makiolaj/jeanlucmakiola.de
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add the Agendula app privacy policy

Browse Source 
Same structure as the Calendula page, but Agendula holds INTERNET and syncs
CalDAV itself, so the wording turns on "only to the server you entered"
rather than on the absence of the permission. Facts from the app repo:
storage modes, Keystore-encrypted credentials, RFC 6764 discovery,
Nextcloud Login Flow v2, Auto Backup exclusions, crash-report allowlist.
This commit is contained in:
makiolaj
2026-09-09 16:01:11 +02:00
parent bf40e27820
commit 0fe0eaf2bd
1 changed files with 328 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/agendula/privacy.astro
+328
View File
@@ -0,0 +1,328 @@
---
import BaseLayout from '../../layouts/BaseLayout.astro';
import { LEGAL } from '../../consts';
// App privacy policy for Agendula — required as a public URL by the Google Play
// Console (mandatory for every app) and linked from the app's About card.
// Deliberately separate from /datenschutz, which covers this website only.
//
// Kept in English because SITE.lang is 'en' and Play's default store listing is
// en-US; /datenschutz and /impressum stay German for legal reasons.
//
// Source of truth for the facts below: the Agendula repository (docs/PRIVACY.md,
// docs/SYNC.md, AndroidManifest.xml, backup_rules.xml). Unlike Calendula,
// Agendula *does* hold INTERNET — it has its own CalDAV sync — so the wording
// here turns on "only to the server you entered", not on the absence of the
// permission. If sync, permissions or data paths change, update this page and
// the "Last updated" date.
const lastUpdated = '9 September 2026';
---
<BaseLayout
title="Agendula — Privacy Policy"
description="Privacy policy for the Agendula Android task app. No accounts, no analytics, no tracking — data leaves your device only for the CalDAV server you choose."
width="narrow"
>
<article class="prose">
<h1 class="page-title">Privacy Policy — Agendula</h1>
<p>
<strong>Last updated:</strong> {lastUpdated}<br />
Applies to the Android app <strong>Agendula</strong>{' '}
(package <code>de.jeanlucmakiola.agendula</code>), all versions and all
distribution channels.
</p>
<h2>In short</h2>
<p>
Agendula has no servers, no user accounts and no analytics. Your tasks live
on your device. They leave it in exactly one case: if you set up a CalDAV
account yourself, they are synchronised with <strong>the server you
entered</strong> — and with nothing and no one else. Nothing is ever sent
to the developer.
</p>
<h2>1. Controller</h2>
<p>
{LEGAL.business}<br />
{LEGAL.street}<br />
{LEGAL.city}<br />
Email: <a href={`mailto:${LEGAL.email}`}>{LEGAL.email}</a>
</p>
<h2>2. No data collection by the developer</h2>
<p>
Agendula contains <strong>no analytics, no tracking, no advertising, no
crash-reporting SDK and no third-party service that reports anything
anywhere</strong>. No user profile is created, no advertising or device
identifier is generated, and no data is shared with or sold to anyone.
There is no Agendula account, and the developer operates no server that the
app talks to.
</p>
<p>
All of this is verifiable in the{' '}
<a href="https://codeberg.org/jlmakiola/agendula" rel="noopener">source code</a>,
which is public.
</p>
<h2>3. Where your tasks live — your choice</h2>
<p>
Agendula offers two storage modes, and you pick one:
</p>
<ul>
<li>
<strong>On your device (the default)</strong> — your task lists, tasks and
reminders are kept in Agendula's own database inside the app's private
storage. Nothing is published to other apps, and uninstalling the app
removes it.
</li>
<li>
<strong>In a tasks provider you already use</strong> — OpenTasks or
tasks.org. Agendula then reads and writes that app's task database
through Android's provider mechanism, after you grant its read/write
permission. Whatever already synchronises that provider (DAVx5,
SmoothSync, DecSync CC, …) keeps doing so, unchanged; that synchronisation
is performed by those apps, not by Agendula, and their privacy policies
apply to it.
</li>
</ul>
<h2>4. CalDAV sync — the only case where your tasks leave the device</h2>
<p>
Sync is optional and off until you add an account. If you add one,
everything below happens between your device and <strong>the server you
nominated</strong>, and nowhere else.
</p>
<h3>What is stored on your device</h3>
<p>
The server address, your username, and your password or app password. The
password is encrypted with a key held in the Android Keystore, which cannot
be exported from the device.
</p>
<h3>What is transmitted, and to whom</h3>
<ul>
<li>
The tasks in the synchronised lists, as standard iCalendar
(<code>VTODO</code>) data, and the credentials needed to authenticate.
</li>
<li>
Requests carry the user agent <code>Agendula (Android)</code> — a fixed
string, so that you can recognise and revoke the session on your server.
No device identifier is sent.
</li>
<li>
Connections are HTTPS. Cleartext HTTP is refused, so credentials are
never sent over an unencrypted connection.
</li>
</ul>
<p>
Under Google Play's Data Safety definitions this counts as{' '}
<strong>collected</strong> — Play defines collection as transmitting data
off the device, regardless of who receives it — and <strong>not
shared</strong>, because the only recipient is the server you chose. Data is
encrypted in transit.
</p>
<h3>Finding your server</h3>
<p>
When you type a server address or an email domain, Agendula follows the
standard discovery procedure (RFC 6764): a DNS lookup for the{' '}
<code>_caldavs._tcp</code> service record of that domain, then{' '}
<code>/.well-known/caldav</code> on the host. The DNS query goes to whichever
resolver your device or network uses, and the requests go to the domain you
typed — no directory of servers is consulted and no lookup is sent to the
developer.
</p>
<h3>Signing in to a Nextcloud</h3>
<p>
If the server is a Nextcloud, Agendula uses Nextcloud's Login Flow v2: your
browser opens <em>your own server's</em> login page, you authorise there,
and the server hands the app a dedicated app password. Agendula never sees
your actual account password. The app password appears in your server's
“Devices &amp; sessions” list as <code>Agendula (Android)</code>, and you can
revoke it there at any time. Removing the account in Agendula revokes it too,
where the server supports that.
</p>
<h3>Your server's own policy</h3>
<p>
Your CalDAV provider has its own privacy policy, and your data on their
server is governed by it. Agendula has no relationship with them.
</p>
<p>
A note on certificates: Agendula trusts private certificate authorities that
you have installed in your device's user store, because self-hosted servers
routinely use them. That is a deliberate trade-off in favour of
self-hosters — any CA installed on your device (for example by an employer's
management profile) can, in principle, intercept traffic from the app, as it
can from other apps that make the same choice.
</p>
<h2>5. Other data Agendula handles on your device</h2>
<h3>Reminders and notifications</h3>
<p>
Due-date reminders are scheduled by the app itself and displayed as local
notifications. Nothing is sent to a push service — there is no push service.
</p>
<h3>Export files</h3>
<p>
You can export your tasks as standard iCalendar <code>.ics</code> files.
Agendula writes exactly the file you select through Android's system file
picker, and has no access to other files.
</p>
<h3>App settings</h3>
<p>
Your preferences (theme, language, list and reminder defaults and similar)
are stored locally on your device and are removed when you uninstall the
app.
</p>
<h2>6. Backups</h2>
<p>
If Android Auto Backup is enabled on your device, your tasks and settings
may be backed up to your own Google account, under Google's terms — the
developer has no access to it. Two things are deliberately excluded from
that backup: your stored CalDAV password, and Agendula's per-device sync
bookkeeping. After restoring onto a new device you therefore sign in to your
server again.
</p>
<h2>7. Crash reports</h2>
<p>
If Agendula crashes, it offers to report the problem. Nothing is sent
automatically, even though the app has network access. The report is copied
to your clipboard and your browser is opened with the project's issue
tracker, the text pre-filled. <strong>You see the full content, you decide
whether to submit it, and you can edit or discard it.</strong>
</p>
<p>Such a report contains:</p>
<ul>
<li>app version,</li>
<li>Android version,</li>
<li>device manufacturer and model,</li>
<li>your device language,</li>
<li>the timestamp,</li>
<li>and the technical stack trace.</li>
</ul>
<p>
It is built from that fixed list and nothing else: <strong>no</strong> task
data, <strong>no</strong> server address or credentials, <strong>no</strong>{' '}
account names, <strong>no</strong> log files and <strong>no</strong> personal
identifiers.
</p>
<p>
If you choose to submit it, the report becomes a public issue on the
project's issue tracker at Codeberg, operated by Codeberg&nbsp;e.&nbsp;V.
Their privacy policy then applies to that submission.
</p>
<h2>8. External links</h2>
<p>
The app links to the source code, the licence, the issue tracker, the
translation platform (Weblate) and a voluntary donation page (Ko-fi).
Following one of these links opens your browser and leaves the app; the
privacy policy of the respective website then applies. Agendula transmits no
data of yours in the process — it only opens the address.
</p>
<h2>9. Permissions and why they exist</h2>
<ul>
<li>
<code>INTERNET</code>, <code>ACCESS_NETWORK_STATE</code> — CalDAV sync with
the server you configure, and checking whether a connection exists before
trying. Without a CalDAV account, no connection is made.
</li>
<li>
<code>READ_SYNC_SETTINGS</code>, <code>WRITE_SYNC_SETTINGS</code> — register
the sync account with Android's sync framework so it can be scheduled.
</li>
<li><code>POST_NOTIFICATIONS</code> — show reminders.</li>
<li>
<code>USE_EXACT_ALARM</code>, <code>SCHEDULE_EXACT_ALARM</code> — deliver
reminders at the exact due time.
</li>
<li>
<code>RECEIVE_BOOT_COMPLETED</code> — re-register pending reminders after a
restart.
</li>
<li>
<code>org.dmfs.permission.READ_TASKS</code> /{' '}
<code>WRITE_TASKS</code> and <code>org.tasks.permission.READ_TASKS</code> /{' '}
<code>WRITE_TASKS</code> — optional, requested only if you choose the
external-provider storage mode, and only for the provider you selected
(OpenTasks or tasks.org).
</li>
<li>
<code>WAKE_LOCK</code>, <code>FOREGROUND_SERVICE</code> — required by the
Android system component used for scheduled background work
(WorkManager); on older Android versions it needs them to run an
expedited sync.
</li>
</ul>
<p>
Agendula publishes no content provider of its own and declares no
permissions that other apps could request.
</p>
<h2>10. Distribution channels</h2>
<p>
Agendula is distributed via F-Droid, Obtainium, a self-hosted repository
and, where applicable, the Google Play Store. When you download or update
the app, the operator of that channel processes data (such as your IP
address) under their own privacy policy. This is outside the developer's
control and unrelated to the app's own behaviour.
</p>
<h2>11. Children</h2>
<p>
Agendula is not directed at children and collects nothing about anyone.
</p>
<h2>12. Deleting your data</h2>
<ul>
<li>
<strong>Remove a CalDAV account</strong> (Settings → Accounts) deletes the
stored credential and, where the server supports it, revokes the app
password. The task lists become device-only lists rather than being
destroyed.
</li>
<li>
<strong>Remove an account and delete its local data</strong> removes those
lists and their tasks as well.
</li>
<li>
<strong>Uninstalling the app</strong> removes everything Agendula stored on
the device.
</li>
</ul>
<p>
Data on your CalDAV server is deleted on that server; data in an external
tasks provider is deleted in that app.
</p>
<h2>13. Your rights</h2>
<p>
The developer stores no personal data of yours — the only data transfer the
app performs is between your device and a server you operate or chose. There
is therefore no data held by the developer to which rights of access,
rectification, erasure, restriction, data portability or objection
(Art.&nbsp;15–21 GDPR) could apply. Your tasks are exportable as standard{' '}
<code>.ics</code> files from within the app at any time. You may contact the
address above with any question, and you have the right to lodge a complaint
with a supervisory authority.
</p>
<h2>14. Changes to this policy</h2>
<p>
Should the app's functionality change in a way that affects data processing,
this policy will be updated and the date at the top adjusted. The version
history is publicly traceable in the project's source repository.
</p>
</article>
</BaseLayout>