ADDon Privacy Policy

Effective 2026-07-28 · applies to ADDon v0.27.1 and later. Every statement below was verified against the application source code on the effective date.

The short version

ADDon collects nothing. There is no account, no email address, no sign-up, no analytics, no advertising, no crash reporting, and no server operated by the developer. Your data lives on your device and leaves it only if you deliberately turn on sync or invites against a server you choose — and even then it leaves encrypted with a key only you hold.

What data exists

• Your planning data — tasks, events, reminders, Future-file items, alarms, and the app's local statistics about your own usage (estimate calibration, deferral patterns, badge tallies).
• Profile details — a display name, country, language, theme, and optional age range and gender. None of these are identity: no email, no phone number, no account.
• Security material — if you set a PIN, only a hash of it is stored. Your recovery code is shown once and stored as a hash — unless you enable sync, which requires the code itself to be stored on-device as your encryption key (this is stated in the sync settings when you turn it on).

All of this is stored in the app's private storage on your device. The developer never sees any of it and has no way to.

What leaves your device

Nothing, by default. Specifically:

• No analytics or telemetry. The app contains no tracking of any kind.
• No developer server. There is no default sync server — the field ships empty.
• Sync (optional, off by default). If you enable it, your data is encrypted on your device with AES-256-GCM using a key derived from your recovery code before transmission. The server — one you choose or run yourself — stores bytes it cannot read, filed under an identifier it cannot link to you. Deleting a profile in-app also asks that server to delete its copy; if the server is unreachable at that moment, the encrypted copy may remain until it is reachable.
• Invites (optional, off by default). The invite service sees a one-way-derived identifier and a short code — never your name, your data, or anything readable.
• Groups (optional, off by default). A group's shared items are encrypted on your device with AES-256-GCM under a key that travels only inside the group's invite code — the service stores bytes it cannot read. Joining or creating a group requires linking a Google account, which is used for identity only: the service keeps a salted, one-way hash of your Google account id — never your email, your name, or any content — and nothing about your calendar ever touches Google. The email shown in the app stays on your device and is not included in sync or export. Unlinking removes the account from the app immediately.
• Membership recovery record (with groups). So a reinstall can later learn which groups an account belonged to, the service keeps a list of group identifiers per hashed account id. It cannot restore group keys or read group content.
• Calendar feeds (optional, off by default). If you subscribe to another calendar's iCal address (Google Calendar, Canvas, Outlook), ADDon fetches that address directly from your device a few times a day. The request carries nothing about you — no identifier, no data, just the address you pasted — and the fetched items are stored only on your device. A profile with no feeds makes no such requests.
• Phone-calendar sync (optional, off by default; Android). If you turn on two-way sync with this phone’s calendar, ADDon writes its events and dated tasks into the device calendar you choose and reads that calendar’s entries for display inside ADDon. From there the phone’s own calendar account (Google’s, for most people) carries those entries between your devices exactly as it does for any calendar app. ADDon itself sends nothing to any server: everything happens through the device’s calendar storage, under a permission you can revoke at any time in system settings.
• Sending an event to Google Calendar (optional, per event) opens Google's own add-event page in your browser with the event's title and time in the link. That link goes to Google only when you tap it, inside your own Google session; ADDon itself sends nothing.
• Alerts on your lock screen. Alarm and reminder notifications display the title you typed for the item. If you would not want a title on your lock screen, use your device's notification privacy settings or a discreet title.

What ADDon asks the operating system for

• Notification permission — so alarms and reminders can sound. The app works without it and says plainly what is lost.
• Exact-alarm scheduling (Android) — so an alarm rings at the minute you set.
• Calendar access (Android, optional) — requested only if you turn on two-way sync with this phone’s calendar, and used only for that. Never requested otherwise.
• Nothing else. No location, no contacts, no camera, no microphone, no storage beyond the app's own sandbox, no network permission use beyond the optional features above.

Data retention and deletion

Everything lives on your device: deleting a profile erases it, and uninstalling the app erases everything. Android's cloud backup is disabled for ADDon, so no copy rides your device backup. For synced profiles, in-app profile deletion also issues a delete to your chosen server as described above. You can export your data at any time from Profile & settings as a plain JSON file you fully control.

Children

ADDon does not collect personal information from anyone, including children. The optional age field exists only to shape on-device defaults and never leaves the device.

Changes

If a future version ever changes what leaves the device, this policy will change with it, the in-app description will say so before you opt in, and the version history will record the change.

Contact

Questions about this policy, or about anything ADDon does with your data: tgsonkran@gmail.com.

Last updated: 10 August 2026.