docs: bring the privacy policy in sync with the published page
The published page carried sections the repo file never had — controller and postal address, permissions, distribution channels, external links, GDPR rights, and the CalDAV specifics (RFC 6764 discovery, Nextcloud Login Flow, the user-CA trade-off). Since the site now renders this file, those would have been dropped from the live page. Two corrections while merging: contact is business@, matching the site and Calendula's policy, and cleartext HTTP is refused outright — allowCleartext is false with no way to turn it on, so the old "unless you opt in" was wrong.
This commit is contained in:
+192
-43
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Privacy Policy — Agendula
|
||||
description: What Agendula does with your data. No servers, no account, no analytics — your tasks stay on your device unless you add a CalDAV server yourself.
|
||||
updated: 2026-09-07
|
||||
updated: 2026-09-09
|
||||
---
|
||||
|
||||
<!--
|
||||
@@ -21,34 +21,68 @@ updated: 2026-09-07
|
||||
render on the published page.
|
||||
-->
|
||||
|
||||
_Last updated: 2026-09-07._
|
||||
**Last updated:** 9 September 2026
|
||||
Applies to the Android app **Agendula** (package `de.jeanlucmakiola.agendula`),
|
||||
all versions and all distribution channels.
|
||||
|
||||
Agendula is a task app for Android, published by Jean-Luc Makiola. This policy
|
||||
describes what happens to your data. It is short because very little happens to
|
||||
it.
|
||||
## In short
|
||||
|
||||
## The short version
|
||||
Agendula has no servers, no user accounts and no analytics. Your tasks live on
|
||||
your device. They leave it in exactly one case: if you set up a CalDAV account
|
||||
yourself, they are synchronised with **the server you entered** — and with
|
||||
nothing and no one else. Nothing is ever sent to the developer.
|
||||
|
||||
Agendula has no servers. There is no Agendula account, no analytics, no
|
||||
advertising, no tracking and no third-party SDK that reports anything anywhere.
|
||||
Your tasks live on your device, and — only if you set that up yourself — on a
|
||||
CalDAV server **you** choose.
|
||||
## 1. Controller
|
||||
|
||||
## What is stored on your device
|
||||
IT-Dienstleister | Jean-Luc Makiola
|
||||
Mahlerstraße 10
|
||||
14772 Brandenburg an der Havel
|
||||
Email: [business@jeanlucmakiola.de](mailto:business@jeanlucmakiola.de)
|
||||
|
||||
- Your task lists, tasks, reminders and app settings.
|
||||
- If you add a CalDAV account: the server address, your username, and your
|
||||
password or app password. The password is encrypted with a key held in the
|
||||
Android Keystore, which cannot be exported from the device.
|
||||
## 2. No data collection by the developer
|
||||
|
||||
## What leaves your device
|
||||
Agendula contains **no analytics, no tracking, no advertising, no
|
||||
crash-reporting SDK and no third-party service that reports anything
|
||||
anywhere**. No user profile is created, no advertising or device identifier is
|
||||
generated, and no data is shared with or sold to anyone. There is no Agendula
|
||||
account, and the developer operates no server that the app talks to.
|
||||
|
||||
**Only if you add a CalDAV account**, and only to the server you entered:
|
||||
All of this is verifiable in the
|
||||
[source code](https://codeberg.org/jlmakiola/agendula), which is public.
|
||||
|
||||
- Your tasks in those lists, as iCalendar data, and the credentials needed to
|
||||
authenticate.
|
||||
- Requests are made over HTTPS. Cleartext HTTP is refused unless you explicitly
|
||||
opt in for a specific account.
|
||||
## 3. Where your tasks live — your choice
|
||||
|
||||
- **On your device (the default)** — your task lists, tasks and reminders are
|
||||
kept in Agendula's own database inside the app's private storage. Nothing is
|
||||
published to other apps, and uninstalling the app removes it.
|
||||
- **In a tasks provider you already use** — OpenTasks or tasks.org. Agendula
|
||||
then reads and writes that app's task database through Android's provider
|
||||
mechanism, after you grant its read/write permission. Whatever already
|
||||
synchronises that provider (DAVx5, SmoothSync, DecSync CC, …) keeps doing so,
|
||||
unchanged; that synchronisation is performed by those apps, not by Agendula,
|
||||
and their privacy policies apply to it.
|
||||
|
||||
## 4. CalDAV sync — the only case where your tasks leave the device
|
||||
|
||||
Sync is optional and off until you add an account. If you add one, everything
|
||||
below happens between your device and **the server you nominated**, and nowhere
|
||||
else.
|
||||
|
||||
### What is stored on your device
|
||||
|
||||
The server address, your username, and your password or app password. The
|
||||
password is encrypted with a key held in the Android Keystore, which cannot be
|
||||
exported from the device.
|
||||
|
||||
### What is transmitted, and to whom
|
||||
|
||||
- The tasks in the synchronised lists, as standard iCalendar (`VTODO`) data,
|
||||
and the credentials needed to authenticate.
|
||||
- Requests carry the user agent `Agendula (Android)` — a fixed string, so that
|
||||
you can recognise and revoke the session on your server. No device identifier
|
||||
is sent.
|
||||
- Connections are HTTPS. Cleartext HTTP is refused, so credentials are never
|
||||
sent over an unencrypted connection.
|
||||
|
||||
Nothing is sent anywhere else. In particular, nothing is sent to the developer.
|
||||
|
||||
@@ -57,41 +91,156 @@ defines collection as transmitting data off the device, regardless of who
|
||||
receives it — and **not shared**, because the only recipient is the server you
|
||||
nominated. Data is encrypted in transit.
|
||||
|
||||
Your CalDAV provider has its own privacy policy, and your data on their server is
|
||||
governed by it. Agendula has no relationship with them.
|
||||
### Finding your server
|
||||
|
||||
## Crash reports
|
||||
When you type a server address or an email domain, Agendula follows the
|
||||
standard discovery procedure (RFC 6764): a DNS lookup for the `_caldavs._tcp`
|
||||
service record of that domain, then `/.well-known/caldav` on the host. The DNS
|
||||
query goes to whichever resolver your device or network uses, and the requests
|
||||
go to the domain you typed — no directory of servers is consulted and no lookup
|
||||
is sent to the developer.
|
||||
|
||||
If the app crashes, it can show you the report and ask whether to send it. It is
|
||||
never sent without you choosing to send it, and you can read the whole report
|
||||
first.
|
||||
### Signing in to a Nextcloud
|
||||
|
||||
## Backups
|
||||
If the server is a Nextcloud, Agendula uses Nextcloud's Login Flow v2: your
|
||||
browser opens *your own server's* login page, you authorise there, and the
|
||||
server hands the app a dedicated app password. Agendula never sees your actual
|
||||
account password. The app password appears in your server's "Devices &
|
||||
sessions" list as `Agendula (Android)`, and you can revoke it there at any
|
||||
time. Removing the account in Agendula revokes it too, where the server
|
||||
supports that.
|
||||
|
||||
If Android Auto Backup is enabled on your device, your tasks and settings may be
|
||||
backed up to your own Google account. Two things are deliberately excluded: your
|
||||
stored CalDAV password, and Agendula's per-device sync bookkeeping.
|
||||
### Your server's own policy
|
||||
|
||||
## Deleting your data
|
||||
Your CalDAV provider has its own privacy policy, and your data on their server
|
||||
is governed by it. Agendula has no relationship with them.
|
||||
|
||||
A note on certificates: Agendula trusts private certificate authorities that
|
||||
you have installed in your device's user store, because self-hosted servers
|
||||
routinely use them. That is a deliberate trade-off in favour of self-hosters —
|
||||
any CA installed on your device (for example by an employer's management
|
||||
profile) can, in principle, intercept traffic from the app, as it can from
|
||||
other apps that make the same choice.
|
||||
|
||||
## 5. Other data Agendula handles on your device
|
||||
|
||||
### Reminders and notifications
|
||||
|
||||
Due-date reminders are scheduled by the app itself and displayed as local
|
||||
notifications. Nothing is sent to a push service — there is no push service.
|
||||
|
||||
### Export files
|
||||
|
||||
You can export your tasks as standard iCalendar `.ics` files. Agendula writes
|
||||
exactly the file you select through Android's system file picker, and has no
|
||||
access to other files.
|
||||
|
||||
### App settings
|
||||
|
||||
Your preferences (theme, language, list and reminder defaults and similar) are
|
||||
stored locally on your device and are removed when you uninstall the app.
|
||||
|
||||
## 6. Backups
|
||||
|
||||
If Android Auto Backup is enabled on your device, your tasks and settings may
|
||||
be backed up to your own Google account, under Google's terms — the developer
|
||||
has no access to it. Two things are deliberately excluded from that backup:
|
||||
your stored CalDAV password, and Agendula's per-device sync bookkeeping. After
|
||||
restoring onto a new device you therefore sign in to your server again.
|
||||
|
||||
## 7. Crash reports
|
||||
|
||||
If Agendula crashes, it offers to report the problem. Nothing is sent
|
||||
automatically, even though the app has network access. The report is copied to
|
||||
your clipboard and your browser is opened with the project's issue tracker, the
|
||||
text pre-filled. **You see the full content, you decide whether to submit it,
|
||||
and you can edit or discard it.**
|
||||
|
||||
Such a report contains:
|
||||
|
||||
- app version,
|
||||
- Android version,
|
||||
- device manufacturer and model,
|
||||
- your device language,
|
||||
- the timestamp,
|
||||
- and the technical stack trace.
|
||||
|
||||
It is built from that fixed list and nothing else: **no** task data, **no**
|
||||
server address or credentials, **no** account names, **no** log files and
|
||||
**no** personal identifiers.
|
||||
|
||||
If you choose to submit it, the report becomes a public issue on the project's
|
||||
issue tracker at Codeberg, operated by Codeberg e. V. Their privacy policy then
|
||||
applies to that submission.
|
||||
|
||||
## 8. External links
|
||||
|
||||
The app links to the source code, the licence, the issue tracker, the
|
||||
translation platform (Weblate) and a voluntary donation page (Ko-fi). Following
|
||||
one of these links opens your browser and leaves the app; the privacy policy of
|
||||
the respective website then applies. Agendula transmits no data of yours in the
|
||||
process — it only opens the address.
|
||||
|
||||
## 9. Permissions and why they exist
|
||||
|
||||
- `INTERNET`, `ACCESS_NETWORK_STATE` — CalDAV sync with the server you
|
||||
configure, and checking whether a connection exists before trying. Without a
|
||||
CalDAV account, no connection is made.
|
||||
- `READ_SYNC_SETTINGS`, `WRITE_SYNC_SETTINGS` — register the sync account with
|
||||
Android's sync framework so it can be scheduled.
|
||||
- `POST_NOTIFICATIONS` — show reminders.
|
||||
- `USE_EXACT_ALARM`, `SCHEDULE_EXACT_ALARM` — deliver reminders at the exact
|
||||
due time.
|
||||
- `RECEIVE_BOOT_COMPLETED` — re-register pending reminders after a restart.
|
||||
- `org.dmfs.permission.READ_TASKS` / `WRITE_TASKS` and
|
||||
`org.tasks.permission.READ_TASKS` / `WRITE_TASKS` — optional, requested only
|
||||
if you choose the external-provider storage mode, and only for the provider
|
||||
you selected (OpenTasks or tasks.org).
|
||||
- `WAKE_LOCK`, `FOREGROUND_SERVICE` — required by the Android system component
|
||||
used for scheduled background work (WorkManager); on older Android versions
|
||||
it needs them to run an expedited sync.
|
||||
|
||||
Agendula publishes no content provider of its own and declares no permissions
|
||||
that other apps could request.
|
||||
|
||||
## 10. Distribution channels
|
||||
|
||||
Agendula is distributed through the project's releases on Codeberg, a
|
||||
self-hosted F-Droid repository, Obtainium, and — where applicable — F-Droid and
|
||||
the Google Play Store. When you download or update the app, the operator of
|
||||
that channel processes data (such as your IP address) under their own privacy
|
||||
policy. This is outside the developer's control and unrelated to the app's own
|
||||
behaviour.
|
||||
|
||||
## 11. Children
|
||||
|
||||
Agendula is not directed at children and collects nothing about anyone.
|
||||
|
||||
## 12. Deleting your data
|
||||
|
||||
- **Remove a CalDAV account** from Settings → Accounts. This deletes the stored
|
||||
credential and, where the server supports it, revokes the app password. Task
|
||||
lists become device-only lists rather than being destroyed.
|
||||
- **Remove an account and delete its local data** removes the lists and tasks as
|
||||
well.
|
||||
- **Remove an account and delete its local data** removes the lists and tasks
|
||||
as well.
|
||||
- **Uninstalling the app** removes everything Agendula stored on the device.
|
||||
|
||||
Deleting data from your CalDAV server is done on that server.
|
||||
Deleting data from your CalDAV server is done on that server; data in an
|
||||
external tasks provider is deleted in that app.
|
||||
|
||||
## Children
|
||||
## 13. Your rights
|
||||
|
||||
Agendula is not directed at children and collects nothing about anyone.
|
||||
The developer stores no personal data of yours — the only data transfer the app
|
||||
performs is between your device and a server you operate or chose. There is
|
||||
therefore no data held by the developer to which rights of access,
|
||||
rectification, erasure, restriction, data portability or objection (Art. 15–21
|
||||
GDPR) could apply. Your tasks are exportable as standard `.ics` files from
|
||||
within the app at any time. You may contact the address above with any
|
||||
question, and you have the right to lodge a complaint with a supervisory
|
||||
authority.
|
||||
|
||||
## Changes
|
||||
## 14. Changes to this policy
|
||||
|
||||
Material changes will be noted here with a new date at the top. The history of
|
||||
Should the app's functionality change in a way that affects data processing,
|
||||
this policy will be updated and the date at the top adjusted. The history of
|
||||
this file is public in the repository.
|
||||
|
||||
## Contact
|
||||
|
||||
mail@jeanlucmakiola.de
|
||||
|
||||
Reference in New Issue
Block a user