Trust & privacy

Read-only. Non-custodial.

Amblee can see that money moved. It can never move it.

Read-only, through Plaid

You connect a bank or brokerage the way you would to a budgeting app: through Plaid, never by typing a password into Amblee. The connection can only read. Amblee has no way to move, hold, or invest money, and never asks your bank for that permission.

Only the accounts you connect

You choose which accounts to connect and which one counts toward your goal. From those accounts we receive amounts, dates, and counterparty names: enough to count a deposit, subtract a withdrawal, and add up what went to the sportsbooks. Never your login. Never a full account number.

Screenshots are read on your phone

If you log a transfer with a screenshot, your phone reads the amount off the image. The image itself never leaves the device. Only the number does.

We never learn which apps you chose

You pick the apps to block in Apple’s own Screen Time picker. iOS hands Amblee an opaque token, not a list. We can tell that a selection exists. We cannot tell what is in it.

A tampered unlock is rejected

Every lock state is signed by our server with a key issued to your account and verified on your phone before it can open anything. A state that fails the check is dropped and the last verified one stands, so an edited or spoofed response cannot open the apps.

Disconnect anytime in Settings

Unlink a bank and Amblee revokes its own access at Plaid on the spot. Delete your account and every record is purged after 30 days: ledger, lock states, devices, the lot. Both live in Settings. Neither needs an email to support.

Safety property

Fail-closed by design

If your phone cannot reach our server for long enough, the gambling block stays on. Not off.

Most software fails open: when the server is unreachable, the feature quietly stops working. For a gambling block, stopping working means the apps open, and they would open at exactly the moment an outage makes us hardest to reach. So Amblee is built the other way around. Every degraded path resolves toward blocked.

No cached state
Blocked.
Cached state older than 48 hours
Blocked. Your phone decides this on its own, with no network at all.
Subscription lapses
The paywall appears and the blocks stay on. A lapse never unblocks.
Bank link breaks
Your progress freezes rather than dropping to zero. An outage is never counted against you.

The cost is real: an outage on our side can keep you blocked a little longer than it should. The alternative is an outage that opens the sportsbooks. We think this is the right side to err on.

Safety valve

Hardship

A real emergency unlock exists. It is slow on purpose, limited, written down, and never behind a paywall.

Sometimes what you need is your phone back, now, and the reason is none of our business. So there is a way out, and it is built so that it cannot become the way around.

Three per month
Counted against the calendar month on a clock you cannot edit.
A 10-minute delay
It takes effect ten minutes after you ask, and you write a short reflection first. Long enough for an urge to pass, short enough for an emergency.
24 hours
The window closes on its own, even if your phone is offline when it ends.
Audited
Every hardship unlock is written to your account’s audit log with its time and window. Nothing about it is silent.
Never behind the paywall
It works when your trial has ended or your subscription has lapsed. A paywall may withhold the product. It never withholds the exit.

The long version

The privacy policy lists every category of data we hold, every vendor that touches it, how long it lives, and how to get it deleted. The terms say what you are agreeing to, in plain language.

Read them. Privacy policy and Terms. Anything still unclear, ask at Support.

Download for iPhone