Privacy Policy — Rosvon

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: Google Sign-In provides a Firebase user ID, email address, and display name. Firebase records can also include account creation/update timestamps, backup-setup state, game Health/HP, entitlements, and purchase-verification information. Rosvon does not retrieve your Google password and does not automatically store your Google profile picture. Guest mode is available without a Rosvon cloud account.
• Community Profile: Signing in currently creates a community profile with a username, display name, bio, profile-photo URL, XP, level, rank, achievement identifiers/count, and a privacy flag. The profile is public by default. Privacy mode hides statistics in the current client but may leave the name, bio, and profile photo visible to signed-in users.
• Profile Photo: A photo you select is copied to app-private local storage and may be included in Drive backup. If you are signed in, the current App also uploads a compressed copy to Firebase Storage and links it to your community profile without a separate "Go Public" step. Profile images can be read by signed-in community users.
• Core User Content: Tasks, habits, journals, notes, projects, areas, resources, and Protocol settings/history are stored locally by default. Supported records and media are copied to your Drive App Data folder only after backup setup. Full records are not stored in the community database, but selected task, habit, project, and focus context may be sent to AI when the corresponding AI controls are enabled.
• AI Chat and Memory: Chat messages and learned memory summaries are stored locally. An AI request can contain your message, recent chat, enabled app context, and identity/coaching-profile fields. After a response, Rosvon may make a second cloud request containing the raw user message and up to 500 characters of the AI response to decide whether to save a local memory.

1.2 Information Collected Automatically

• Analytics Data: Firebase Analytics is included in the release App and may collect automatic app, session, device, and pseudonymous installation events. The audited code does not set a Firebase Analytics user ID and does not contain explicit per-screen Analytics logging. Exact retention is controlled in the Firebase/Google Analytics console.
• Crash and Performance Data: Firebase Crashlytics, Performance Monitoring, and Sessions may process pseudonymous installation identifiers, device/app details, stack traces, diagnostics, and performance measurements. AI performance traces record metadata such as request/response length, timing, and result status; the audited trace code does not attach prompt text.
• Advertising Data: Google Mobile Ads is loaded for penalty-display and opt-in rewarded-ad flows. The current App uses Google's sample/test application and ad-unit identifiers, so it does not currently serve production monetized inventory. Ordinary ad requests are used; the App does not currently implement Google UMP consent collection or enforce non-personalized requests. Google SDKs may process advertising/device identifiers, IP-derived coarse location, device information, impressions, clicks, and fraud/security signals under Google's terms.
• Purchase and Credit Records: Google Play processes purchase details. Firebase Functions/Firestore store purchase tokens or hashes, product/entitlement state, request/event identifiers, user ID, quantities/amounts, and timestamps for verification, AI-credit consumption, and Golden Key redemption.

1.3 Information Accessed On-Device Only (Never Collected)

• App Usage Statistics: If you grant Usage Access, Rosvon reads app screen-time totals and package names to show usage patterns, app limits, calendar insights, and top apps. Raw Usage Access events, package names, app limits, and blocked-app lists stay on your device. If AI Focus Context is enabled, selected focus-session summaries—not raw Usage Access events or package lists—may be sent to Google AI.
• Accessibility Service Events: If you enable the Rosvon Protocol Accessibility Service, Rosvon receives Android window-change events and the package name of the app currently opened. Rosvon uses this only to show the breathing intervention screen when a user-defined app limit, daily limit, or focus-session whitelist rule is reached. Rosvon does not read screen text, messages, passwords, form fields, notifications, or web content, and does not perform gestures, clicks, or control actions in other apps.

2. What We Do NOT Collect

3. How We Use Your Information

We use the information we collect for the following purposes:

4. Permissions and Their Purpose

Runtime and special-access permissions are optional for the core task, habit, journal, and project features. Denying Usage Access or Accessibility disables or weakens Protocol monitoring and enforcement; denying notifications or exact-alarm access can reduce reminder or timer reliability. Some library-declared permissions do not produce a user prompt.

5. AI Features and Data Processing

Rosvon includes an AI assistant called "Aria". AI requests are cloud requests. In the current version, the master AI-content switch and individual context categories are enabled by default; change them before sending a message if you do not want a category attached.

5.1 Firebase AI Logic / Agent Platform Gemini Processing

Aria sends requests through Firebase AI Logic to Google's Agent Platform Gemini service (formerly described as Vertex AI). A request can contain your message, recent chat, locally learned memories, enabled tasks/habits/projects/resources/focus summaries, and profile or runtime context such as name, age, personality/coaching fields, current screen, time, battery/offline state, streak, discipline, burnout, and mood. Google processes requests under the applicable Firebase, Google Cloud, and Gemini terms, project configuration, and retention practices. The App cannot verify or guarantee zero provider retention or model-training use.

5.2 AI Privacy Controls

You can disable app-data categories via Aria → three-dot menu → Privacy. Notes are separately controlled from Journal and Reflection entries, and project resource links follow Tasks & Projects. Turning off the master content control blocks new live app content and runtime context; it does not erase recent chat or learned memories, and your typed message is still sent when you request a response. Rosvon may make a second AI request using the raw user message and up to 500 characters of the response to decide whether to save a local memory. Aria does not receive raw Usage Access events, screen-time totals, individual package names, app limits, or blocked-app lists. If Focus Context is enabled, selected recent or active focus-session summaries may be attached.

6. Data Storage and Security

6.1 Local Storage

Local data uses Room (SQLite), DataStore, SharedPreferences, and app-private files/cache. Android's app sandbox limits ordinary access by other apps. Rosvon does not add SQLCipher or another app-layer encryption scheme to its Room database, preferences, or local media.

6.2 Cloud Storage (Opt-In)

Signing in activates Firebase account/community/game services. Google Drive backup is a separate optional feature:

• Firebase/Google Cloud: A signed-in account can store authentication/account fields, timestamps, backup status, game Health/HP, community profile/statistics, profile photos, entitlements, purchase verification, AI-credit consumption, and Golden Key redemption records. The community profile is currently created public by default.
• Google Drive App Data Folder: After backup setup, Rosvon writes supported tasks, habits, journals, notes, projects, profile/game state, preferences, and selected media as App Data backup files. AI chat/memories and some Protocol focus history are not included. The folder is accessible to Rosvon through your Google authorization and to Google as service provider; it is not exposed as an ordinary Drive file or copied to Rosvon's Firebase database.

6.3 Security Measures

• Rosvon uses Google Sign-In through Credential Manager and Firebase Authentication. The App does not receive or store your Google password.
• The audited Google/Firebase and custom network integrations use HTTPS/TLS; no custom cleartext endpoint was found.
• Firestore rules restrict private user collections to the owner and configured administrators. Community profiles and profile images are readable by signed-in users.
• The App integrates Firebase App Check with Play Integrity. Enforcement for each Firebase service is configured outside the App and cannot be confirmed by the source code alone.
• Google-hosted services apply their platform storage protections. This is separate from local/Drive app-layer encryption, which Rosvon does not currently add.
• We implement reasonable technical and organizational security measures to protect your data. However, no method of electronic storage or internet transmission is 100% secure, and we cannot guarantee absolute security.

7. Advertising

Rosvon includes Google Mobile Ads for penalty-display and user-initiated rewarded-ad flows. The current App uses Google's sample/test application and ad-unit identifiers and therefore does not currently serve production monetized inventory. If an ad request is made, Google's SDK may process:

• Device advertising identifier (Google Advertising ID)
• Device information (model, OS version)
• IP address (for geographic ad targeting at a broad level)
• Ad interaction data (impressions, clicks)

Rosvon does not attach journal text, tasks, habits, projects, raw screen-time records, app-limit lists, or focus history to an ad request. The current App makes ordinary Google ad requests and does not implement Google UMP consent collection, a privacy-options entry point, or an application-level guarantee that requests are non-personalized. Production ads must not be enabled in regions requiring consent until those controls are implemented.

Google's processing and device-level ad controls are described in Google's Privacy Policy. Device settings do not replace any consent flow the App is legally required to provide.

8. Data Sharing and Disclosure

The audited App contains no mechanism that sells private user records. It does transmit or expose data in the following provider, community, legal, and safety circumstances:

8.1 Service Providers

We use the following third-party services that may process data on our behalf:

8.2 Community Features

Signing in currently creates a community profile with its privacy flag set to public by default. The active community client can make the following fields visible to signed-in Rosvon users:

• Username, Display Name, Bio, and Profile Picture
• Level, Rank, and Experience Points (XP)
• Achievement identifiers and achievement count

The active public payload does not include Health/HP, Gold, active challenges, personal tasks, habits, projects, journal text, raw screen-time records, or email address. Current privacy mode hides statistics but may continue to expose username, display name, bio, and profile photo to signed-in users.

8.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of our users or the public.

9. Data Retention and Account Deletion

• Local Data: Rosvon app-private records remain until removed with an app control, Android's clear-data action, a successful in-app account-deletion flow, or uninstall. Provider-held records are separate.
• Firebase/Auth/Storage Data: The in-app deletion flow attempts to delete Auth, user_info, user_data, community profile, profile pictures, Play purchase-token records, and challenge records. It is network/provider dependent and may require retry or support.
• Current Backend Exception: The current deletion Function does not automatically delete the top-level ai_credit_consumptions and golden_key_redemptions records. Those records can contain Firebase user ID, request/event identifiers, quantities or amounts, product/reward context, and timestamps. The current code defines no automatic expiry period for them. This implementation should be corrected before publication.
• Email Requests: You may ask for server-account deletion at rosvon.support@gmail.com. Email cannot remove app-private data from your phone or files in your Drive account. No fixed acknowledgement or completion time is guaranteed by the App.
• Google Drive Backups: The in-app flow attempts deletion only when local backup/sync markers identify a Rosvon backup. Network, authorization, provider failure, or lost local markers can leave Drive App Data files behind; use Google Account controls or contact support if the App cannot remove them.
• Analytics, Crash, Performance, Ads, Billing, and Platform Data: Retention is controlled by Google/Firebase console configuration, provider terms, and legal requirements. Rosvon source code cannot guarantee a 14-month or 90-day period or that every provider record is anonymous.
• AI Data: Chat and memory summaries remain locally until cleared with available controls, successful deletion, clear-data, or uninstall. Google handles cloud request data under the applicable Firebase/Cloud/Gemini terms and project configuration; Rosvon does not guarantee zero provider retention.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

For All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Start the current in-app deletion attempt from Help & Support, or request manual server-account handling at rosvon.support@gmail.com. Section 9 lists the current backend, Drive, local-device, provider, and transaction-record limitations.
• Data Portability: Ask for available account data in a structured form where applicable. Drive backup is intended for Rosvon restore and is not a complete export: it excludes AI chat/memories and some Protocol focus history.
• Withdraw Consent: Revoke consent for cloud sync and optional app features via Settings, and control Aria's access to app content via Aria → three-dot menu → Privacy.

For EU/EEA Users (GDPR)

Under the General Data Protection Regulation, you additionally have the right to:

• Object to processing based on legitimate interests.
• Restrict processing of your personal data.
• Lodge a complaint with your local data protection authority.

For California Users (CCPA/CPRA)

Under the California Consumer Privacy Act and California Privacy Rights Act, you have the right to:

• Know what personal information is collected, used, and shared.
• Request deletion of your personal information.
• Opt-out of the sale of personal information. We do not sell your personal information.
• Non-discrimination for exercising your privacy rights.

For Users in Other Jurisdictions

If you are located in any other jurisdiction with applicable data protection laws (e.g., LGPD in Brazil, POPIA in South Africa, PDPA in Singapore/Thailand, or India's DPDP Act), we will honor your rights as required by applicable law. Contact us using the details in Section 15 to exercise your rights.

To exercise a legally available right, contact us using Section 15. We will respond within the period required by applicable law after any necessary identity verification. The App itself does not guarantee a fixed response time.

11. International Data Transfers

Rosvon uses cloud services provided by Google LLC (United States). If you are located outside the United States, your data may be transferred to and processed in the United States or other countries where our service providers maintain facilities.

The transfer location and safeguard depend on the selected provider, service configuration, and current provider contract. Where required, we will rely only on a transfer mechanism that actually applies to the relevant service and jurisdiction.

12. Children's Privacy

Rosvon is intended only for people aged 18 or older and is not offered through parental consent. The current App does not technically verify date of birth or age, so a user must not use it if under 18.

If you believe an under-18 person has created an account, contact us using Section 15. We will handle the report and any required restriction or deletion under applicable law. The current general deletion limitations in Section 9 also apply until the implementation is corrected.

13. Data Security Incident Response

If a security incident affects personal information, response timing and notice will follow applicable law and the facts of the incident. Intended response steps include:

• Notify affected users and authorities within the period required by applicable law;
• Notify relevant data protection authorities as required by law.
• Take reasonable steps to contain and remediate the incident; and
• Provide information about affected data and protective actions when required and available.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the App, providers, or law. The current App has no remote policy-version notification or versioned-consent ledger.

• We will update the "Last Updated" date at the top of this page.
• Review this page and the in-app policy for the current text.
• Where law requires direct notice or renewed consent, we must add and use an appropriate mechanism before relying on the changed processing.

Continued use alone does not replace consent where applicable law requires affirmative consent.

15. Contact Us

If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data practices, please contact us at:

We aim to handle requests promptly and will meet any response period required by applicable law. The App does not provide a guaranteed 48-hour acknowledgement.

16. Google Play Data Safety Disclosure Summary

In accordance with Google Play Store requirements, the following is a summary of our data handling practices: