makiolaj
28b2423ad9
The parts of chunk 5 that a build can verify. What is left needs a device or a live server, and is listed in docs/SYNC-PLAN.md rather than guessed at. - Attribution screen in Settings. dav4jvm is vendored, which makes MPL-2.0 §3.2(a) ours rather than a dependency's, so its row points at PROVENANCE.md next to upstream. Hand-maintained: generators read POM metadata, which routinely names a non-SPDX licence and a licence URL that 404s. - Revocation both ways. A 401 marks the account, stops it before the next request reaches the network, and takes it off the schedule from outside the worker — Nextcloud throttles then 429s per source IP, so a timer on a dead app password degrades the user's other clients. On removal, a bounded best-effort DELETE of the app password, or uninstalling never revokes it. - Play compliance: docs/PRIVACY.md linked in the app, declaring Collected and not Shared; an option to delete the account's tasks from the device too; REQUEST_IGNORE_BATTERY_OPTIMIZATIONS confirmed absent. - The server trap matrix as far as a protocol mock reaches, with four tests left @Ignore'd and their reasons written out. - docs/SYNC-PLAN.md records what moves to floret-kit, so that branch is a file move rather than a rediscovery. /code-review high raised 9 findings, all fixed. Three were serious: app-password revocation was aimed at the principal URL and revoked nothing; opening the app put accounts a 401 had stopped back on the timer, because KEEP does not keep cancelled work; and the incremental path advanced the sync token past bodies a failed multiget never applied. Also: four scalars were emitted twice whenever their residue copy survived, which the round-trip corpus could not see. Not done, and needing you: the live server matrix, releaseTest on device, the restore-onto-a-fresh-device check, cert4android, and MKCALENDAR feature detection. Chunk 2's on-device review is still outstanding.
2.7 KiB
Agendula — privacy policy
Last updated: 2026-09-07.
Agendula is a task app for Android, published by Jean-Luc Makiola. This policy describes what happens to your data. It is short because very little happens to it.
The short version
Agendula has no servers. There is no Agendula account, no analytics, no advertising, no tracking and no third-party SDK that reports anything anywhere. Your tasks live on your device, and — only if you set that up yourself — on a CalDAV server you choose.
What is stored on your device
- Your task lists, tasks, reminders and app settings.
- If you add a CalDAV account: the server address, your username, and your password or app password. The password is encrypted with a key held in the Android Keystore, which cannot be exported from the device.
What leaves your device
Only if you add a CalDAV account, and only to the server you entered:
- Your tasks in those lists, as iCalendar data, and the credentials needed to authenticate.
- Requests are made over HTTPS. Cleartext HTTP is refused unless you explicitly opt in for a specific account.
Nothing is sent anywhere else. In particular, nothing is sent to the developer.
Under Google Play's Data Safety definitions this counts as collected — Play defines collection as transmitting data off the device, regardless of who receives it — and not shared, because the only recipient is the server you nominated. Data is encrypted in transit.
Your CalDAV provider has its own privacy policy, and your data on their server is governed by it. Agendula has no relationship with them.
Crash reports
If the app crashes, it can show you the report and ask whether to send it. It is never sent without you choosing to send it, and you can read the whole report first.
Backups
If Android Auto Backup is enabled on your device, your tasks and settings may be backed up to your own Google account. Two things are deliberately excluded: your stored CalDAV password, and Agendula's per-device sync bookkeeping.
Deleting your data
- Remove a CalDAV account from Settings → Accounts. This deletes the stored credential and, where the server supports it, revokes the app password. Task lists become device-only lists rather than being destroyed.
- Remove an account and delete its local data removes the lists and tasks as well.
- Uninstalling the app removes everything Agendula stored on the device.
Deleting data from your CalDAV server is done on that server.
Children
Agendula is not directed at children and collects nothing about anyone.
Changes
Material changes will be noted here with a new date at the top. The history of this file is public in the repository.