Numlilt Privacy Policy

Implementation disclosure updated: 2026-10-20 App: Numlilt (com.servenzo.numlilt) Publisher/developer: Servenzo Privacy contact: [email protected] Public policy address: https://servenzo.com/apps/numlilt/privacy-policy

This disclosure describes the Numlilt R1 and the R2 NU-W04 and NU-W05 local implementations and the separately labelled previous demo with its optional shared platform controls. Cloud availability depends on the publisher’s configured deployment. A build without a backend URL works locally. No sign-in or upload is performed automatically.

Operator, hosting and internal testing

Servenzo operates this app and its optional cloud service. Contact [email protected] for privacy questions or requests. The app service is hosted on a Servenzo-operated VPS in the United Kingdom at https://apps-api.servenzo.com. The shared sign-in service is operated there using Keycloak; app accounts and access tokens remain scoped to their own app. Quizlilt child cloud accounts remain disabled.

Cloudflare provides DNS and the traffic proxy for the public website and API. It processes network addresses, request timing and security information through its global infrastructure. Choosing an online service sends the selected information over the network; core local features do not upload your records automatically. Google Play separately handles app distribution, tester accounts and any authorized store purchases.

Account and synchronized information is retained while you keep the app cloud account, subject to the app's export and deletion controls. Requesting account deletion blocks app access and queues scoped cleanup. The shared identity-provider profile has separate controls; contact [email protected] to request its removal, with identity verification where needed. Files expire at the time you select; expiry blocks access before background cleanup removes stored versions. Independent exports and copies are outside that cleanup.

API access logs contain network address, request path without query parameters, status and timing. They rotate daily with fourteen retained rotations; service diagnostic logs rotate by size. The internal-testing service has no automated off-server backup or guaranteed recovery. Keep independent copies of information you need. Optional cloud files use private encrypted storage that the server operator can read. This test deployment uses a locally held encryption key and is not end-to-end encrypted; a maintained key-management service is required before public cloud use.

Local information and use

Calculator expressions, cursor/draft state, numeric convention, unit choices, labels, committed exact results, engine/catalog versions, assumptions, timestamps and retention preferences are saved in the app-local transactional database (native private file; IndexedDB on the web). Live previews are not history records. The previous demo uses its original preferences, and the upgrade preserves that source separately as a recovery draft without inventing past calculations. New R1 drafts and history are not sent through the previous demo snapshot endpoint.

Organization, exact memory and Android launcher surfaces

Tools search runs locally over the built-in catalog. Successful tool choices, favorites, folder names, tags, sort choices and stable tool/history references are stored separately in the numlilt_organization transactional sidecar. Named memory stores exact rational numerator/denominator strings with its name and timestamps. Changing a folder or tag does not change the saved source expression or result. These new organization and memory records are not uploaded through the previous demo snapshot endpoint.

Android shortcut and compact widget controls send only allowlisted local target identifiers and the chosen launcher labels to Android. Labels are hidden by default, and expressions, numeric results and exact memory values are never published to those surfaces. If you deliberately enable labels, another person using or viewing your launcher may see them. Hiding labels changes the published surface without changing source records. Launchers may maintain independent pinned copies or caches; changing a preference or deleting a source record does not promise retrospective erasure from every launcher. Use Android launcher controls to remove those copies. No overlay permission is requested.

The Android launcher implementation is source-prepared; actual installation, delivery and widget display have not been qualified for a signed release. A pin request is not proof that a launcher installed or displayed it. Unsupported platforms keep the normal in-app tools available.

Everyday calculators and journey planners

NU-W05 tools run locally. The separate numlilt_everyday transactional sidecar stores current tool draft fields and explicitly reviewed saved results, including exact quantities, labels, units, selected modes, bill/tax/tip bases, currency labels and precision, recipe/density/cup assumptions, fuel/gallon standards, dates/timezones, journey segments, allowed pack types/search bounds, file-size/throughput factors and editable overhead assumptions. These values can reveal private purchases or travel plans. They are not uploaded through the previous demo snapshot endpoint. A draft or preview is not a committed result; reusing a saved result creates an editable copy. Saved-result search checks titles and original inputs locally; its query text is held in the current UI and is not stored.

The local capacity is eight current tool drafts and 1,000 explicitly saved everyday results. Capacity errors preserve acknowledged records rather than silently evicting old results. No location, calendar, traffic, route, tax-rate, currency-rate, fuel-price or speed-test provider is called by these tools. Rates, density, prices and transfer assumptions are entered by you. Timezone rules come from bundled data, not a live jurisdictional service.

Everyday exports and explicit copies may contain private draft text, exact values, bill breakdowns, recipe quantities and dated journey plans. They are plaintext external copies. An explicitly selected raw recovery export can also include the captured unacknowledged command and its inputs/result from the current process, alongside unsupported stored data. This in-memory retry content is not promised to survive app/process termination, and exporting it does not provide automatic restore. Everyday deletion controls are separate from R1 history, organization, legacy account data and exported copies. Native automatic app backup remains disabled. No application-level encryption, automatic restore, typed cloud synchronization or remote analytics is added for this sidecar.

Optional account and snapshot sync

You may use the local demo without creating an account. If you choose sign-in, the configured identity provider processes authentication in your browser. The backend verifies a provider subject and app-specific access token, and stores a separate app account and workspace. Native session tokens use platform secure storage; the web session token is kept in memory. Connection drafts and revision metadata may be stored locally to preserve retries, without saving the access token in ordinary preferences.

Snapshot data eligible for your explicit upload from Settings > Previous demo: the previous demo calculator inputs and conversion preferences. This does not include the new R1 history or transactional draft.

You choose whether to upload the allowed local fields or replace them from cloud state. A conflict requires an explicit choice rather than silently overwriting newer work. Shared infrastructure does not give one app’s account access to another app’s private workspace. Operational requests necessarily reach the configured server/provider and can expose network information such as IP address and request timing to that infrastructure.

Other optional platform controls

Cloud file controls transfer only files you deliberately select, together with bounded filename/type/size, checksum and expiry metadata. These server-readable files are not end-to-end encrypted vault storage. Expiry and deletion block future authorized access before eventual physical cleanup; previously downloaded copies cannot be recalled.

Notification controls store the schedule, message and inbox record you submit. If push delivery is configured and you register a device, the service stores its app-scoped push token and sends the message through the configured push provider. Provider acceptance does not establish that the device displayed it. In-app inbox delivery and local phone reminder scheduling have different behavior.

Google Play billing controls, where configured, send the selected product and purchase token for server verification and store verification/entitlement status. Payment details are handled by Google Play rather than entered into this app. No paid entitlement is granted just because a device claims a purchase. Development adapters are identified as development features; they do not establish a paid purchase.

The app does not include advertising or product analytics in this implementation. Future ads, child profiles, additional SDK collection or other new processing need separate disclosure and review before being enabled.

Storage, retention and deletion

The R1 local database, organization and everyday sidecars, and previous demo preferences are not encrypted by an app-level data layer. Device security and the browser profile provide platform protections. On the web, use a private browser profile and clear this site’s storage to remove its local database. Android automatic app backup is disabled to avoid restoring encrypted authentication tokens on another device; this also excludes other app-private data from that automatic backup mechanism. Device manufacturers or separately selected document providers can operate independent services.

History offers per-record or bounded bulk deletion, a 30-second undo window, and age/count retention applied on writes and reopening. Expired undo payloads and old deletion metadata are cleaned on subsequent writes or reopening; this is not a claim of immediate physical erasure. Damaged rows are isolated for recovery rather than silently deleted. Clearing new history does not clear the separately preserved previous demo draft or the organization sidecar. Organization deletion is separate; deleting a folder or reference does not delete its source calculation. A deleted source target can leave a stale reference for explicit recovery.

Recovery export and explicit copy can include raw expressions, labels, exact results, settings and damaged records. Organization recovery exports can include names, tags, references and exact memory values; treat them as private content. An explicitly chosen recovery export may also include active unacknowledged memory, folder and history-organization editor text and a reviewed memory candidate. That unsaved editor state exists in the current UI process; exporting it does not create an automatic restore or promise to survive process termination. JSON exports are unencrypted. Clipboard content is read only for an explicit paste action and is never sent as diagnostics. External files and clipboard copies must be managed separately. Recovery export does not imply an automatic import/restore feature.

You can remove app-local data with Android Settings > Apps > Numlilt > Storage > Clear storage (labels vary). Clearing local data or uninstalling does not by itself delete an optional cloud account, cancel a Google Play subscription or erase a file you exported.

Cloud account export/deletion are separate account controls and require recent sign-in. Account deletion applies to this app’s account and workspace, rather than silently deleting all Servenzo app accounts. It ends access and initiates scoped cleanup; a queued or partially completed cleanup is not a claim of immediate forensic erasure. Identity-provider accounts, Google Play purchase records, mandatory provider retention and independent external copies have separate controls. See the operator and hosting section of this policy for the current deployment and retention settings.

Device access

The app does not request camera, microphone, contacts or location access. INTERNET allows an explicitly configured HTTPS service connection. Native browser sign-in returns through this app’s unique callback scheme.

Children and audience

The publisher intends this app for users aged 13 and older. The app does not ask for a date of birth or build an account-based age profile.

Contact

Contact [email protected] for privacy questions. Do not include private files, child information, habit details or financial records in an initial support message. Sending support email uses your chosen email provider and is separate from this app’s feature data. No support message is sent automatically.

Current local R2 increment — 20 October 2026

The separate numlilt_currency namespace keeps original amount/currency/label rows, explicit manual rate factors and source/as-of timestamps, cached provider metadata where an approved adapter is configured, immutable pinned conversion snapshots, editor drafts and content-free save receipts. Reporting currency never rewrites original amounts. Missing/unavailable rates block a combined total. Manual assumptions show recorded age and stale status without verified market freshness. No live provider is configured by default. Optional adapters need approved pair, attribution, cache/retention and historical-use rights before their respective actions. This does not qualify any real provider or execute money transfers.

The new feature state remains app-scoped and local. Explicit JSON/file/clipboard exports are independent private copies; recovery can contain active or captured unacknowledged inputs. Deleting local feature data does not erase exports, OS/provider originals, separate app accounts or another product. Provider, installed-device, signed-release and store/public-policy qualification are not inferred from local tests.