Move the privacy policy into the repo (#12)

The policy had no copy in this repository — it existed only inside the Astro page on jeanlucmakiola.de. This file becomes the single copy: the website build checks this repo out beside itself and renders `docs/PRIVACY.md` through a content collection, so the published page and the app's own documentation cannot drift. Same arrangement as calendula#293. Shaped as the content entry the site expects: `title` / `description` / `updated` frontmatter, an HTML maintainer note that cannot render, and a body starting below the `h1` the page supplies. The text is the published page carried over in full — controller and postal address, the two storage modes, CalDAV sync (what is stored, what is transmitted, RFC 6764 discovery, Nextcloud Login Flow v2, the user-CA trade-off), reminders and export, backups, crash reports, external links, permissions, distribution channels, deletion paths and GDPR rights. Two things differ from the older short version that lived on `feat/caldav-sync`: - Contact is `business@jeanlucmakiola.de`, matching the site and Calendula's policy, rather than `mail@`. - Cleartext HTTP is described as refused outright. `CalDavDiscovery.allowCleartext` is `false` with nothing wiring it true, and `network_security_config.xml` sets `cleartextTrafficPermitted="false"`, so the previous "unless you explicitly opt in for a specific account" described a feature that does not exist. It goes back if a per-account opt-in ships. Split out of `feat/caldav-sync` so the website change is not waiting on the whole sync branch. No issue to close — there is no open privacy/policy issue to reference. Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de> Reviewed-on: https://codeberg.org/jlmakiola/agendula/pulls/12
2026-09-09 16:52:17 +02:00
parent d7131087cb
commit 633ec5b5d3
1 changed files with 246 additions and 0 deletions
@@ -0,0 +1,246 @@
 ---
 title: Privacy Policy — Agendula
 description: What Agendula does with your data. No servers, no account, no analytics — your tasks stay on your device unless you add a CalDAV server yourself.
 updated: 2026-09-09
 ---
 <!--
  THIS FILE IS THE POLICY. Edit it here, in a PR, reviewed like any other
  change — it is the source of truth.
  It is published at https://jeanlucmakiola.de/agendula/privacy, which is what
  the app's Settings → About → Privacy policy row opens and what the Play
  Console field must hold. That page holds no copy of the prose: the website
  build checks this repository out beside itself and renders this file through
  an Astro content collection, so there is exactly one copy of the policy
  anywhere and the two cannot drift. An edit here reaches the live page on the
  site's next build.
  The page supplies its own <h1> from the `title` above, so this body starts at
  the first section — do not add one. This comment is HTML so that it cannot
  render on the published page.
 -->
 **Last updated:** 9 September 2026  
 Applies to the Android app **Agendula** (package `de.jeanlucmakiola.agendula`),
 all versions and all distribution channels.
 ## In short
 Agendula has no servers, no user accounts and no analytics. Your tasks live on
 your device. They leave it in exactly one case: if you set up a CalDAV account
 yourself, they are synchronised with **the server you entered** — and with
 nothing and no one else. Nothing is ever sent to the developer.
 ## 1. Controller
 IT-Dienstleister | Jean-Luc Makiola  
 Mahlerstraße 10  
 14772 Brandenburg an der Havel  
 Email: [business@jeanlucmakiola.de](mailto:business@jeanlucmakiola.de)
 ## 2. No data collection by the developer
 Agendula contains **no analytics, no tracking, no advertising, no
 crash-reporting SDK and no third-party service that reports anything
 anywhere**. No user profile is created, no advertising or device identifier is
 generated, and no data is shared with or sold to anyone. There is no Agendula
 account, and the developer operates no server that the app talks to.
 All of this is verifiable in the
 [source code](https://codeberg.org/jlmakiola/agendula), which is public.
 ## 3. Where your tasks live — your choice
 - **On your device (the default)** — your task lists, tasks and reminders are
  kept in Agendula's own database inside the app's private storage. Nothing is
  published to other apps, and uninstalling the app removes it.
 - **In a tasks provider you already use** — OpenTasks or tasks.org. Agendula
  then reads and writes that app's task database through Android's provider
  mechanism, after you grant its read/write permission. Whatever already
  synchronises that provider (DAVx5, SmoothSync, DecSync CC, …) keeps doing so,
  unchanged; that synchronisation is performed by those apps, not by Agendula,
  and their privacy policies apply to it.
 ## 4. CalDAV sync — the only case where your tasks leave the device
 Sync is optional and off until you add an account. If you add one, everything
 below happens between your device and **the server you nominated**, and nowhere
 else.
 ### What is stored on your device
 The server address, your username, and your password or app password. The
 password is encrypted with a key held in the Android Keystore, which cannot be
 exported from the device.
 ### What is transmitted, and to whom
 - The tasks in the synchronised lists, as standard iCalendar (`VTODO`) data,
  and the credentials needed to authenticate.
 - Requests carry the user agent `Agendula (Android)` — a fixed string, so that
  you can recognise and revoke the session on your server. No device identifier
  is sent.
 - Connections are HTTPS. Cleartext HTTP is refused, so credentials are never
  sent over an unencrypted connection.
 Nothing is sent anywhere else. In particular, nothing is sent to the developer.
 Under Google Play's Data Safety definitions this counts as **collected** — Play
 defines collection as transmitting data off the device, regardless of who
 receives it — and **not shared**, because the only recipient is the server you
 nominated. Data is encrypted in transit.
 ### Finding your server
 When you type a server address or an email domain, Agendula follows the
 standard discovery procedure (RFC 6764): a DNS lookup for the `_caldavs._tcp`
 service record of that domain, then `/.well-known/caldav` on the host. The DNS
 query goes to whichever resolver your device or network uses, and the requests
 go to the domain you typed — no directory of servers is consulted and no lookup
 is sent to the developer.
 ### Signing in to a Nextcloud
 If the server is a Nextcloud, Agendula uses Nextcloud's Login Flow v2: your
 browser opens *your own server's* login page, you authorise there, and the
 server hands the app a dedicated app password. Agendula never sees your actual
 account password. The app password appears in your server's "Devices &
 sessions" list as `Agendula (Android)`, and you can revoke it there at any
 time. Removing the account in Agendula revokes it too, where the server
 supports that.
 ### Your server's own policy
 Your CalDAV provider has its own privacy policy, and your data on their server
 is governed by it. Agendula has no relationship with them.
 A note on certificates: Agendula trusts private certificate authorities that
 you have installed in your device's user store, because self-hosted servers
 routinely use them. That is a deliberate trade-off in favour of self-hosters —
 any CA installed on your device (for example by an employer's management
 profile) can, in principle, intercept traffic from the app, as it can from
 other apps that make the same choice.
 ## 5. Other data Agendula handles on your device
 ### Reminders and notifications
 Due-date reminders are scheduled by the app itself and displayed as local
 notifications. Nothing is sent to a push service — there is no push service.
 ### Export files
 You can export your tasks as standard iCalendar `.ics` files. Agendula writes
 exactly the file you select through Android's system file picker, and has no
 access to other files.
 ### App settings
 Your preferences (theme, language, list and reminder defaults and similar) are
 stored locally on your device and are removed when you uninstall the app.
 ## 6. Backups
 If Android Auto Backup is enabled on your device, your tasks and settings may
 be backed up to your own Google account, under Google's terms — the developer
 has no access to it. Two things are deliberately excluded from that backup:
 your stored CalDAV password, and Agendula's per-device sync bookkeeping. After
 restoring onto a new device you therefore sign in to your server again.
 ## 7. Crash reports
 If Agendula crashes, it offers to report the problem. Nothing is sent
 automatically, even though the app has network access. The report is copied to
 your clipboard and your browser is opened with the project's issue tracker, the
 text pre-filled. **You see the full content, you decide whether to submit it,
 and you can edit or discard it.**
 Such a report contains:
 - app version,
 - Android version,
 - device manufacturer and model,
 - your device language,
 - the timestamp,
 - and the technical stack trace.
 It is built from that fixed list and nothing else: **no** task data, **no**
 server address or credentials, **no** account names, **no** log files and
 **no** personal identifiers.
 If you choose to submit it, the report becomes a public issue on the project's
 issue tracker at Codeberg, operated by Codeberg e. V. Their privacy policy then
 applies to that submission.
 ## 8. External links
 The app links to the source code, the licence, the issue tracker, the
 translation platform (Weblate) and a voluntary donation page (Ko-fi). Following
 one of these links opens your browser and leaves the app; the privacy policy of
 the respective website then applies. Agendula transmits no data of yours in the
 process — it only opens the address.
 ## 9. Permissions and why they exist
 - `INTERNET`, `ACCESS_NETWORK_STATE` — CalDAV sync with the server you
  configure, and checking whether a connection exists before trying. Without a
  CalDAV account, no connection is made.
 - `READ_SYNC_SETTINGS`, `WRITE_SYNC_SETTINGS` — register the sync account with
  Android's sync framework so it can be scheduled.
 - `POST_NOTIFICATIONS` — show reminders.
 - `USE_EXACT_ALARM`, `SCHEDULE_EXACT_ALARM` — deliver reminders at the exact
  due time.
 - `RECEIVE_BOOT_COMPLETED` — re-register pending reminders after a restart.
 - `org.dmfs.permission.READ_TASKS` / `WRITE_TASKS` and
  `org.tasks.permission.READ_TASKS` / `WRITE_TASKS` — optional, requested only
  if you choose the external-provider storage mode, and only for the provider
  you selected (OpenTasks or tasks.org).
 - `WAKE_LOCK`, `FOREGROUND_SERVICE` — required by the Android system component
  used for scheduled background work (WorkManager); on older Android versions
  it needs them to run an expedited sync.
 Agendula publishes no content provider of its own and declares no permissions
 that other apps could request.
 ## 10. Distribution channels
 Agendula is distributed through the project's releases on Codeberg, a
 self-hosted F-Droid repository, Obtainium, and — where applicable — F-Droid and
 the Google Play Store. When you download or update the app, the operator of
 that channel processes data (such as your IP address) under their own privacy
 policy. This is outside the developer's control and unrelated to the app's own
 behaviour.
 ## 11. Children
 Agendula is not directed at children and collects nothing about anyone.
 ## 12. Deleting your data
 - **Remove a CalDAV account** from Settings → Accounts. This deletes the stored
  credential and, where the server supports it, revokes the app password. Task
  lists become device-only lists rather than being destroyed.
 - **Remove an account and delete its local data** removes the lists and tasks
  as well.
 - **Uninstalling the app** removes everything Agendula stored on the device.
 Deleting data from your CalDAV server is done on that server; data in an
 external tasks provider is deleted in that app.
 ## 13. Your rights
 The developer stores no personal data of yours — the only data transfer the app
 performs is between your device and a server you operate or chose. There is
 therefore no data held by the developer to which rights of access,
 rectification, erasure, restriction, data portability or objection (Art. 15–21
 GDPR) could apply. Your tasks are exportable as standard `.ics` files from
 within the app at any time. You may contact the address above with any
 question, and you have the right to lodge a complaint with a supervisory
 authority.
 ## 14. Changes to this policy
 Should the app's functionality change in a way that affects data processing,
 this policy will be updated and the date at the top adjusted. The history of
 this file is public in the repository.