01 Overview
Reflectodoro ("the app", "we") is built around a simple idea: no reflection, no skipping the break. There's no account system and no backend of any kind — every reflection, check-in, and setting you enter is written to a single SQLite database file that lives on your own device.
This policy exists to satisfy Google Play's privacy policy requirement and to tell you, honestly, exactly what the app touches. It covers the Windows, macOS, Linux, and Android builds. It does not cover any third-party service you separately choose to connect the app to (see §5).
02 Data we collect
"Collect" here means stored somewhere — almost all of it never leaves your device. The table below lists every category, mapped to how Google Play's Data safety section groups things.
| What | Examples | Where it goes | Why |
|---|---|---|---|
| Reflection entries | The free-text "what did I do" answer you type at the end of each break | On-device only | The app's core function |
| Wellness check-ins | Yes/no answers about eyes, movement, water, breaks | On-device only | Optional post-break check-in feature |
| Task lists | "Most Important Tasks" and "Not-to-do" list text | On-device only | Planning feature shown on the overlay |
| Screen-time / app usage | Which app had focus and for how long (Windows & Android only) — app name only, never a window title, URL, or anything typed | On-device only | The optional "where your day went" breakdown on the Entries tab |
| Settings | Device name, break-timer preferences, thresholds you configure | On-device only | Remembering your preferences |
| Pairing identifier | A random 128-bit ID generated on your device (no personal meaning) | Shown only to a device you pair with | Lets a paired device recognize yours for direct sync |
| Diagnostic log file | Timestamps and technical event names (window shown/hidden, phase changes, errors) | On-device only | Troubleshooting, if you choose to export and send it to us |
| Name, email, phone, location, contacts, photos, payment info | — | Never collected | The app has no feature that asks for any of these |
03 How your information is used
- Running the app. Reflections, check-ins, and task lists exist to be shown back to you — in the Entries tab, in the "coming next" preview, in the overlay's pre-fill.
- The screen-time breakdown. App-usage sessions are aggregated, on-device, into the per-app totals shown on the Entries tab.
- Enforcing the break screen. A random "breakit" challenge string is generated locally to let you skip a break early, within a daily limit; it's just a typing challenge and isn't derived from anything you've entered.
- Nothing here is used for advertising, profiling, or sold to anyone — there's no mechanism in the app that could do that, since there's no server to run it from.
04 Storage & security
All app data lives in one local SQLite database file, in the OS-standard app data folder for the current platform. On Android, automatic cloud backup of app data is explicitly turned off (allowBackup="false") — Reflectodoro's data is deliberately excluded from Google's Auto Backup rather than left to the platform default, specifically so pomodoro.db is never silently uploaded to your Google account's Drive backup.
Log files
The app also writes a rotating local log file for troubleshooting (kept to roughly the last 1–2 weeks, then automatically deleted). None of your actual content is ever written to it — not reflection text, not check-in answers, not task-list content, and not the "breakit" emergency-exit code either.
Sync encryption
If you use the optional device-to-device sync (§5), the pairing handshake and every synced record are encrypted end-to-end between the two devices using a PIN-authenticated key exchange (SPAKE2) followed by the Noise protocol — the 6-digit PIN itself is never transmitted or usable to derive the encryption key by an eavesdropper.
05 Sharing & third parties
Device-to-device sync (P2P LAN sync)
An entirely optional, opt-in feature under Settings → Paired devices. It connects two of your own devices directly over the same Wi-Fi network — no server, no relay, no third party is ever involved. Pairing is PIN-based; discovery on the local network briefly broadcasts your device's name, a random pairing ID, and platform (never reflection content, never the encryption key) so a paired device can find yours. You control exactly which devices are paired, and can unpair at any time.
Optional quote panel (third-party call)
The break screen can show a short quote fetched from an HTTP endpoint you configure in Settings, defaulting to a public quote API (zenquotes.io). This is, by design, the app's only outbound call to an arbitrary third party. When it fires, that endpoint receives a plain web request from your device (which, like any web request, exposes your IP address to that service per normal internet operation) — no reflection text, settings, or other app content is included in it. You can disable this entirely by clearing the endpoint field, or the app never sends it if you never set one.
06 App permissions (Android)
Android requires the app to explicitly ask for a few special-access permissions. Every one of them is used purely to make the timer/overlay behave correctly on your own device — none of them causes data to leave it.
| Permission | What it's for | Leaves the device? |
|---|---|---|
| Display over other apps | Shows the full-screen break/reflection overlay above whatever you're using | No |
| Schedule exact alarms | Wakes the app precisely on each 25/5-minute work/break boundary | No |
| Notifications | Alerts you a break has started when the overlay can't be drawn | No |
| Usage access | Powers the optional on-device screen-time breakdown | No — stored only in your local database |
| Wi-Fi state / multicast | Finds a paired device on your own Wi-Fi for direct sync | Only broadcasts name/ID on your own LAN |
| Foreground service | Keeps the break scheduler running reliably in the background | No |
Every special-access permission above is optional in the sense that the app tells you what's disabled without it and never blocks core use of the timer if you decline.
07 Your choices
- Turn off screen-time tracking anytime in Settings — existing sessions stay until you delete them, but no new ones are recorded.
- Turn off the quote panel by clearing the endpoint URL in Settings.
- Export your data to a plain JSON file at any time (Settings → Data), and re-import it later or on another device.
- Unpair a synced device at any time from Settings → Paired devices.
- Delete everything by uninstalling the app, or by clearing app data/storage from your OS's app settings — since nothing is kept anywhere but your device, this removes it completely.
08 Data retention & deletion
Your reflections, check-ins, task lists, and screen-time sessions are kept until you edit or delete them yourself, or until you uninstall the app. There's currently no automatic pruning of older screen-time data, so that table will grow over time unless you manage it manually via export/delete — we're noting this plainly rather than implying a retention limit that doesn't exist yet.
Log files are capped and rotate automatically, so old ones are deleted on their own after roughly 1–2 weeks; the daily "breakit" usage counter resets and discards the previous day's count every day and is never included in export or sync.
09 Children's privacy
Reflectodoro is a general-audience productivity tool and is not directed at children. It has no account system, no ads, and no social or communication features that would specifically target children. We don't knowingly collect data about children — and since the app collects nothing at all outside your own device by default, there's no server-side data of a child's to be aware of. If you believe a child has used a paired-sync or quote-endpoint feature in a way that concerns you, contact us at the address in §12 and we'll help.
10 International use
Because your data is stored only on your own device and, at most, sent directly to a second device you personally pair over local Wi-Fi, there is no cross-border transfer of your content initiated by us — we simply have no infrastructure to move it anywhere. The one exception is the optional quote panel (§5), which contacts whatever endpoint you configure, wherever that service happens to be hosted.
11 Changes to this policy
If Reflectodoro's data practices change — a new platform capability, a new optional integration — we'll update this page and its effective date above. Material changes (anything that adds a new way data could leave your device) will also be called out in the app's release notes.