Privacy Policy — Rosvon | Self-Improvement

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: Google Sign-In provides a Firebase user ID, email address, and display name. Firebase records can also include account creation/update timestamps, backup-setup state, game Health/HP, entitlements, and purchase-verification information. Rosvon does not retrieve your Google password and does not automatically store your Google profile picture. Guest mode is available without a Rosvon cloud account.
• Leaderboard & Community Profile: Signing in currently creates a leaderboard and community profile with a username, display name, bio, profile-photo URL, XP, level, rank, achievement identifiers/count, and a privacy flag. The profile is public by default. Privacy mode hides statistics in the current client but may leave the name, bio, and profile photo visible to signed-in users.
• Profile Photo: A photo you select is copied to app-private local storage and may be included in Drive backup. If you are signed in, the current App also uploads a compressed copy to Firebase Storage and links it to your community profile without a separate "Go Public" step. Profile images can be read by signed-in community users.
• Core User Content: Tasks, habits, journals, notes, projects, areas, resources, and Protocol settings/history are stored locally by default. Supported records and media are copied to your Drive App Data folder only after backup setup. Full records are not stored in the community database, but selected task, habit, project, and focus context may be sent to AI when the corresponding AI controls are enabled.
• AI Chat and Memory: Chat messages and learned memory summaries are stored locally. An AI request can contain your message, recent chat, enabled app context, and identity/coaching-profile fields. After a response, Rosvon may make a second cloud request containing the raw user message and up to 500 characters of the AI response to decide whether to save a local memory.

1.2 Information Collected Automatically

• Analytics Data: Firebase Analytics is included in the release App and may collect automatic app, session, device, and pseudonymous installation events. The audited code does not set a Firebase Analytics user ID and does not contain explicit per-screen Analytics logging. Exact retention is controlled in the Firebase/Google Analytics console.
• Crash and Performance Data: Firebase Crashlytics, Performance Monitoring, and Sessions may process pseudonymous installation identifiers, device/app details, stack traces, diagnostics, and performance measurements. AI performance traces record metadata such as request/response length, timing, and result status; the audited trace code does not attach prompt text.
• Advertising Data: Google Mobile Ads is loaded for penalty-display and opt-in rewarded-ad flows. The release build is configured with production Google AdMob application and ad-unit identifiers for real advertising; debug and performance builds use test identifiers. Ad availability depends on Google and network conditions. Ordinary ad requests are used; the App does not currently implement Google UMP consent collection or enforce non-personalized requests. Google SDKs may process advertising/device identifiers, IP-derived coarse location, device information, impressions, clicks, and fraud/security signals under Google's terms.
• Purchase and Credit Records: Google Play processes purchase and payment details. Firebase Functions/Firestore store hashed purchase tokens, product and purchase type, Google Play order ID, subscription base-plan/state/expiry metadata, a hashed app-account identifier, granted or reversed entitlement quantities, request/event identifiers, Firebase user ID, and timestamps. Cloud Functions use these records to verify and deduplicate purchases and renewals, acknowledge or consume completed purchases, process real-time billing notifications, and reconcile refunds or chargebacks through Google Play's Voided Purchases API. Raw payment-card details are not provided to Rosvon.

1.3 Information Accessed On-Device Only (Never Collected)

• App Usage Statistics: If you grant Usage Access, Rosvon reads app screen-time totals and package names to show usage patterns, app limits, calendar insights, and top apps. Raw Usage Access events, package names, app limits, and blocked-app lists stay on your device. If AI Focus Context is enabled, selected focus-session summaries—not raw Usage Access events or package lists—may be sent to Google AI.
• Accessibility Service Events: If you enable the Rosvon Protocol Accessibility Service, Rosvon receives Android window-change events and the package name of the app currently opened. Rosvon uses this only to show the breathing intervention screen when a user-defined app limit, daily limit, or focus-session whitelist rule is reached. Rosvon does not read screen text, messages, passwords, form fields, notifications, or web content, and does not perform gestures, clicks, or control actions in other apps.

2. What We Do NOT Collect

3. How We Use Your Information

We use the information we collect for the following purposes:

4. Permissions and Their Purpose

Runtime and special-access permissions are optional for the core task, habit, journal, and project features. Denying Usage Access or Accessibility disables or weakens Protocol monitoring and enforcement; denying notifications or exact-alarm access can reduce reminder or timer reliability. Some library-declared permissions do not produce a user prompt.

5. AI Features and Data Processing

Rosvon's minimum age does not override a third-party provider's age restrictions. Google's current Firebase AI Logic and Google Cloud generative-AI terms restrict use in applications directed towards or likely to be accessed by individuals under 18. Parent or guardian permission does not override those terms. The current cloud-AI integration must be resolved before Rosvon is released for a 13+ audience; these Terms do not claim an implemented teen-AI restriction or provider approval. See the Firebase terms and Google Cloud Service Specific Terms, section 20(d).

Rosvon includes an AI assistant called "Aria". AI requests are cloud requests. In the current version, the master AI-content switch and individual context categories are enabled by default; change them before sending a message if you do not want a category attached.

5.1 Firebase AI Logic / Agent Platform Gemini Processing

Aria sends requests through Firebase AI Logic to Google's Agent Platform Gemini service (formerly described as Vertex AI). A request can contain your message, recent chat, locally learned memories, enabled tasks/habits/projects/resources/focus summaries, and profile or runtime context such as name, age, personality/coaching fields, current screen, time, battery/offline state, streak, discipline, burnout, and mood. Google processes requests under the applicable Firebase, Google Cloud, and Gemini terms, project configuration, and retention practices. The App cannot verify or guarantee zero provider retention or model-training use.

5.2 Google Search Grounding

Google Search is available to Aria's chat model. The model decides whether to search, for example when you request an online search or verification, or an answer needs current or uncertain public information. It is instructed to answer routine greetings and coaching without searching when existing knowledge and conversation context are sufficient; this is not a guarantee that a particular message will or will not trigger a search.

When search is used, Google processes your message and attached AI context to generate one or more queries sent to Google Search and uses the results to help answer. Aria is instructed to avoid private app data and account identifiers in search queries, but this instruction is not a technical redaction guarantee. Disabling app-content sharing does not disable Google Search for chat requests.

Under Google Cloud Service Specific Terms, section 20(k)(ii), Google may retain search queries derived from prompts and supplied context, not associated with Rosvon or its users, for up to three days for debugging. This search-log period is separate from local chat storage and other provider or project-configured retention described in this Policy.

5.3 AI Privacy Controls

You can disable app-data categories via Aria → three-dot menu → Privacy. Notes are separately controlled from Journal and Reflection entries, and project resource links follow Tasks & Projects. Turning off the master content control blocks new live app content and runtime context; it does not erase recent chat or learned memories, and your typed message is still sent when you request a response. Rosvon may make a second AI request using the raw user message and up to 500 characters of the response to decide whether to save a local memory. Aria does not receive raw Usage Access events, screen-time totals, individual package names, app limits, or blocked-app lists. If Focus Context is enabled, selected recent or active focus-session summaries may be attached.

6. Data Storage and Security

6.1 Local Storage

Local data uses Room (SQLite), DataStore, SharedPreferences, and app-private files/cache. Android's app sandbox limits ordinary access by other apps. Rosvon does not add SQLCipher or another app-layer encryption scheme to its Room database, preferences, or local media.

6.2 Cloud Storage (Opt-In)

Signing in activates Firebase account/community/game services. Google Drive backup is a separate optional feature:

• Firebase/Google Cloud: A signed-in account can store authentication/account fields, timestamps, backup status, game Health/HP, community profile/statistics, profile photos, entitlements, purchase verification, AI-credit consumption, and Golden Key redemption records. The community profile is currently created public by default.
• Google Drive App Data Folder: After backup setup, Rosvon writes supported tasks, habits, journals, notes, projects, profile/game state, preferences, and selected media as App Data backup files. AI chat/memories and some Protocol focus history are not included. The folder is accessible to Rosvon through your Google authorization and to Google as service provider; it is not exposed as an ordinary Drive file or copied to Rosvon's Firebase database.

6.3 Security Measures

• Rosvon uses Google Sign-In through Credential Manager and Firebase Authentication. The App does not receive or store your Google password.
• The audited Google/Firebase and custom network integrations use HTTPS/TLS; no custom cleartext endpoint was found.
• Firestore rules restrict private user collections to the owner and configured administrators. Community profiles and profile images are readable by signed-in users.
• The App integrates Firebase App Check with Play Integrity. Enforcement for each Firebase service is configured outside the App and cannot be confirmed by the source code alone.
• Google-hosted services apply their platform storage protections. This is separate from local/Drive app-layer encryption, which Rosvon does not currently add.
• We implement reasonable technical and organizational security measures to protect your data. However, no method of electronic storage or internet transmission is 100% secure, and we cannot guarantee absolute security.

7. Advertising

Penalty-screen choices: Habit, Task, Goal, and Focus/Protocol penalty screens can be cleared using 199 Gold (in-app coins) or 1 Golden Key, subject to available balance. Watching 5 rewarded ads is an optional alternative. Golden Key redemption requires an internet connection. Penalty-display ads may still appear even when you choose Gold or a Golden Key. Clearing a screen does not automatically restore XP, Gold, or HP already deducted. Clearing the Focus/Protocol daily-limit penalty screen keeps that gate cleared for the current day; it does not remove configured app or screen-time limits.

Rosvon includes Google Mobile Ads for penalty-display and user-initiated rewarded-ad flows. The release build is configured to request real ads using production Google AdMob identifiers; debug and performance builds use test identifiers. This does not guarantee that an ad will be available or shown. If an ad request is made, Google's SDK may process:

• Device advertising identifier (Google Advertising ID)
• Device information (model, OS version)
• IP address (for geographic ad targeting at a broad level)
• Ad interaction data (impressions, clicks)

Rosvon does not attach journal text, tasks, habits, projects, raw screen-time records, app-limit lists, or focus history to an ad request. The current App makes ordinary Google ad requests and does not implement Google UMP consent collection, a privacy-options entry point, or an application-level guarantee that requests are non-personalized. Production ads must not be enabled in regions requiring consent until those controls are implemented.

Google's processing and device-level ad controls are described in Google's Privacy Policy. Device settings do not replace any consent flow the App is legally required to provide.

8. Data Sharing and Disclosure

The audited App contains no mechanism that sells private user records. It does transmit or expose data in the following provider, community, legal, and safety circumstances:

8.1 Service Providers

We use the following third-party services that may process data on our behalf:

8.2 Community Features

Signing in currently creates a community profile with its privacy flag set to public by default. The active community client can make the following fields visible to signed-in Rosvon users:

• Username, Display Name, Bio, and Profile Picture
• Level, Rank, and Experience Points (XP)
• Achievement identifiers and achievement count

The active public payload does not include Health/HP, Gold, active challenges, personal tasks, habits, projects, journal text, raw screen-time records, or email address. Current privacy mode hides statistics but may continue to expose username, display name, bio, and profile photo to signed-in users.

8.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of our users or the public.

9. Data Retention and Account Deletion

• Local Data: Rosvon app-private records remain until removed with an app control, Android's clear-data action, a successful in-app account-deletion flow, or uninstall. Provider-held records are separate.
• Firebase/Auth/Storage Data: The in-app deletion flow attempts to delete Auth, user_info, user_data, community profile, profile pictures, user-linked Play purchase-token, billing-event, void-event, and challenge records. It is network/provider dependent and may require retry or support.
• Current Backend Exception: The current deletion Function does not automatically delete the top-level ai_credit_consumptions and golden_key_redemptions records. Those records can contain Firebase user ID, request/event identifiers, quantities or amounts, product/reward context, and timestamps. The current code defines no automatic expiry period for them. This implementation should be corrected before publication.
• Email Requests: You may ask for server-account deletion at rosvon.support@gmail.com. Email cannot remove app-private data from your phone or files in your Drive account. No fixed acknowledgement or completion time is guaranteed by the App.
• Google Drive Backups: The in-app flow attempts deletion only when local backup/sync markers identify a Rosvon backup. Network, authorization, provider failure, or lost local markers can leave Drive App Data files behind; use Google Account controls or contact support if the App cannot remove them.
• Analytics, Crash, Performance, Ads, Billing, and Platform Data: Retention is controlled by Google/Firebase console configuration, provider terms, and legal requirements. Rosvon source code cannot guarantee a 14-month or 90-day period or that every provider record is anonymous.
• AI Data: Chat and memory summaries remain locally until cleared with available controls, successful deletion, clear-data, or uninstall. Google handles cloud request data under the applicable Firebase/Cloud/Gemini terms and project configuration; Rosvon does not guarantee zero provider retention.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

For All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Start the current in-app deletion attempt from Help & Support, or request manual server-account handling at rosvon.support@gmail.com. Section 9 lists the current backend, Drive, local-device, provider, and transaction-record limitations.
• Data Portability: Ask for available account data in a structured form where applicable. Drive backup is intended for Rosvon restore and is not a complete export: it excludes AI chat/memories and some Protocol focus history.
• Withdraw Consent: Use available feature controls and contact support to withdraw consent you previously provided. Aria's content controls are at Aria → three-dot menu → Privacy; turning off context does not stop transmission of a message you later submit or erase previous chats and memories. Disabling backup does not delete existing Drive files. An Android permission or sign-in is not consent to every optional processing purpose.

For EU/EEA Users (GDPR)

Where the General Data Protection Regulation applies to our processing of your data, you may additionally have rights to:

• Object to processing based on legitimate interests.
• Restrict processing of your personal data.
• Lodge a complaint with your local data protection authority.

For California Users (CCPA/CPRA)

Where the California Consumer Privacy Act and California Privacy Rights Act apply to us and your data, you may have rights to:

• Know what personal information is collected, used, and shared.
• Request deletion of your personal information.
• Opt out of sale or sharing as those terms are defined by applicable law, and request limits on qualifying sensitive-data use. Rosvon does not sell private app records; the legal treatment of third-party advertising data must be assessed separately.
• Non-discrimination for exercising your privacy rights.

For Users in Other Jurisdictions

If you are located in any other jurisdiction with applicable data protection laws (e.g., LGPD in Brazil, POPIA in South Africa, PDPA in Singapore/Thailand, or India's DPDP Act), we will honor rights under the provisions that apply to us and are in force. Contact us using the details in Section 15 to exercise your rights.

To exercise a legally available right, contact us using Section 15. We will respond within the period required by applicable law after any necessary identity verification. The App itself does not guarantee a fixed response time.

11. International Data Transfers

Rosvon uses cloud services provided by Google LLC (United States). If you are located outside the United States, your data may be transferred to and processed in the United States or other countries where our service providers maintain facilities.

The transfer location and safeguard depend on the selected provider, service configuration, and current provider contract. Where required, we will rely only on a transfer mechanism that actually applies to the relevant service and jurisdiction.

12. Teenagers and Children's Privacy

Rosvon is intended for users aged 13 and above, including teenagers, and is not intended for children under 13. Users aged 13–17 need a parent or lawful guardian to review and accept the Terms and authorize use. Applicable local age and parental-consent requirements take precedence. The current App does not yet technically verify age, guardian identity, or guardian acceptance; this policy does not claim that verified parental consent is collected.

A parent or lawful guardian may contact rosvon.support@gmail.com about a young user's account, access, correction, withdrawal of any consent they provided, or deletion. If you believe a child under 13 is using Rosvon, or a young user is using it without required authorization, contact us. We will handle requests under applicable law after appropriate identity and authority checks; the deletion limitations described above still apply. Do not email passwords, payment-card details, government identity documents, or sexual images of children.

13. Data Security Incident Response

If a security incident affects personal information, response timing and notice will follow applicable law and the facts of the incident. Intended response steps include:

• Notify affected users and authorities within the period required by applicable law;
• Notify relevant data protection authorities as required by law.
• Take reasonable steps to contain and remediate the incident; and
• Provide information about affected data and protective actions when required and available.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the App, providers, or law. The current App has no remote policy-version notification or versioned-consent ledger.

• We will update the "Last Updated" date at the top of this page.
• Review this page and the in-app policy for the current text.
• Where law requires direct notice or renewed consent, we must add and use an appropriate mechanism before relying on the changed processing.

Continued use alone does not replace consent where applicable law requires affirmative consent.

15. Contact Us

If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data practices, please contact us at:

We aim to handle requests promptly and will meet any response period required by applicable law. The App does not provide a guaranteed 48-hour acknowledgement.

16. Google Play Data Safety Disclosure Summary

In accordance with Google Play Store requirements, the following is a summary of our data handling practices: