Baby Cam (Android and browser viewer)
When you start monitoring, the Android camera phone uses its camera and microphone to send live video and audio to an approved phone or browser. Talk-back uses the viewer's microphone while the control is held. A session can continue when the Android app is backgrounded, until you pause or stop it or the session ends. The app does not save recordings. Direct media travels over an encrypted connection between the devices. The service uses Cloudflare to authorize devices, connect them and coordinate monitoring. A household has an account identifier, device names and identifiers, security credentials, pairing and permission records, and session or sound events. Activity history contains event types and times and is retained on the service for up to seven days. You can clear the history. Exported files are copies you control.
Google Play processes subscription payments. RevenueCat receives the household purchase identifier, product and transaction details, and subscription status to verify, restore and manage Premium. AppSurge does not receive your payment card details. You can revoke an approved device, export your household data, or delete your household in Settings. Deleting the household removes viewing access and stored activity. Security and purchase records may be kept as needed for service protection, refunds, restoration, or legal obligations. Manage or cancel subscriptions separately in Google Play. Contact info@appsurge.app for privacy and deletion requests.
Shift Planner (Android)
Last updated 8 November 2026
Local planning. Shift Planner stores calendars, job names and time zones, planned and worked shifts, breaks, rotations, private notes, pay settings, reminders and preferences on your device. Core planning works without a Shift Planner account or cloud sync. If you enable Android backups, Android may back up planner data and preferences. Files you export or share are separate copies you control. If you enable reminders or add a widget, Android can show the shift information on the device. You can hide shift labels on the widget.
Purchases. Google Play processes payments and lets you manage or cancel a subscription. RevenueCat processes the app customer identifier, purchase and transaction details, product and subscription status to grant, verify and restore Pro access. The RevenueCat paywall also sends views, plan selections and purchase interactions with app/session context to operate the paywall and measure its performance. AppSurge’s cloud service checks subscription status and associates it with your optional cloud account. AppSurge does not receive your full payment-card details.
Optional cloud sync and Google recovery. Cloud sync requires your agreement in the app and a verified Pro entitlement. Cloudflare hosts the service and receives the planner records you sync, including shift times, notes and pay settings, along with account/device identifiers, the device’s public signing key, sync revisions and operational information. The service uses this information to synchronize your calendars, keep account data separate and resolve conflicting changes. The device keeps its private signing key. If you choose Google sign-in for recovery, the service verifies Google’s sign-in token. That token can contain basic profile information, such as your name and email address, which is processed temporarily during verification. The service retains the Google account identifier to link or recover your calendar; it does not store your profile name, email address or profile picture from the token, and it does not request access to Gmail or Google Calendar.
Private availability sharing. You can create a single-use invitation and choose a date range and whether to share free/busy or shift times. The recipient can see only the availability data you preview and authorize. Private notes, pay and job names are excluded. You can revoke access in Sharing. Revocation stops new downloads. An offline availability copy can remain available on the recipient’s device for up to 24 hours. Information a recipient has copied separately remains under their control.
Optional in-app support. When you choose Send feedback in Settings → Contact support, we receive your selected reason and message, a report reference, RevenueCat customer identifier, device manufacturer and model, Android version, app version/build and language. Cloudflare delivers and stores the report in AppSurge’s private support dashboard to investigate feedback and purchase issues. Sending feedback requires neither Pro nor cloud sign-in. The form explains the details included. Calendar records, private notes, pay settings and files are not automatically attached. Please avoid passwords, payment-card details or sensitive information in your message. Support reports are kept while needed for investigation, follow-up, security or legal claims. Cloud-account deletion does not automatically erase a separately submitted support report. Contact info@appsurge.app, identifying Shift Planner and the relevant report or customer reference, for access or deletion requests.
Retention, export and deletion. The service retains synced calendar records and the markers needed to synchronize deletions until cloud-account deletion. Records you delete are no longer part of the active synced calendar. The service removes sync change and mutation history older than 90 days during scheduled maintenance. Cloud export snapshots are available for 24 hours. To export cloud data or delete your cloud account, open Sharing and use the Account & Data controls. Deletion revokes cloud access and shares immediately and queues removal of synced records and the associated RevenueCat customer record. A minimal deletion record prevents old devices from recreating the deleted account. You can keep or erase the local calendar separately. Account deletion and uninstalling do not cancel Google Play billing. Google and other providers retain their own records according to their policies and obligations.
AppSurge commv is responsible for Shift Planner. Contact info@appsurge.app with privacy questions or use the account deletion page if you cannot open the app.
- Shift Planner account deletion — https://shift-planner.mgz96rthy2.workers.dev/account-deletion
- Cloudflare privacy policy — https://www.cloudflare.com/privacypolicy/
- RevenueCat privacy policy — https://www.revenuecat.com/privacy/
- Google privacy policy — https://policies.google.com/privacy
AppSurge commv is responsible for the personal information described here. Contact us at [info@appsurge.app](mailto:info@appsurge.app) or at Sergeant Debruynestraat 38, Antwerpen
This policy covers our App Store and Google Play apps that link to it. Collection depends on the app, platform, version and features you use; not every app handles every category below.
- Your content: selected photos, videos, recordings, instructions, documents, notes, messages and other information needed for a feature.
- Accounts and purchases: sign-in details where accounts are offered, customer or installation identifiers, receipts, subscription status and purchase history. Apple and Google process store payments; we do not receive your full card number or security code.
- Usage and diagnostics: IP address, approximate location, device/app information, feature and purchase interactions, performance, errors and service records. Some records are linked to a customer or installation identifier rather than being anonymous.
- Feature-specific information: location, health or dietary information, religious activity, child profiles, measurements, contacts and financial documents, as described in section 5.
Information comes from you, your use of the app, authorized device services, sign-in/payment providers and services that return requested results. Local content may also be included in your device backups or optional cloud sync.
We use information to deliver requested features, manage purchases, provide support, review reports, understand app use, prevent abuse, maintain reliability and meet legal obligations.
Where European law applies, service delivery relies on performance of our contract with you; necessary security, troubleshooting and ordinary support rely on legitimate interests, subject to your rights; legally required records rely on legal obligations. Consent applies to processing covered by a valid permission you give. Analytics requires consent where applicable; otherwise, any reliance on legitimate interests must respect your rights and applicable device-access rules. Protected health or religious information also requires an additional legal condition, such as explicit consent. This policy does not itself provide consent.
AppSurge does not use customer information for off-app advertising, email marketing or training AI models. This describes our use; third-party processing and retention depend on the applicable service arrangements.
We use providers for these specific purposes:
- AI processing: OpenAI for supported analysis, transcription and assistance; Replicate and fal.ai for supported media generation; Google Gemini in applicable legacy features. Section 5 identifies the relevant apps. Platform speech services may also process audio remotely.
- Cloud hosting and account storage: processing submitted content, storing accounts or cloud history, and maintaining service/security records. Apple or your device-backup provider handles enabled sync and backups.
- Purchases and analytics: app stores and subscription/paywall services receive purchase, identifier and interaction information; app-usage and diagnostic services receive the events described below.
- Support and moderation: email and third-party support-messaging services handle reports, attachments and relevant customer information. Operational alerts may contain request metadata or error details.
- Feature content: product databases, weather/maps, prayer resources and wildlife-information services receive relevant searches, downloads or location requests.
We may disclose necessary information to comply with binding legal requirements, protect rights and safety, or in a business transfer subject to applicable protections. Exports, external websites and recipients you choose have their own privacy practices.
Your journal and Apple Health. Period and symptom entries, mood, sleep, temperature and fertility observations, pregnancy/context records, treatment notes, learning preferences and reminders are stored in the protected local journal. The app works without an account. Apple Health access is optional: you choose the types and separately review imports or exports. Estimates are not exported as observed health measurements. Face ID and device-passcode authentication are handled by Apple; AppSurge does not receive biometric templates or your passcode. Widget content follows your widget privacy choice; shared widget storage remains on the device.
Optional accounts, backup and Plus sync. Cloudflare hosts our account and encrypted-storage services. Setup registers account and device identifiers and public signing keys. Email sign-in is optional: Cloudflare processes the address to deliver a code; our identity service stores a hash linked to the account, rate-limit records and short-lived authentication challenges. Passkeys store public credentials, not biometric data. Apple/RevenueCat receive the account identifier when purchase access is linked to an account. Linking an email or purchase identity does not authorize a journal upload.
When you choose Back up now, or separately enable Plus sync, the app encrypts journal content on the device before uploading it to Cloudflare. This content can contain health, pregnancy, intimate and other sensitive records. AppSurge's storage service receives ciphertext and the account/device and version information needed to operate it; it does not have the journal decryption key. Plus sync runs while the app is open and unlocked. Recovery requires the recovery key you save separately. Rythena cannot replace a lost recovery key. Protect your devices and key; encryption is not a guarantee against all access or loss.
Optional Plus supporter sharing. You preview the specific summary and choose whether estimates are included before creating a link. Only that summary is encrypted and uploaded; the key is in the link fragment used by the recipient's browser. Anyone who receives the full link can read the summary. Links expire and can be revoked in the app, but recipients can retain copies. Sharing is not an emergency or clinical monitoring service.
Optional Partner Mode
Partner Mode maintains a private, read-only connection with a partner, separate from manually created supporter-summary links. The owner needs Plus to create and approve a connection, resume or increase sharing, and publish updates. Reviewing, reducing, pausing and revoking sharing remain free. Recipients need no account, cycle-journal setup or Plus subscription. Pairing gives them no journal-editing rights, account sign-in or recovery key.
Invitations and choices
An invitation expires after 24 hours and can be claimed once. A claim stays pending until the owner previews the sharing choices, confirms them and approves matching verification codes. Matching codes confirm the pairing; check whom you are connecting with separately. Keep invitations and connection credentials private. Ongoing access is bound to the recipient connection credential.
Each category initially starts off: cycle day and recorded/setup period-start information with available next-period estimates; separate fertility estimates, which also require cycle sharing; today’s saved built-in mood; and a support preference you choose from space, company, listening or practical help. Drafts, future entries, custom wording, notes, symptom entries, intimacy records, test results and the full journal are excluded. Support preferences are chosen by you, not inferred from cycle phase. Fertility estimates are not confirmed ovulation or guidance for avoiding pregnancy.
Storage and updates
The app encrypts only your selected information before uploading the snapshot to Cloudflare. The receiving app decrypts it locally. The service does not have the unencrypted snapshot key. Health contents and decryption keys are not included in server URLs or notification text.
Readable connection metadata includes account-linked identifiers, invitation/recipient credential hashes, permissions, status, versions, timing/expiry information and opaque update identifiers. The service also stores an encrypted owner-recovery envelope, not a plaintext key. Connection/security information, including IP-derived rate-limit information, protects access. On iPhone/iPad, connection secrets and notification preferences use protected local Keychain storage. Encryption does not guarantee against every device compromise or loss.
Approving nonempty permissions enables automatic sharing on the owner’s device. Updates are attempted after saved changes, during refresh while open and unlocked, and when iOS permits background refresh, subject to permission state, available data, connectivity and current Plus access. iOS may delay or skip checks, including after force quit or when Background App Refresh is unavailable. Delivery is not immediate or guaranteed. Partner Mode is not an emergency or clinical monitoring service.
Expiry and ending access
Snapshots expire by the owner’s next local midnight, within 24 hours. Expired contents are no longer returned as current information. Cleanup occurs when the service next processes the connection; expiry does not promise immediate physical erasure.
Owners can reduce permissions, pause or revoke; recipients can disconnect. These owner privacy actions stop new local publishing immediately. If offline or a request fails, the app shows that the server change is still pending. The last snapshot may remain accessible until the server processes the change or it expires. Information already seen or copied cannot be recalled.
Revocation clears the snapshot, encrypted owner envelope and active credential hashes, and disables sharing and alerts. A revoked identifier/state/version/timing record can remain until cloud-account deletion. Deleting that account erases Partner Mode storage; the limited deletion/security markers described elsewhere may remain. Removing the app or disconnecting a device does not itself erase all server records or recipient copies.
Optional notifications
Recipient opt-in, owner alert permission and iOS permission are required. After an authorized refresh and decryption, iOS creates local alerts using neutral text such as “Your partner shared an update. Open Rythena to see it.” Health details and credentials are excluded from notification contents and remote push payloads. Quiet hours suppress alert attempts; update identifiers prevent duplicates. Disconnect/revocation cancels local alerts when processed; an offline device may not yet know about remote changes. Notifications can be disabled without ending the connection.
Articles and reading statistics. Cloudflare delivers published articles and their assets and processes connection/security information such as IP address, request time and client information to deliver and protect the service. Optional reading statistics are off by default. If enabled, they include article ID, language/version, day, active reading time, whether the end was reached, marked-read and save actions, and random per-article reader/session identifiers. These events contain no account ID or journal entries; article topics can indicate health interests. The server stores hashes of the random identifiers. Turning sharing off stops new optional collection and clears queued events. Queued events expire after seven days; scheduled cleanup removes received reading sessions after 90 days, allowing until the next cleanup execution. We do not re-link reading statistics to account identities. OpenAI is used by the administration service to translate and check editorial content and create guide images; Rythena does not send your journal, HealthKit records, or account details to OpenAI for these tasks. Articles cite sources and are educational, not clinician-reviewed personal advice.
Purchases and support. Apple processes payment. RevenueCat receives purchase history, product/transaction information, entitlement status and app/customer identifiers to enable, restore and manage Plus, prevent fraud and provide purchase analytics. The purchasing Apple account is separate from a Rythena journal account. No health records are sent as RevenueCat customer attributes. AppSurge does not receive payment-card details. The in-app feedback form sends the category and message you review to our Cloudflare service; it does not automatically attach your journal or account. Avoid including health records, recovery keys or passwords in feedback. Email support processes the information you choose to send.
Retention and deletion. Local entries remain until you remove them. In Settings → Privacy & protection → Backup & recovery → Account and recovery, you can delete the cloud account and backups using the recovery key without buying Plus. Successful cloud deletion removes stored journal copies, active sharing links and account identity bindings; limited deletion/security markers may remain to prevent replay or unauthorized recreation. Disconnecting a device, disabling sync, deleting local entries or uninstalling does not itself delete existing cloud copies. Shared/exported files, your saved backups and recipient copies require separate deletion. Support messages remain while needed to investigate and follow up, or until an applicable deletion request is completed; contact info@appsurge.app with the app and relevant reference. Purchase/provider security records remain as needed for subscription operation, restoration, fraud prevention, disputes and legal recordkeeping. Account deletion does not cancel a subscription: use your Apple subscription settings.
Providers and your choices. Cloudflare, RevenueCat and Apple process the information needed for their stated services under their applicable privacy and data-processing terms, including security and subprocessor safeguards. Their relevant terms are linked below; international-transfer and rights provisions in sections 3 and 6–10 also apply. We do not sell Rythena health information, use it for advertising tracking, or train AI models on it. Optional cloud/sharing, Apple Health, reminders and reading statistics have separate controls. You can keep using the free local journal when you decline optional services. Contact AppSurge at info@appsurge.app for access, correction, deletion and other applicable privacy rights.
Your local journal and device protection. Core period tracking works without an online account. Period dates and flow, symptoms, mood, sleep, temperature and fertility observations, pregnancy or contraception context, treatment and dose observations, notes, preferences and reminders are stored in the encrypted local journal on your Android device. Android Keystore protects local encryption credentials. Optional biometric or device-credential authentication is handled by Android; AppSurge does not receive your biometric templates, screen-lock PIN or passcode. Screen-capture/app-switcher privacy and widget visibility have separate controls. They are visibility choices, not substitutes for journal encryption. Exports and files you share are separate copies outside the journal's protection.
Optional Health Connect. Health Connect is separate from cloud backup and Google Play billing. With the permissions you choose, Rythena can read menstrual-flow and period records and, for optional context, sleep duration, step totals and basal body temperature. You review menstrual imports before saving them to your journal. Writing requires separate permission and confirmation and exports only supported, manually recorded menstrual-flow observations; estimates are not written as observed health measurements. You can review or revoke access in Android Health Connect settings and keep using manual tracking. Health Connect data is used for the tracking and context features you request, not advertising, sale or AI-model training. A permission does not itself authorize a cloud upload or partner sharing. Imported information can be included in an encrypted backup or selected sharing only when you separately choose those services.
Optional account, encrypted backup and Plus sync. Cloudflare hosts our account, encrypted-storage and sharing services. Android account setup uses an account/device identifier, public signing keys and a user-held recovery credential; this Android build does not require email/password or social sign-in. Keep the recovery code separately: Rythena cannot replace a lost recovery key. Creating or recovering an account does not by itself upload your journal. When you explicitly back up, or separately enable Plus device synchronization, the app encrypts the journal on the device before uploading it. The service receives ciphertext, account/device identifiers and the version, size, timing and security information needed to operate it; it does not hold the journal decryption key. Plus sync checks while the journal is open and unlocked, and incoming changes require review. Encryption does not guarantee protection against every compromised device or lost key.
Google Play purchases. Google Play processes Android payments. RevenueCat receives app/customer identifiers, purchase and transaction information, product identifiers and entitlement/subscription status to enable, restore and manage Plus, prevent fraud and provide purchase analytics. Linking Plus to an optional Rythena account also associates the purchase-service identity with that account identifier; it does not authorize a journal upload. We do not send health records as RevenueCat customer attributes or receive your payment-card details. The Google account used for purchases is separate from the Rythena journal account. Plans auto-renew at the localized price and terms shown by Google Play until cancelled. Manage or cancel them in Google Play Subscriptions. Deleting journal data, the cloud account or the app does not cancel a subscription or automatically erase records that Google or RevenueCat retain for purchases, restoration, fraud prevention or legal obligations.
Optional supporter links and Partner Mode. Supporter links share only the summary you preview and choose, encrypted on your device. The decryption key is in the link fragment used by the recipient's browser; anyone holding the full link can read it until access expires or is revoked, and recipients can retain copies. Partner Mode is a separate private, read-only app connection. Its owner needs Plus to create/approve a connection, increase or resume sharing and publish updates. Reviewing, reducing, pausing or revoking sharing remains free; recipients need no account, cycle setup or second Plus subscription. A one-use invitation expires within 24 hours and remains pending until the owner reviews the permissions and approves matching verification codes. Check the recipient's identity separately.
Partner choices and storage. Categories initially start off. The owner separately chooses cycle/period-start information and available next-period estimates, fertility estimates (which also require cycle sharing), today's saved built-in mood and a chosen support preference. Notes, custom wording, symptoms, intimacy records, test results, drafts, future entries and the full journal are excluded. Only the selected summary is encrypted and uploaded to Cloudflare; the receiving app decrypts it locally. The service keeps readable account-linked connection identifiers, permission/status/version/timing information, credential hashes and opaque update identifiers, plus an encrypted owner-recovery envelope. It does not receive the plaintext summary key. Android stores connection credentials and preferences with Keystore-backed protection; received health snapshots are held in memory, not saved as a recipient journal.
Partner updates and notifications. Approving nonempty permissions enables automatic publishing on the owner's device. Android may also schedule network-constrained background refresh using WorkManager. Background execution, battery settings, force stop, permissions, connectivity and Plus access can delay or prevent updates; delivery is not immediate or guaranteed. Snapshots expire by the owner's next local midnight, within 24 hours. Recipient opt-in, owner alert permission and Android notification permission are required for partner alerts. They use neutral local notification text without health details or credentials. Quiet hours and update identifiers limit alerts and duplicates. Regular journal/reminder notifications are separately controlled and may show the reminder wording you choose on your device or lock screen.
Ending sharing. Reducing, pausing or revoking sharing stops new local publishing immediately, but an offline or failed request may leave the server change pending. The last snapshot may remain accessible until the service processes the change or it expires. Revocation clears the active snapshot and credentials when processed; a limited revoked-connection record can remain until cloud-account deletion. Expiry is not a promise of immediate physical erasure. Recipients can disconnect. Previously viewed, exported or copied information cannot be recalled. Partner Mode is not an emergency, clinical-monitoring or contraception service; fertility dates are estimates, not confirmed ovulation or safe days.
Articles, reading statistics and support. Cloudflare delivers articles/assets and processes technical connection and security information, including IP-related request information, to deliver and protect the service. Optional reading statistics are off by default. If enabled, they include article ID, language/version, day, active reading time, end-reached/marked-read/save actions and random per-article reader/session identifiers; they contain no journal entries or account ID, although article topics can reveal health interests. Turning them off stops new optional collection and clears queued statistics. Queued events expire after seven days; received reading-session cleanup runs after 90 days, subject to the next cleanup execution. Editorial administration may use OpenAI to translate/check articles or create guide images; these tasks do not send your journal, Health Connect records or account details to OpenAI. The feedback form sends the category and message you review to our Cloudflare service, without automatically attaching your journal or account. Email support processes what you choose to send. Do not include recovery codes, passwords, private invitations or health records in support messages.
Retention, deletion and privacy requests. Local entries remain until you remove them; Android Clear storage or uninstalling removes local app data but does not delete cloud copies or recipient/exported files. In the app's settings, open Encrypted cloud backup and select Delete my cloud account. This free control authenticates with your recovery credential and deletes the cloud account and stored backups; limited security/deletion markers may remain to prevent replay or unauthorized recreation. Disconnecting a device or disabling sync is not cloud-account deletion. Keep any records you need before deleting. For a web-based account, data-deletion or other privacy request, email info@appsurge.app with “Rythena Android privacy request”, the action requested and a relevant non-secret account or support reference. Never email the recovery code. We verify requests proportionately and explain any data retained for security, purchase operations or legal obligations; without sufficient account authentication we may be unable to erase an encrypted account safely. Support messages remain while needed to investigate/follow up or handle an applicable deletion request. Backups you saved, Health Connect records and third-party purchase records have their own controls.
Providers and choices. Cloudflare, RevenueCat and Google process information for their respective hosting, purchase, health-platform and security services under their applicable terms. The international-transfer and rights provisions in sections 3 and 6–10 apply. Google privacy: https://policies.google.com/privacy. Cloudflare and RevenueCat terms are linked in the Rythena section above. We do not sell Rythena health information or use it for advertising tracking or AI-model training. You can keep using the free local journal when you decline optional Health Connect, cloud/sharing, reading statistics or purchases.
This section describes Roof Pitch version 1.0.0 and its one-time Roof Pro upgrade.
Local measurements and job content. Pitch readings and calibration, calculator inputs, saved jobs and customer details, material and cost worksheets, company details and logos, photos and annotations, and generated PDFs are processed and stored on your device. Roof Pitch does not upload this job content to AppSurge or RevenueCat. Camera access is requested when you choose to take a job photo; importing a photo uses Apple's system photo picker. Roof Pitch has no app account, cloud job synchronization, advertising SDK or third-party AI processing.
Purchases. Apple processes the lifetime purchase. RevenueCat receives purchase history, product and transaction information, entitlement status and an anonymous app customer identifier to validate purchases, prevent fraud, enable Roof Pro and restore eligible access. Purchase information also supports RevenueCat's purchase-performance reporting. We do not set a named account identifier or send job/customer details as RevenueCat customer attributes, and we do not use this purchase information for advertising tracking or sell it to data brokers. AppSurge does not receive your full payment-card details.
Service-provider protection. RevenueCat processes purchase-related information under its data-processing terms, which require processing for the contracted service, appropriate security measures and protective obligations for its subprocessors. Those obligations support protection consistent with this policy. See RevenueCat's data-processing terms and privacy policy. Apple's purchase processing is governed by Apple's privacy policy.
Retention and deletion. Local job content remains until you remove it or use Settings → Backup, import & delete to delete local data. Device backups, exported backup files, shared photos and PDFs are separate copies controlled by you and your chosen destination. Deleting a job or uninstalling Roof Pitch does not erase Apple or RevenueCat purchase records. Purchase records are retained as needed to operate and restore lifetime access, resolve refunds and disputes, prevent fraud and meet applicable recordkeeping requirements. For access or deletion requests concerning information held by AppSurge or its purchase processor, contact info@appsurge.app and identify Roof Pitch and a relevant purchase reference. We assess requests under applicable law and explain any records that must be retained. Restore Purchases restores paid access; local jobs are recovered separately from your backup.
Selected images and instructions are processed by Replicate or fal.ai; legacy processing may use Google Gemini. Saved results are local; customer-linked instructions, usage and diagnostic records can remain on our services. Android and some earlier iOS versions use additional usage analytics. Submitted safety reports include the generated image, instructions and your explanation, excluding original/reference photos.
Portraits, reference images and styling choices are processed by Replicate. Saved looks can include originals and results. Separately agreed support reports can include before/after photos and customer details sent through a support-messaging service. Private-session mode does not guarantee immediate provider-wide deletion.
Baby photos and selected milestone text are processed by Replicate. Profiles can include names, birth dates and milestones. Optional Apple cloud backup includes profiles and images. The app is intended for adults acting for a child.
Ordinary measurements stay local. Optional AI try-on sends hand and ring images to Replicate. Device verification, purchases and usage limits involve service records; optional analytics concerns app events.
Room/reference photos and design instructions are processed by fal.ai. Projects and results are also saved locally. Selected shopping links contact external retailers.
Account details, uploaded media and generation/purchase history are stored online. Images and instructions are processed by Replicate. Use the account-deletion control to request account and associated storage removal.
Recordings, documents, images, transcripts and chat context can be sent for OpenAI processing. Replicate supports certain generated audio/visual features. Live conversations send microphone audio for processing; recording may continue in the background when started. Notes are also local. iOS includes usage analytics. MelonNote is intended for adults aged 18 and older. Local deletion does not erase all remote records.
From Android version 1.0.12 (build 25), MelonNote offers optional usage analytics, turned off by default. You can enable it on the last introduction screen or in Settings → Data & storage → Optional analytics, and turn it off there at any time. If enabled, we receive app and feature interactions, note-creation and study-action outcomes, paywall and checkout/restore outcomes, app version/build, language, session timestamps, request timings and sanitized error categories. These records are linked to a pseudonymous installation identifier derived by our service; they are not anonymous. Optional analytics do not contain your notes, recordings, messages, images, transcripts, prompts, filenames or URLs. Cloudflare hosts the administration service and database used to understand usage, investigate problems and improve MelonNote.
Turning analytics off stops future optional collection and clears pending events on your device; it does not itself erase previously received records. Scheduled cleanup removes raw analytics events after 90 days and installation activity records after 90 days without activity. Pending on-device events expire after seven days. Cleanup timing means records may remain until the next scheduled execution.
Necessary app verification, security and purchase processing remain separate from the optional analytics setting. Google Play and RevenueCat process purchase history, customer/app identifiers and subscription status to provide and restore access, verify purchases, prevent fraud and measure subscription performance. Our Cloudflare administration service receives verified billing events separately from optional usage analytics. Its billing-event records are removed after 400 days and expired subscription-status records 400 days after expiry. These rules do not control Google, Apple, RevenueCat or AI providers’ own retention. There is no dedicated Android analytics-deletion button. Contact info@appsurge.app for privacy requests, identifying MelonNote and any relevant purchase or support reference. Uninstalling the app or deleting local notes does not cancel subscriptions or automatically delete service-provider records.
Product databases receive barcode/search requests. Optional OpenAI explanations include relevant product and selected allergen information. Product/usage analytics is collected. Where available, improvement submissions include product results and a customer identifier and are enabled unless switched off. Use **Help improve FoodCheckr** and **Delete submitted data** to control these submissions separately from local history.
Product databases receive barcode/search requests. Prayer services receive coordinates and calculation preferences. Preferences/history are local; Android explanations use on-device models. iOS includes usage analytics. Product reports are sent through a support-messaging service on iOS or an email you choose to send on Android.
Product databases receive barcode/search requests; saved preferences/history are local. iOS nearby-place features use location and map services. Product reports go to a support-messaging service and can include your explanation, product details and customer identifier.
Food, weight, hydration and activity records are local, with optional Apple Health integration. Photos and descriptions used for nutrition analysis are sent to OpenAI. Optional usage analytics and product-database lookups are separate.
Photos and analysis instructions are processed by OpenAI; supported edits use Replicate. AI coaching can include facial estimates, food, hydration and sleep context, including authorized Apple Health summaries. Local wellness history and usage analytics are separate from this processing.
Location supports weather/maps. Optional skin analysis sends a photo and skin-type context to OpenAI. Analytics can include skin type, undertone and tan-level attributes. Its analytics setting is enabled by default in versions using that setting; turning it off stops future collection through that control.
Migraine, symptom and medication records are local. Optional Apple Health access includes sleep, heart-rate, menstrual and wrist-temperature information. Opt-in analytics can include headache type, pain/duration ranges and symptom/medication counts. Weather features use location.
Facial geometry and prescription recognition are processed locally. Saved measurements may include photos and prescriptions. Optional Apple iCloud sync includes this saved history; disabling sync does not delete existing cloud copies.
Workout history is local. Optional Apple Health integration accesses workout, heart-rate and energy information and can save workouts. External providers supply exercise and voice resources.
Caregiver-entered names, birth dates, feeding, sleep, milestones and developmental records are local and may enter device backups. These records can include a child's health information.
iOS stores selected-app blocking settings and progress locally. Recitation audio is processed locally, but analytics receives verse references, sequences, timing and recognition statistics that can reveal religious activity. Android uses installed-app selection, Accessibility, Usage Access and overlay permissions for chosen app limits; its blocking records stay local. Content downloads contact religious-resource providers.
Lessons and progress are local. Pronunciation practice uses speech services that may process audio remotely. Optional analytics concerns usage and technical events rather than raw answers or transcripts.
Photos are processed by OpenAI. Bird Identifier can also send text descriptions and precise coordinates to OpenAI for identification or seasonal advice. Weather/species services receive relevant location queries. Saved observations and photos are local.
Documents and reading progress are stored locally on your device. When you request a translation, the text you choose to translate and your target language are sent over HTTPS through our Cloudflare-hosted service to OpenAI to generate the translation. Translation requires an internet connection. Premium cloud speech sends selected text and voice settings to our speech-processing service. Supported on-device voices and document recognition run locally. Importing a web page contacts that website. Content submitted for cloud processing is subject to the service-provider and retention provisions in this policy.
Documents and reading progress are local. Web-page imports contact the selected website; device backups and chosen file providers may hold separate copies.
Recordings and edits are local. Transcription uses on-device models where available; supported platform-speech fallbacks can process audio remotely. Sharing creates separate copies.
Client/contact details, invoices, tax information, signatures and receipts are local. Exports share selected documents with the destination you choose.
Selected contact details and reminders are local. Calling or messaging passes the selected number to your chosen phone or messaging service.
This section describes Tapper for iOS version 1.0.6 and later versions that provide these privacy controls. Earlier versions and other platforms may have different features and data practices.
Your browsing and automation content. Saved websites, routines, scripts, tap positions, entered text and screen recordings are handled on your device. Tapper's usage analytics do not upload website URLs, page content, typed text, tap coordinates, selectors, routine names or recordings. Websites you open still receive requests from your device and may use their own cookies and tracking technologies. Their privacy policies apply. Content you choose to export or share is sent to the destination you select.
Optional usage analytics. Usage sharing is on by default when no previous preference exists. You can switch it off during onboarding or in Settings → Privacy & usage → Share usage analytics. An existing choice to switch it off is preserved. Switching it off stops optional usage reporting and clears pending analytics on the device; it does not by itself erase previously received records.
When sharing is on, we receive a random installation identifier and usage information such as features and modes used, app and paywall interactions, action counts, run durations, completion or failure reasons, subscription access state, timestamps and configuration version. Records also contain app version and build, operating-system version, device family, language and the part of Tapper being used, such as the app or Safari extension. We use these records to understand adoption, find problems and improve Tapper. A random identifier is pseudonymous: it is not your name, but it allows records from the same installation to be connected.
Optional questions.You may select a broad reason for using Tapper, such as games, reading, updates, repetitive tasks, testing or exploring, and answer whether Tapper helped with a task. These answers help us improve the app. Your selected purpose is saved locally. It is shared when usage sharing is enabled; if sharing is off, it stays on your device and may be shared if you later enable sharing. You can change your choice in Privacy & usage.
Bug reports and feedback. Reports are sent when you choose to submit them, including when optional analytics is off. We receive your message, selected topic, report reference, optional reply email, installation identifier, app version/build, iOS version, device model and family, language, RevenueCat customer identifier, subscription status and app configuration version. Reports also identify test/simulator versus production environments. We use this information to understand the problem, investigate subscriptions and respond when you provide contact details. The form lets you view the included support details. Please do not include passwords, payment-card details or private website content in your message.
Purchases. Apple processes purchases. RevenueCat helps us validate purchases, restore access and manage subscriptions using customer identifiers, transaction and product information, and subscription status. We may also receive subscription events in our support and administration service. Tapper does not receive your full payment-card details. Purchase information has its own retention and account controls; deleting Tapper analytics does not cancel a subscription or delete Apple or RevenueCat purchase records.
Remote settings and service security. Tapper loads remote settings even when optional analytics is off so that feature availability, fixes and in-app configuration continue to work. These requests include an installation identifier, platform, app version, language and app surface. Our service providers process the connection information needed to deliver and protect these services. Our API uses a salted hash of an IP address for rate limiting instead of storing the raw IP address in that rate-limit database. Cloudflare hosts the administration API and its data storage. RevenueCat provides subscription infrastructure, and Apple provides purchase processing. Access to the administration dashboard is restricted to authorized administrators. We do not use these Tapper records for third-party advertising tracking or sell them to data brokers.
Retention and deletion. Our daily cleanup removes usage events older than 90 days and feedback reports older than 365 days. Installation records are removed after 180 days without recorded analytics activity, measured from the last activity or registration. Cleanup timing means records may remain until the next scheduled cleanup.
You can choose Delete my analytics data in Privacy & usage. A successful deletion turns off usage sharing, removes the installation's server-side analytics records, and removes its installation link, reply email and RevenueCat identifier from associated feedback reports. The feedback message and remaining diagnostic details are retained for support until their normal deletion date. Personal information you typed into the message is not automatically removed from that text. If deletion cannot reach the service, sharing is switched off and the app asks you to retry.
For a request to delete feedback text or other support information, contact info@appsurge.app, preferably with the report reference. Subscription and billing records are separate from analytics and are retained as needed to operate subscriptions, resolve disputes and meet applicable recordkeeping obligations. They are not covered by the analytics deletion button or the 90-day analytics cleanup. You may continue to use local routines after deleting analytics and may later choose to send a new support report or enable analytics again.
Photos, recordings, health estimates and religious activity can be sensitive even without an account name. Facial processing for measurement or image generation is different from identifying someone through biometric authentication. Submit others' information only with appropriate authority.
Our apps are not directed specifically to children under 13. Baby-related features are for parents or authorized caregivers and can process children's information. Contact us about information submitted without appropriate authority. Age and parental-consent requirements depend on applicable law.
- Saved content: local items remain until removed or cleared; cloud accounts/history remain for the service until removed through applicable controls or a valid deletion request, subject to lawful retention. Backups and exports are separate.
- AIPGEN safety reports: retained for 90 days.
- FoodCheckr improvement submissions: scans for 365 days; reports while open and for 365 days after closure. Linked evidence follows report retention; limited deletion markers prevent resubmission of removed records.
- Support, usage and security records: kept as needed for investigation, follow-up, reliability, abuse prevention and legal claims. They can outlast a generated result.
- Purchases: retained as necessary for subscriptions, restoration, refunds and legal recordkeeping.
- AI processing: providers can retain content or security records beyond completion. Retention depends on the service and applicable settings; immediate deletion is not guaranteed.
Deleting an image, uninstalling an app or disabling sync does not automatically erase provider records, submitted reports or backups. Use the relevant local/account/cloud controls or contact us for server-held data. Android system **Clear storage** removes local app data. Deletion does not cancel a subscription; manage subscriptions through the purchasing store.
You can manage device permissions and available analytics/sync settings. Permission withdrawal affects future access, not previously submitted information. Some permissions or content are necessary for the feature you request; declining them can prevent that feature from working. Android recognition libraries can send technical diagnostics even when image recognition runs locally. Declining optional analytics does not stop necessary purchase/security processing.
Depending on applicable law, you may request access, correction, deletion, restriction or portability; object to processing; withdraw consent; use an authorized representative; or appeal a refusal. Withdrawal does not invalidate earlier lawful processing. We may verify your identity proportionately and will not unlawfully discriminate for exercising rights.
Email [info@appsurge.app](mailto:info@appsurge.app), identifying the app and relevant account/report reference. GDPR requests normally receive a response within one month; permitted extensions will be explained within that month. You may complain to your local authority or Belgium's [Data Protection Authority](https://www.dataprotectionauthority.be/citizen/actions/lodge-a-complaint).
Providers may process information outside Belgium and the European Economic Area, including in the United States. Transfers restricted by European law require an applicable legal mechanism, such as an adequacy decision or approved safeguards. Contact us for details relevant to your app.
We use appropriate security measures, but no system is completely secure. Information you export or share is also subject to the destination's protections.
We update this policy and its date when practices change, providing additional notice or seeking consent where required. A policy update does not itself authorize a new use of your information.