ADDon Privacy Policy
Effective 2026-07-28, revised 18 August 2026 · applies to ADDon v0.27.1 and later. Statements are checked against the application source at each revision; the verification record lives in the project repository.
The short version
ADDon itself collects nothing. There is no required account and no sign-up: the app works fully without one. An optional account is built in but not yet offered in this release — no sign-in appears anywhere in the app today. When it is offered (or if you added it in an earlier version), signing in with Google lets your calendar follow you between your devices, encrypted with a key only you hold. There is no analytics, no advertising, no crash reporting, and no server operated by the developer. Your data lives on your device and leaves it only for features you turn on, against a server you choose.
What data exists
- Your planning data — tasks, events, reminders, Future-file items, alarms, and
the app's local statistics about your own usage (estimate calibration, deferral patterns, badge
tallies).
- Profile details — a display name, country, language, theme, and
optional age range and gender. None of these are identity: no email, no phone number, no account required.
The display name is optional and can be anything: a name, a username, or the one ADDon generates
for you (like User482913). ADDon never reads your device’s contacts to fill it.
If you add the optional account, its name, email address, and sign-in token are kept on this device
for display and are left out of exports. Your profile’s display name takes the account’s name.
- Security material — if you set a PIN, only a hash of it is stored. Your
recovery code is shown once and stored as a hash — unless you enable sync, which requires the code
itself to be stored on-device as your encryption key (this is stated in the sync settings when you
turn it on).
All of this is stored in the app's private storage on your device. The developer never sees any
of it and has no way to.
What leaves your device
Nothing, by default. Specifically:
- No analytics or telemetry. The app contains no tracking of any kind.
- No developer server. There is no default sync server — the field ships
empty.
- Sync (optional, off by default). If you enable it, your data is encrypted on
your device with AES-256-GCM using a key derived from your recovery code before
transmission. The server — one you choose or run yourself — stores bytes it cannot read, filed
under an identifier it cannot link to you. Deleting a profile in-app also asks that server to
delete its copy; if the server is unreachable at that moment, the encrypted copy may remain until
it is reachable.
- Invites (optional, off by default). The invite service sees a
one-way-derived identifier and a short code — never your name, your data, or anything
readable.
- Account (optional, off by default; not offered in the current release — this describes the capability for when it is, and for profiles that added it earlier). Signing in with Google runs through the service address you configured, using Google’s device flow. Adding the account also turns sync on for you. During sign-in that service sees your name and email once and returns them to your device for display; it stores only a one-way hash of your account id and the one-way identifier of your encrypted sync data — never the key, never content. Signing out deletes that record. Your calendar’s contents are never readable by the service or by Google. Groups, a shared-calendar feature built on this account, is upcoming and not in the app today.
- Calendar feeds (optional, off by default). If you subscribe to another
calendar's iCal address (Google Calendar, Canvas, Outlook), ADDon fetches that address
directly from your device a few times a day. The request carries no identifier beyond what any
web request reveals (your network address), and the fetched items are stored only on
your device. A profile with no feeds makes no such requests.
- Android's own backup (on by default at the system level; Android). If your phone's "Backup by Google One" (or the manufacturer's equivalent) is switched on in the phone's settings, Android itself — not ADDon — periodically keeps a copy of the app's on-device data in your own Google account, alongside the rest of the phone's app data. On Android 9 and later with a screen lock set, that copy is end-to-end encrypted with a key Google does not hold, and ADDon's rules allow the cloud copy only when that encryption is available. Cable or phone-to-phone transfers during a phone change carry the data directly between your devices. ADDon operates no server in any of this and can read none of it; you control the whole feature from the phone's own backup settings.
- Phone-calendar sync (optional, off by default; Android). If you turn on two-way sync with this phone’s calendars, ADDon writes its events and dated tasks into the first device calendar you connect and reads the entries of every device calendar you connect for display inside ADDon. From there the phone’s own calendar accounts (Google’s, for most people) carry those entries between your devices exactly as they do for any calendar app. ADDon itself sends nothing to any server: everything happens through the device’s calendar storage, under a permission you can revoke at any time in system settings.
- Sending an event to Google Calendar (optional, per event) opens Google's
own add-event page in your browser with the event's title and time in the link. That link
goes to Google only when you tap it, inside your own Google session; ADDon itself sends
nothing.
- Alerts on your lock screen. Alarm and reminder notifications display the
item’s title, including event titles from calendars you connect. If you would not want a title
on your lock screen, use your device’s notification privacy settings, a discreet title, or turn
off ringing for connected calendars.
What ADDon asks the operating system for
- Notification permission — so alarms and reminders can sound. The app works
without it and says plainly what is lost.
- Exact-alarm scheduling (Android) — so an alarm rings at the minute you
set.
- Calendar access (Android, optional) — requested only if you turn on two-way sync with this phone’s calendar, and used only for that. Never requested otherwise.
- Nothing else. No location, no contacts, no camera, no microphone, no storage beyond the app's
own sandbox, no network permission use beyond the optional features above.
Data retention and deletion
Everything you type lives on your device: deleting a profile erases it, and uninstalling the app erases everything on the device. If Android's own backup is on in your phone's settings, a copy rides that backup in your own Google account (see "Android's own backup" above) — deleting it is done from the phone's backup settings, like any app's backup copy. If you added an account, signing out deletes its record on the service — sign out before uninstalling if you want that record gone too. For synced profiles, in-app profile deletion also issues a delete to your chosen server as described above. You can export your data at any time from Profile & settings as a plain JSON file you fully control.
Children
ADDon itself collects personal information from no one, including children. The optional account is a sync tool that stores a scrambled identifier on the service you choose, deleted on sign-out. The optional age field exists only to shape on-device defaults and never leaves the device.
Changes
If a future version ever changes what leaves the device, this policy will change with it, the
in-app description will say so before you opt in, and the version history will record the
change.
Contact
Questions about this policy, or about anything ADDon does with your data:
tgsonkran@gmail.com.
If you email, your address and message reach that inbox and are used only to answer you; they are never added to a database, never shared, and you can ask for the thread's deletion at any time. The app itself sends nothing — the support buttons only open your own mail app, pre-filled with a subject naming the app version.
Last updated: 18 August 2026.