The full answer
Every time you bring Fold’em to the foreground, and on a background wake iOS schedules no sooner than four hours after the last one, the app checks whether Screen Time is still granted and whether the shield it applied is still on the phone, then sends that reading to foldem.app. When a phone goes quiet the server wakes it with a silent push so it can report. If it still hears nothing after 24 hours it marks the phone Dark rather than assuming the block is fine, and your keyholder and supporters see Not confirmed yet.
What the phone sends, and when
Fold’em does not trust its own memory of the block. It reads the phone again and reports what it found. The reading is taken at five moments: when the app comes to the foreground, when a background wake fires, when a silent push arrives, when Screen Time permission changes in either direction while the app is running, and when iOS says the tokens behind your blocked apps have expired and renewing them changed something. If the app is not running when the permission changes, that reading goes the next time it runs.
The background wake is a standard iOS background refresh task, registered as app.foldem.heartbeat, and Fold’em asks for it no sooner than four hours after the last one. iOS decides whether to grant it, so it is opportunistic. Nothing depends on it arriving.
One reading carries a small, fixed set of facts: whether Screen Time is granted, whether the shield is still applied on the phone, whether anything had to be repaired to get it there, whether the app pick is still waiting to be done again, whether the subscription is active, whether site blocking is on and answered its own test, which build of the app is running, and the time on the phone's clock. No app name, no web address and no app token is in any of it, which is why nobody in your circle can ever be shown one.
The phone sends the reading. It does not write the state. That distinction is the whole design: a phone that could write its own state could write a comfortable one.
The silent probe, and the tighter one for a circle
A phone that is never opened sends nothing, so the server goes and asks. A scheduled sweep runs every four hours, finds phones that have been quiet for more than six hours, and sends each one a silent push. The push carries no alert and shows nothing; it wakes the app in the background just long enough to take a reading and send it.
If you have a keyholder, a second sweep runs every 60 minutes and takes any phone in that group that has been quiet for more than two hours. It sends exactly the same silent push through exactly the same sender. The tighter window exists because there is somebody waiting to be told, and probing everyone that often would be wasteful.
A probe is a nudge, never enforcement. It cannot block anything, it cannot unblock anything, and it never writes the state. All it does is give the phone a chance to speak.
Sometimes the push comes back saying the phone's token is no longer registered, which is what iOS reports after an app is deleted. The server then reads the token again inside a transaction, and clears it only if it is still the one that just failed, so a phone that has already registered a fresh token wins. That is recorded and nothing else: a healthy phone can lose a push token for ordinary reasons, so losing one is never treated as protection coming off.
Silence, counted
The signal with no producer is the one that matters most. An hourly sweep looks for phones whose last reading is older than the threshold, which is 24 hours, and marks them Dark. Your keyholder and supporters then see Not confirmed yet, and each gets a push saying your phone has gone quiet. It is the gentler of the two alarms: a dead battery and airplane mode look exactly like this.
This is also what closes the one known gap. Force quitting Fold’em and then switching Screen Time off in iOS Settings produces no reading at all, because there is no app running to take one. Nothing is heard until the next launch, and the 24 hour rule is what turns that quiet into something your circle sees instead of something nobody sees.
The phone is honest about the other direction too. When the app cannot reach the server, Today says so in one line, Offline. Showing what was saved. The face claims nothing it has not been told.
Today, offline
What this does not do
It does not watch what you do. There is no browsing history in a reading, no list of apps, no amount of money and nothing you typed, so there is nothing for any screen to leak by accident.
It does not make the block hold. Reporting and enforcing are separate: the shield is applied by Screen Time on the phone, and the reading only describes it. A probe that never arrives, a reading that never sends, and a phone with no signal all leave the block exactly where it was.
It cannot prove the block is on right now. A reading is true for the moment it was taken, and the state your circle sees is as fresh as the last one that arrived. It also reaches only this iPhone: a second phone, a computer or a shop are outside all of it.
Write to us and a person reads it. We answer within two working days, and we would rather hear the question twice than not at all.