ADDon Privacy Policy

Effective 2026-07-28, revised 11 August 2026 · applies to ADDon v0.27.1 and later. Statements are checked against the application source at each revision; the verification record lives in the project repository.

The short version

ADDon itself collects nothing. There is no required account and no sign-up: the app works fully without one. An optional account exists — sign in with Google and your calendar follows you between your devices, encrypted with a key only you hold. There is no analytics, no advertising, no crash reporting, and no server operated by the developer. Your data lives on your device and leaves it only for features you turn on, against a server you choose.

What data exists

• Your planning data — tasks, events, reminders, Future-file items, alarms, and the app's local statistics about your own usage (estimate calibration, deferral patterns, badge tallies).
• Profile details — a display name, country, language, theme, and optional age range and gender. None of these are identity: no email, no phone number, no account required. If you add the optional account, its email address and sign-in token are kept on this device for display and are left out of exports.
• Security material — if you set a PIN, only a hash of it is stored. Your recovery code is shown once and stored as a hash — unless you enable sync, which requires the code itself to be stored on-device as your encryption key (this is stated in the sync settings when you turn it on).

All of this is stored in the app's private storage on your device. The developer never sees any of it and has no way to.

What leaves your device

Nothing, by default. Specifically:

• No analytics or telemetry. The app contains no tracking of any kind.
• No developer server. There is no default sync server — the field ships empty.
• Sync (optional, off by default). If you enable it, your data is encrypted on your device with AES-256-GCM using a key derived from your recovery code before transmission. The server — one you choose or run yourself — stores bytes it cannot read, filed under an identifier it cannot link to you. Deleting a profile in-app also asks that server to delete its copy; if the server is unreachable at that moment, the encrypted copy may remain until it is reachable.
• Invites (optional, off by default). The invite service sees a one-way-derived identifier and a short code — never your name, your data, or anything readable.
• Account (optional, off by default). ADDon has an optional account: signing in with Google, through the service address you configured, using Google’s device flow. Adding the account also turns sync on for you. During sign-in that service sees your email once and returns it to your device for display; it stores only a one-way hash of your account id and the one-way identifier of your encrypted sync data — never the key, never content. Signing out deletes that record. Your calendar’s contents are never readable by the service or by Google. Groups, a shared-calendar feature built on this account, is upcoming and not in the app today.
• Calendar feeds (optional, off by default). If you subscribe to another calendar's iCal address (Google Calendar, Canvas, Outlook), ADDon fetches that address directly from your device a few times a day. The request carries no identifier beyond what any web request reveals (your network address), and the fetched items are stored only on your device. A profile with no feeds makes no such requests.
• Phone-calendar sync (optional, off by default; Android). If you turn on two-way sync with this phone’s calendar, ADDon writes its events and dated tasks into the device calendar you choose and reads that calendar’s entries for display inside ADDon. From there the phone’s own calendar account (Google’s, for most people) carries those entries between your devices exactly as it does for any calendar app. ADDon itself sends nothing to any server: everything happens through the device’s calendar storage, under a permission you can revoke at any time in system settings.
• Sending an event to Google Calendar (optional, per event) opens Google's own add-event page in your browser with the event's title and time in the link. That link goes to Google only when you tap it, inside your own Google session; ADDon itself sends nothing.
• Alerts on your lock screen. Alarm and reminder notifications display the title you typed for the item. If you would not want a title on your lock screen, use your device's notification privacy settings or a discreet title.

What ADDon asks the operating system for

• Notification permission — so alarms and reminders can sound. The app works without it and says plainly what is lost.
• Exact-alarm scheduling (Android) — so an alarm rings at the minute you set.
• Calendar access (Android, optional) — requested only if you turn on two-way sync with this phone’s calendar, and used only for that. Never requested otherwise.
• Nothing else. No location, no contacts, no camera, no microphone, no storage beyond the app's own sandbox, no network permission use beyond the optional features above.

Data retention and deletion

Everything you type lives on your device: deleting a profile erases it, and uninstalling the app erases everything on the device. Android’s cloud backup is disabled for ADDon, so no copy rides your device backup. If you added an account, signing out deletes its record on the service — sign out before uninstalling if you want that record gone too. For synced profiles, in-app profile deletion also issues a delete to your chosen server as described above. You can export your data at any time from Profile & settings as a plain JSON file you fully control.

Children

ADDon itself collects personal information from no one, including children. The optional account is a sync tool that stores a scrambled identifier on the service you choose, deleted on sign-out. The optional age field exists only to shape on-device defaults and never leaves the device.

Changes

If a future version ever changes what leaves the device, this policy will change with it, the in-app description will say so before you opt in, and the version history will record the change.

Contact

Questions about this policy, or about anything ADDon does with your data: tgsonkran@gmail.com.

Last updated: 11 August 2026.