Pausevane Privacy Policy

Implementation disclosure updated: 2026-10-20 App: Pausevane (com.servenzo.pausevane) Publisher/developer: Servenzo Privacy contact: [email protected] Public policy address: https://servenzo.com/apps/pausevane/privacy-policy

This disclosure describes Pausevane R1 local timing and its separately labelled previous preferences with optional shared platform controls. Cloud availability depends on the publisher’s configured deployment. A build without a backend URL works locally. No sign-in or upload is performed automatically.

Operator, hosting and internal testing

Servenzo operates this app and its optional cloud service. Contact [email protected] for privacy questions or requests. The app service is hosted on a Servenzo-operated VPS in the United Kingdom at https://apps-api.servenzo.com. The shared sign-in service is operated there using Keycloak; app accounts and access tokens remain scoped to their own app. Quizlilt child cloud accounts remain disabled.

Cloudflare provides DNS and the traffic proxy for the public website and API. It processes network addresses, request timing and security information through its global infrastructure. Choosing an online service sends the selected information over the network; core local features do not upload your records automatically. Google Play separately handles app distribution, tester accounts and any authorized store purchases.

Account and synchronized information is retained while you keep the app cloud account, subject to the app's export and deletion controls. Requesting account deletion blocks app access and queues scoped cleanup. The shared identity-provider profile has separate controls; contact [email protected] to request its removal, with identity verification where needed. Files expire at the time you select; expiry blocks access before background cleanup removes stored versions. Independent exports and copies are outside that cleanup.

API access logs contain network address, request path without query parameters, status and timing. They rotate daily with fourteen retained rotations; service diagnostic logs rotate by size. The internal-testing service has no automated off-server backup or guaranteed recovery. Keep independent copies of information you need. Optional cloud files use private encrypted storage that the server operator can read. This test deployment uses a locally held encryption key and is not end-to-end encrypted; a maintained key-management service is required before public cloud use.

Local information and use

Session configuration, optional intentions, active monotonic anchors, boot-context identifiers, measured active segments, paused time, explicit estimated additions, extension events, terminal records, self-confirmation, adjustment audits, import provenance, drafts and settings are stored in the app-local transactional database (native private file; IndexedDB on web). An action is acknowledged only after its local transaction commits. Android elapsedRealtime and boot context support same-boot reconciliation. On a reboot or missing context, explicit recovery separates estimates from measured segments. Wall-clock labels never substitute silently for measured elapsed time.

The previous aggregate completed-session count includes focus, break and test sessions. It is preserved as an ambiguous legacy summary, not reconstructed into invented focus history. Break, ten-second test and discarded time do not count as measured focus. Self-confirmation is a user statement, not verification of productivity.

Optional account and snapshot sync

You may use the local demo without creating an account. If you choose sign-in, the configured identity provider processes authentication in your browser. The backend verifies a provider subject and app-specific access token, and stores a separate app account and workspace. Native session tokens use platform secure storage; the web session token is kept in memory. Connection drafts and revision metadata may be stored locally to preserve retries, without saving the access token in ordinary preferences.

Snapshot data eligible for explicit upload from Previous preferences & cloud controls: only the original preferred session mode and ambiguous aggregate completed-session count. New R1 sessions, segments, intentions, reports and recovery state are excluded from this endpoint.

You choose whether to upload the allowed local fields or replace them from cloud state. A conflict requires an explicit choice rather than silently overwriting newer work. Shared infrastructure does not give one app’s account access to another app’s private workspace. Operational requests necessarily reach the configured server/provider and can expose network information such as IP address and request timing to that infrastructure.

Other optional platform controls

Cloud file controls transfer only files you deliberately select, together with bounded filename/type/size, checksum and expiry metadata. These server-readable files are not end-to-end encrypted vault storage. Expiry and deletion block future authorized access before eventual physical cleanup; previously downloaded copies cannot be recalled.

Notification controls store the schedule, message and inbox record you submit. If push delivery is configured and you register a device, the service stores its app-scoped push token and sends the message through the configured push provider. Provider acceptance does not establish that the device displayed it. In-app inbox delivery and local phone reminder scheduling have different behavior.

Google Play billing controls, where configured, send the selected product and purchase token for server verification and store verification/entitlement status. Payment details are handled by Google Play rather than entered into this app. No paid entitlement is granted just because a device claims a purchase. Development adapters are identified as development features; they do not establish a paid purchase.

Optional local end alerts use generic session/revision metadata and a generic message, never intention text. Permission is requested only after opt-in. Inexact Android scheduling respects system channels, DND and sound/vibration settings; the request may be delayed or blocked. A notification tap is recorded only when it matches the current desired session/revision and never changes timer accounting. OS permission, scheduled request, observed channel state and matching user interaction are distinct; delivery is not verified. No exact-alarm access or permanent wake lock is requested. Other surfaces can expose only a clearly described visible/in-app fallback.

The app does not include advertising or an analytics uploader in this implementation. Optional local content-free diagnostics are off by default. If enabled, the bounded local queue contains action names and revision metadata, without intentions, correction text or session content. Turning consent off clears queued optional diagnostics without disabling timing. Future ads, child profiles, additional SDK collection or other new processing need separate disclosure and review before being enabled.

Storage, retention and deletion

The local database, previous preferences and JSON/CSV exports are not encrypted by an app-level data layer. Browser storage belongs to its origin/profile and may be evicted. Session history and intention text have separate optional age controls; saved history also has a bounded count. Maintenance occurs during operations and reopening. Active timing recovery is protected from session-history eviction. Intention deletion/retention scrubs related active, adjustment, operation and undo copies to avoid unexpected restoration. Explicit active/draft text clearing has no undo; selected saved record deletion offers a 30-second local undo. Expired undo payloads are cleaned during subsequent maintenance rather than a promise of immediate physical erasure.

History export is freely available offline as versioned JSON or CSV, excluding private intentions by default. A recovery export can include raw private data, drafts, operation receipts and quarantined rows; keep it private. JSON/CSV imports require preview, row-error review and an explicit duplicate strategy. Imported records retain external-source provenance; an import never changes a live timer. Unknown schemas or malformed rows cannot silently replace valid records. No general automatic recovery restore is offered.

Clipboard, file picker and export destination access occur only after your action. Recipients, OS/document providers and external copies have independent controls; local deletion cannot recall them. Android automatic app backup is disabled to avoid restoring encrypted authentication tokens on another device; this also excludes other app-private data from that automatic backup mechanism. Device manufacturers or separately selected document providers can operate independent services.

You can remove app-local data with Android Settings > Apps > Pausevane > Storage > Clear storage (labels vary). Clearing local data or uninstalling does not by itself delete an optional cloud account, cancel a Google Play subscription or erase a file you exported.

Cloud account export/deletion are separate account controls and require recent sign-in. Account deletion applies to this app’s account and workspace, rather than silently deleting all Servenzo app accounts. It ends access and initiates scoped cleanup; a queued or partially completed cleanup is not a claim of immediate forensic erasure. Identity-provider accounts, Google Play purchase records, mandatory provider retention and independent external copies have separate controls. See the operator and hosting section of this policy for the current deployment and retention settings.

Device access

The app does not request camera, microphone, contacts or location access. POST_NOTIFICATIONS is optional for local end alerts on supported Android versions. INTERNET allows an explicitly configured HTTPS service connection. Native browser sign-in returns through this app’s unique callback scheme.

Children and audience

The publisher intends this app for users aged 13 and older. The app does not ask for a date of birth or build an account-based age profile.

Contact

Contact [email protected] for privacy questions. Do not include private files, child information, habit details or financial records in an initial support message. Sending support email uses your chosen email provider and is separate from this app’s feature data. No support message is sent automatically.

Current local R2 increment — 20 October 2026

The new local practice workspace stores versioned recipes and launch snapshots, project/task names, partial checkpoints, preparation/shutdown records and unfinished drafts, thought-parking notes, dated restart cues and edited break menus/rotation. Preparation and shutdown are separate from measured focus. Finishing a timer never silently completes a task. Template/menu edits affect future activity, while accepted snapshots remain unchanged. Private thought/task/ritual content is included only in deliberately selected feature exports or recovery copies, and is not uploaded as analytics or through the previous demo snapshot.

The new feature state remains app-scoped and local. Explicit JSON/file/clipboard exports are independent private copies; recovery can contain active or captured unacknowledged inputs. Deleting local feature data does not erase exports, OS/provider originals, separate app accounts or another product. Provider, installed-device, signed-release and store/public-policy qualification are not inferred from local tests.