Routisprig Privacy Policy

Implementation disclosure updated: 2026-10-20 App: Routisprig (com.servenzo.routisprig) Publisher/developer: Servenzo Privacy contact: [email protected] Public policy address: https://servenzo.com/apps/routisprig/privacy-policy

This disclosure describes Routisprig R1 local habit tracking and its separately labelled previous demo snapshot with optional shared platform controls. Cloud availability depends on the publisher’s configured deployment. A build without a backend URL works locally. No sign-in or upload is performed automatically.

Operator, hosting and internal testing

Servenzo operates this app and its optional cloud service. Contact [email protected] for privacy questions or requests. The app service is hosted on a Servenzo-operated VPS in the United Kingdom at https://apps-api.servenzo.com. The shared sign-in service is operated there using Keycloak; app accounts and access tokens remain scoped to their own app. Quizlilt child cloud accounts remain disabled.

Cloudflare provides DNS and the traffic proxy for the public website and API. It processes network addresses, request timing and security information through its global infrastructure. Choosing an online service sends the selected information over the network; core local features do not upload your records automatically. Google Play separately handles app distribution, tester accounts and any authorized store purchases.

Account and synchronized information is retained while you keep the app cloud account, subject to the app's export and deletion controls. Requesting account deletion blocks app access and queues scoped cleanup. The shared identity-provider profile has separate controls; contact [email protected] to request its removal, with identity verification where needed. Files expire at the time you select; expiry blocks access before background cleanup removes stored versions. Independent exports and copies are outside that cleanup.

API access logs contain network address, request path without query parameters, status and timing. They rotate daily with fourteen retained rotations; service diagnostic logs rotate by size. The internal-testing service has no automated off-server backup or guaranteed recovery. Keep independent copies of information you need. Optional cloud files use private encrypted storage that the server operator can read. This test deployment uses a locally held encryption key and is not end-to-end encrypted; a maintained key-management service is required before public cloud use.

Local information and use

Stable habit identities/names, exact boolean/count/duration goals and unit labels, prospective schedule/status versions, civil periods and fixed-home/follow-device timezone policy are stored in the app-local transactional database (native private file; IndexedDB on web). Check-ins, explicit skips, historical corrections/reasons, undo lineage, editable drafts, preferences, deletion stages/tombstones and operation receipts preserve acknowledged local work. Unknown periods are not inferred failures. Optional quotes and prompts do not change eligibility.

Original demo names/date sets remain as a recoverable one-time migration source. Valid saved dates have unknown original schedule/target/timezone context; malformed rows are isolated. No past eligibility or missed-day outcome is invented. Mapped name/date CSV imports preserve the same unknown-context facts. Versioned JSON/audit CSV retain original schedules, units, event/correction provenance. Import/restore requires a dry-run and explicit atomic-merge confirmation; cancelled/invalid previews leave current data intact.

Optional account and snapshot sync

You may use the local demo without creating an account. If you choose sign-in, the configured identity provider processes authentication in your browser. The backend verifies a provider subject and app-specific access token, and stores a separate app account and workspace. Native session tokens use platform secure storage; the web session token is kept in memory. Connection drafts and revision metadata may be stored locally to preserve retries, without saving the access token in ordinary preferences.

Snapshot data eligible for explicit upload from Previous demo recovery & cloud controls: only original habit names/date sets, in-app reminder/time/dismissal and quote preferences. Phone reminder enabled/permission state stays device-local. This is a previous demo recovery snapshot, not current typed synchronization. R1 habit identities, schedule versions, check-in/correction records, typed drafts, imports and backup keys are excluded from that endpoint.

You choose whether to upload the allowed local fields or replace them from cloud state. A conflict requires an explicit choice rather than silently overwriting newer work. Shared infrastructure does not give one app’s account access to another app’s private workspace. Operational requests necessarily reach the configured server/provider and can expose network information such as IP address and request timing to that infrastructure.

Other optional platform controls

Cloud file controls transfer only files you deliberately select, together with bounded filename/type/size, checksum and expiry metadata. These server-readable files are not end-to-end encrypted vault storage. Expiry and deletion block future authorized access before eventual physical cleanup; previously downloaded copies cannot be recalled.

Notification controls store the schedule, message and inbox record you submit. If push delivery is configured and you register a device, the service stores its app-scoped push token and sends the message through the configured push provider. Provider acceptance does not establish that the device displayed it. In-app inbox delivery and local phone reminder scheduling have different behavior.

Google Play billing controls, where configured, send the selected product and purchase token for server verification and store verification/entitlement status. Payment details are handled by Google Play rather than entered into this app. No paid entitlement is granted just because a device claims a purchase. Development adapters are identified as development features; they do not establish a paid purchase.

Optional Android reminders use an app-private projection containing anonymous habit/occurrence identifiers, revision, fire instant and period end. Generic messages contain no habit names, quantities, reasons or imported content. A native guard is fenced before schedule-affecting commits; stale callbacks validate the current allowlist before display. Anonymous action tickets and a bounded pending-action buffer persist until the repository durably accepts or rejects them. Done/Snooze open the app and use the normal reducer; measured/weekly-quota goals require explicit input. Old/expired actions never check in a new day.

Permission follows explicit opt-in with a meaningful saved schedule. Requests are inexact and may be delayed, blocked or suppressed by OS/OEM restrictions or force-stop. Acceptance is not proof of display. Quiet hours may defer or omit requests beyond their original period. The rolling plan covers at most 200 requests, seven upcoming periods per habit within 60 days; opening/resuming refills it. Snooze is ten minutes within the same eligible period and quiet-hour policy. Reboot re-arms approved future requests; time/timezone changes invalidate the guard until reconciliation. Other surfaces retain local tracking and in-app prompts. No exact-alarm access, permanent wake lock or DND bypass is requested.

No advertising identity or analytics uploader is enabled. Optional bounded local diagnostics default off and contain only event categories, revisions, counts, scheduler/failure codes and measured latency. Habit names, correction reasons and imported rows are excluded. Withdrawing consent clears queued optional events. Future SDKs or new collection require updated disclosure and review before release.

Storage, retention and deletion

The active database, previous preferences, plain JSON and CSV exports are not app-encrypted. Android app OS backup is disabled. Browser storage belongs to its origin/profile and may be evicted. Independent device/document services have separate lifecycles.

Versioned encrypted backup uses AES-256-GCM, a random salt/nonce and PBKDF2-HMAC-SHA256 at 210,000 iterations. A passphrase of at least 12 characters derives the key locally. No passphrase/key is saved in ordinary preferences or sent to a recovery service. Losing the passphrase means losing access to that backup; Servenzo cannot promise key recovery. Authentication/decryption precedes a restore dry-run; current data remains until reviewed merge confirmation. Encryption applies to the backup file, not the active database or plain exports. The encrypted backup covers the typed ledger; the optional raw recovery-source export is a separately disclosed plain JSON copy.

Selected deletion offers a 30-second reversible stage before content cleanup. Minimal durable deletion markers block stale imports from reviving deleted identities. Full local deletion removes typed records, drafts, diagnostics, original demo source and pending device action content without undo; it retains non-content deletion markers. Local deletion does not erase exported/backup files, downloaded copies, OS/provider backups or optional cloud accounts. External copies remain under their owner’s control.

Cloud account export/deletion are separate account controls and require recent sign-in. Account deletion applies to this app’s account and workspace, rather than silently deleting all Servenzo app accounts. It ends access and initiates scoped cleanup; a queued or partially completed cleanup is not a claim of immediate forensic erasure. Identity-provider accounts, Google Play purchase records, mandatory provider retention and independent external copies have separate controls. See the operator and hosting section of this policy for the current deployment and retention settings.

Device access

The app does not request camera, microphone, contacts or location access. POST_NOTIFICATIONS is optional for supported Android reminders; boot/time broadcasts reconcile or invalidate approved alarm authority. INTERNET allows an explicitly configured HTTPS service connection. Native browser sign-in returns through this app’s unique callback scheme.

Children and audience

The publisher intends this app for users aged 13 and older. The app does not ask for a date of birth or build an account-based age profile.

Contact

Contact [email protected] for privacy questions. Do not include private files, child information, habit details or financial records in an initial support message. Sending support email uses your chosen email provider and is separate from this app’s feature data. No support message is sent automatically.

Current local R2 increment — 20 October 2026

The local practice workspace adds private cues, obstacles/playbook text, chosen fallback/minimum/standard tiers, target ladders, reduction/avoidance observations, action-window policy, boards/priorities, alternative-action groups, versioned routine snapshots/progress, and named day types with dated-versus-series overrides. These supplement existing period evidence without rewriting historical targets or fabricating missed/zero observations. Android widget projections use actual occurrence/version authority. Habit names are hidden by default; deliberately enabling names can expose them on the launcher. Revoked/stale/duplicate tickets cannot authorize a different period. Installed-widget behavior still requires device qualification.

The new feature state remains app-scoped and local. Explicit JSON/file/clipboard exports are independent private copies; recovery can contain active or captured unacknowledged inputs. Deleting local feature data does not erase exports, OS/provider originals, separate app accounts or another product. Provider, installed-device, signed-release and store/public-policy qualification are not inferred from local tests.