the physical display and does not obtain the contents of other apps merely by drawing over them. Playback of music, videos or other audio depends on the underlying app and Android behaviour.

Data accessed and stored on your device

• Settings: display mode, blackout configuration, floating-control positions, reveal/unlock preferences, and other chosen settings in Android app-private storage.
• Optional overlay PIN or pattern: salted PBKDF2-derived hashes rather than plain-text secrets. This is overlay protection, not a replacement for Android device security; an emergency exit remains available.
• Trial and purchase status: local timestamps for the 72-hour trial, cached entitlement and purchase-acknowledgement retry information. The trial begins on the first successful blackout activation, not app installation.

LightsOut has no Odd Bear Productions user accounts, advertising SDK, analytics SDK, cloud backup of settings, OBP trial-tracking server or device-fingerprinting service. LightsOut does not send PINs, patterns, overlay preferences, content of other apps or individual blackout activity to Odd Bear Productions. No OBP usage analytics are collected. For the version 19 production-licensing build, the first successful blackout starts the server-verified 72-hour trial.

Production licensing in version 19

Earlier local-only releases and licensing-disabled development or test builds do not connect to an Odd Bear Productions licensing server. The version 19 production-licensing build connects to the Odd Bear Productions licensing service hosted by Cloudflare at oddbear-licensing.oddbearatwork.workers.dev to enforce the free trial and verify purchased access, not to collect usage statistics. Earlier local-only releases and licensing-disabled development or test builds do not use this service.

How the 72-hour trial works: The 72-hour free trial starts on the first successful blackout. The licensing service records its start and expiry for the recognised device so an ordinary uninstall and reinstall on the same recognised device does not start another free trial. This is not an absolute device identification or anti-fraud guarantee.

Information sent for licence verification: The version 19 production-licensing build sends its app identifier and an Android ID scoped by the app signing key and Android user/profile, a temporary Google Play Integrity security token and one-time server challenge, and a trial-activation request when applicable. For purchases and restores it also sends a Google Play purchase token to the licensing service for verification. An existing local trial start time may be sent once when upgrading from version 15. These are sent over HTTPS only to check trial eligibility, security, and paid entitlement; there is no advertising or usage reporting purpose.

How the service handles the information: The licensing service temporarily processes the Android ID, Play Integrity token and, when applicable, the Play purchase token. Its database stores an HMAC-pseudonymised device identifier instead of the raw Android ID, a keyed hash of the purchase token rather than that raw token, trial start time and entitlement status. Cloudflare processes network request information including the source IP address; a keyed pseudonymous rate-limit value is stored instead of the raw IP in the licensing database. Google checks Play Integrity and purchase information when requested. Cloudflare and Google also process data under their own service practices.

No activity tracking: The licensing service does not collect app-opening events, blackout session counts, blackout durations, screens or screenshots, PINs, unlock patterns, content of other apps, contacts, browsing history, precise location or advertising identifiers. The first successful blackout is used only as the one-time trigger that starts the trial.

Offline access and licence revalidation

After a server-confirmed trial check, the app may reuse an active-trial authorisation for up to five minutes without a new network request for every blackout. This does not start a trial offline or extend its 72-hour expiry. A previously server-verified paid entitlement may be used for up to 72 hours from verification, with a further verification due after 24 hours. Confirmed rejection invalidates cached paid access. Initial trial activation and unverified purchases require online verification.

Retention and deletion: Pseudonymised trial records are retained while required to enforce the one-time trial and recognise prior eligibility, and purchase records while needed to recognise or restore entitlements. They do not currently have automatic inactivity-deletion timers. Reviewer grant records are retained as needed to administer or audit grants. Expired challenges and rate-limit records are removed by best-effort cleanup: challenges become eligible after expiry plus one hour, and rate-limit records after 24 hours, though deletion may occur later. Contact support@oddbear.co.uk to request access, correction or erasure; we may need enough information to locate the pseudonymous record, verify the request and assess lawful retention obligations. Removing licence records may affect future restoration or trial eligibility. Deleting the app does not automatically erase server records. These server-side retention practices apply to licensing-enabled releases including version 19, not earlier local-only releases or licensing-disabled development or test builds.

Request deletion of LightsOut data

LightsOut OBP does not require you to create an account.

To request deletion of your licensing data, email support@oddbear.co.uk with the subject LightsOut Data Deletion Request.

We will explain any information needed to verify your request and locate your records. Please do not email passwords, PINs or Google Play purchase tokens.

Data eligible for deletion: Pseudonymised device identifiers, trial records and associated licensing records held by Odd Bear Productions, subject to verification and applicable retention requirements.

Data we may retain: Limited licensing or purchase-verification records where necessary for fraud prevention, disputes or legal obligations. Trial and purchase records do not currently have a fixed automatic inactivity-deletion period. We retain them while reasonably necessary for their stated purposes and review deletion requests under applicable data-protection law.

Uninstalling LightsOut removes locally stored app information but does not automatically delete server-side licensing records. Deleting licensing records may affect trial eligibility or licence restoration. Google Play independently manages its purchase records under its own policies.

See the dedicated LightsOut data deletion instructions.

Permissions

• Display over other apps: enables the blackout layer and floating controls. It does not grant access to read or record underlying app content.
• Foreground service and notifications: permit user-requested overlay controls, active-state notification and emergency exit.
• Quick Settings tile: provides the optional Android shortcut.
• Google Play Billing and network access: process lifetime purchase, restore and acknowledgement through Google's services. Earlier local-only releases and licensing-disabled development or test builds do not contact an OBP licensing server. Version 19 production licensing checks first-party trial eligibility and paid access only. No OBP usage analytics are transmitted.

LightsOut does not use accessibility, location, contacts, camera, microphone or general file-storage access for its functionality.

Payments and third parties

Google Play processes checkout and payment-related information under Google's privacy policy. LightsOut receives purchase status and tokens needed to recognise and acknowledge a lifetime unlock; purchase tokens are not sent to an OBP licensing server. Google Play Billing and its dependencies may process technical or diagnostic information for their services. Google may process service and diagnostic information independently of Odd Bear Productions; see Google’s privacy policy for details. Odd Bear Productions does not receive your payment card details through LightsOut.

Security, retention and deletion

Settings and trial information remain in app-private storage while the app is installed. Android application backup and transfer are disabled in the app configuration. You can clear app data or uninstall LightsOut to remove its locally stored settings, trial records and cached entitlements. An eligible paid unlock can be restored through the purchasing Google Play account. Google may independently retain purchase or system records in accordance with its policies.

Support messages and privacy rights

If you email us, we receive your address and the information you choose to send to respond to the enquiry; please do not include passwords, overlay PINs or payment details. Messages are retained only as reasonably needed for support, related records and legal obligations, then reviewed for deletion. You may request access, correction or erasure of information under our control, subject to applicable UK law, via support@oddbear.co.uk. You may complain to the Information Commissioner's Office.

Children and policy changes

LightsOut is a general-purpose utility and is not designed specifically for children. We will update this notice if releases change relevant permissions, third-party services or privacy practices.

← All OBP app privacy policies · Contact support