agendula/docs/PRIVACY.md

title, description, updated

title	description	updated
Privacy Policy — Agendula	What Agendula does with your data. No servers, no account, no analytics — your tasks stay on your device unless you add a CalDAV server yourself.	2026-09-21

Last updated: 21 September 2026
Applies to the Android app Agendula (package de.jeanlucmakiola.agendula), all versions and all distribution channels.

In short

Agendula has no servers, no user accounts and no analytics. Your tasks live on your device. They leave it in exactly one case: if you set up a CalDAV account yourself, they are synchronised with the server you entered — and with nothing and no one else. Nothing is ever sent to the developer.

As of version 1.0.0, CalDAV sync is not in the app yet. It is designed and described here so that this policy does not have to change underneath you when it arrives, but the released app has no network access of its own at all — it does not hold Android's INTERNET permission, so section 4 cannot happen on this version. Until it ships, your tasks leave the device only if you export them, or if a separate sync app you installed yourself syncs a task provider you pointed Agendula at (section 3).

1. Controller

IT-Dienstleister | Jean-Luc Makiola
Mahlerstraße 10
14772 Brandenburg an der Havel
Email: support@jeanlucmakiola.de

2. No data collection by the developer

Agendula contains no analytics, no tracking, no advertising, no crash-reporting SDK and no third-party service that reports anything anywhere. No user profile is created, no advertising or device identifier is generated, and no data is shared with or sold to anyone. There is no Agendula account, and the developer operates no server that the app talks to.

All of this is verifiable in the source code, which is public.

3. Where your tasks live — your choice

• On your device (the default) — your task lists, tasks and reminders are kept in Agendula's own database inside the app's private storage. Nothing is published to other apps, and uninstalling the app removes it.
• In a tasks provider you already use — OpenTasks or tasks.org. Agendula then reads and writes that app's task database through Android's provider mechanism, after you grant its read/write permission. Whatever already synchronises that provider (DAVx5, SmoothSync, DecSync CC, …) keeps doing so, unchanged; that synchronisation is performed by those apps, not by Agendula, and their privacy policies apply to it.

4. CalDAV sync — the only case where your tasks leave the device

Not available in version 1.0.0 — see the note in "In short". This section describes how it will behave, and is published in advance deliberately.

Sync is optional and off until you add an account. If you add one, everything below happens between your device and the server you nominated, and nowhere else.

What is stored on your device

The server address, your username, and your password or app password. The password is encrypted with a key held in the Android Keystore, which cannot be exported from the device.

What is transmitted, and to whom

• The tasks in the synchronised lists, as standard iCalendar (VTODO) data, and the credentials needed to authenticate.
• Requests carry the user agent Agendula (Android) — a fixed string, so that you can recognise and revoke the session on your server. No device identifier is sent.
• Connections are HTTPS. Cleartext HTTP is refused, so credentials are never sent over an unencrypted connection.

Nothing is sent anywhere else. In particular, nothing is sent to the developer.

Under Google Play's Data Safety definitions this counts as collected — Play defines collection as transmitting data off the device, regardless of who receives it — and not shared, because the only recipient is the server you nominated. Data is encrypted in transit.

Finding your server

When you type a server address or an email domain, Agendula follows the standard discovery procedure (RFC 6764): a DNS lookup for the _caldavs._tcp service record of that domain, then /.well-known/caldav on the host. The DNS query goes to whichever resolver your device or network uses, and the requests go to the domain you typed — no directory of servers is consulted and no lookup is sent to the developer.

Signing in to a Nextcloud

If the server is a Nextcloud, Agendula uses Nextcloud's Login Flow v2: your browser opens your own server's login page, you authorise there, and the server hands the app a dedicated app password. Agendula never sees your actual account password. The app password appears in your server's "Devices & sessions" list as Agendula (Android), and you can revoke it there at any time. Removing the account in Agendula revokes it too, where the server supports that.

Your server's own policy

Your CalDAV provider has its own privacy policy, and your data on their server is governed by it. Agendula has no relationship with them.

A note on certificates: Agendula trusts private certificate authorities that you have installed in your device's user store, because self-hosted servers routinely use them. That is a deliberate trade-off in favour of self-hosters — any CA installed on your device (for example by an employer's management profile) can, in principle, intercept traffic from the app, as it can from other apps that make the same choice.

5. Other data Agendula handles on your device

Reminders and notifications

Due-date reminders are scheduled by the app itself and displayed as local notifications. Nothing is sent to a push service — there is no push service.

Export files

You can export your tasks as standard iCalendar .ics files. Agendula writes exactly the file you select through Android's system file picker, and has no access to other files.

App settings

Your preferences (theme, language, list and reminder defaults and similar) are stored locally on your device and are removed when you uninstall the app.

6. Backups

If Android Auto Backup is enabled on your device, your tasks and settings may be backed up to your own Google account, under Google's terms — the developer has no access to it. What travels is Agendula's own task database and your settings, and nothing else: the backup rules name those explicitly, which makes everything not named — including the archived copy the app keeps of an older version's database — excluded by default.

Once CalDAV sync ships, two further things will be kept out of that backup by design: the stored password, and the per-device sync bookkeeping. Restoring onto a new device will therefore mean signing in to your server again.

7. Crash reports

If Agendula crashes, it offers to report the problem. Nothing is sent automatically — and on this version the app could not send it if it wanted to, having no network permission. The report is copied to your clipboard and your browser is opened with the project's issue tracker, the text pre-filled. You see the full content, you decide whether to submit it, and you can edit or discard it.

Such a report contains:

• app version,
• Android version,
• device manufacturer and model,
• your device language,
• the timestamp,
• and the technical stack trace.

It is built from that fixed list and nothing else: no task data, no server address or credentials, no account names, no log files and no personal identifiers.

If you choose to submit it, the report becomes a public issue on the project's issue tracker at Codeberg, operated by Codeberg e. V. Their privacy policy then applies to that submission.

8. External links

The app links to the source code, the licence, the issue tracker, the translation platform (Weblate) and a voluntary donation page (Ko-fi). Following one of these links opens your browser and leaves the app; the privacy policy of the respective website then applies. Agendula transmits no data of yours in the process — it only opens the address.

9. Permissions and why they exist

This is the complete list the released app declares — you can check it against the app's entry in F-Droid, or against app/src/main/AndroidManifest.xml in the source:

• POST_NOTIFICATIONS — show reminders.
• USE_EXACT_ALARM, SCHEDULE_EXACT_ALARM — deliver reminders at the exact due time.
• RECEIVE_BOOT_COMPLETED — re-register pending reminders after a restart.
• org.dmfs.permission.READ_TASKS / WRITE_TASKS and org.tasks.permission.READ_TASKS / WRITE_TASKS — optional, requested only if you choose the external-provider storage mode, and only for the provider you selected (OpenTasks or tasks.org). All four are declared in the manifest because a manifest is static, but none is requested until you pick that mode.

Note what is not there: Agendula declares no INTERNET permission, so the released app cannot make a network connection of any kind. When CalDAV sync ships it will need INTERNET and ACCESS_NETWORK_STATE, and the sync-framework permissions to schedule itself; this section will be updated in the same release that adds them, never before.

Agendula publishes no content provider of its own and declares no permissions that other apps could request.

10. Distribution channels

Agendula is distributed through the project's releases on Codeberg, a self-hosted F-Droid repository, Obtainium, and — where applicable — F-Droid and the Google Play Store. When you download or update the app, the operator of that channel processes data (such as your IP address) under their own privacy policy. This is outside the developer's control and unrelated to the app's own behaviour.

11. Children

Agendula is not directed at children and collects nothing about anyone.

12. Deleting your data

• Remove a CalDAV account from Settings → Accounts. This deletes the stored credential and, where the server supports it, revokes the app password. Task lists become device-only lists rather than being destroyed.
• Remove an account and delete its local data removes the lists and tasks as well.
• Uninstalling the app removes everything Agendula stored on the device.

Deleting data from your CalDAV server is done on that server; data in an external tasks provider is deleted in that app.

13. Your rights

The developer stores no personal data of yours — the only data transfer the app performs is between your device and a server you operate or chose. There is therefore no data held by the developer to which rights of access, rectification, erasure, restriction, data portability or objection (Art. 15–21 GDPR) could apply. Your tasks are exportable as standard .ics files from within the app at any time. You may contact the address above with any question, and you have the right to lodge a complaint with a supervisory authority.

14. Changes to this policy

Should the app's functionality change in a way that affects data processing, this policy will be updated and the date at the top adjusted. The history of this file is public in the repository.