Privacy Policy for Reality

1. Data Isolation & Local Storage

Reality preserves offline integrity. All variables required to run your productivity dashboard reside locally:

• Room SQLite Database: Stores focus durations, strict lock limits, XP level states, and alarms locally.
• On-Device Encryption: Key config states and token parameters are locked inside Android's native EncryptedSharedPreferences container.
• Transient Screen Logging: Real-time screen metrics are cached in memory for up to 3 days to feed stats charts, after which they are deleted.

2. Personal Google Integration & OAuth

Reality integrates with Google Calendar, Tasks, Docs, and Drive using a client-side model. No intermediate servers handle these handshakes:

• Direct Client Authentication: The app utilizes credentials you configure in your own Google Cloud project. It requests tokens straight from Google using an on-device socket redirect listener.
• Drive & Docs Storage: Document logs, backup files, and journals are created inside your personal Google Drive space. Neubofy does not have access credentials to view or read these assets.
• Permission Scope: Google Profile scopes (name, profile picture, email address) are retrieved strictly to map active synchronization identities inside your local profile console. If you use custom GCP credentials, we do not collect or store this data. If you use the Firebase Auth fallback, a standard Firebase user record is created, but it remains entirely isolated from our subscription database (which never stores names, emails, or tokens).

3. JIT Cryptography & Edge Workers

To prevent physical data extractions or credential modifications from the client device:

• HMAC-SHA256 calculations are run Just-In-Time on Cloudflare Workers edge nodes.
• These edge servers only compute deterministic cryptographic hash keys using secret peppers and transient logins. No database or configuration metrics are logged or kept on edge node filesystems.

4. Accessibility API & Permissions

Reality leverages specific Android system controls to enforce blocks and prevent bypass loops:

• Accessibility Service: Used to read package change callbacks and block active applications. No inputs, keys, or background messages are tracked or parsed.
• Device Administrator: Utilized strictly to prevent unauthorized app uninstalls during active DND focus hours.

5. Third-Party Diagnostics

Reality employs Firebase strictly for debugging and message routing:

• Stability & Performance: Anonymous usage trends (crashes, session lengths) are tracked to monitor bug outbreaks.
• Push Notifications (FCM): Firebase Cloud Messaging handles silent background triggers to synchronize calendar data changes. No payload content is parsed.

6. Source-Available Integrity

Reality is a source-available codebase. Every line of implementation is open for public audit on GitHub. We provide this transparency so you can verify that no backend relays or telemetry tracking is added.

7. Changes to this Policy

As Reality runs local-first without cataloging your identity, we cannot send out email updates. Any changes will be updated directly on this page. We encourage you to review this policy periodically.

8. Data Sharing and Protection

Reality is a local-first application. We do not share, transfer, or disclose your Google user data (including Workspace APIs data) to any third parties. All data is kept strictly on your device or in your personal Google Drive. To protect sensitive data, we utilize on-device Android Keystore encryption to securely store authentication tokens and protect your data from unauthorized access.

9. Data Retention and Deletion

Your Google user data is retained only locally on your personal device. You can immediately delete all Google user data by signing out from the Profile page, clearing the app's cache/data in Android settings, or uninstalling the app. We do not retain any of your Google data on our servers because we do not have backend servers that store user data.

10. Google Workspace API Limited Use Disclosure

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We strictly prohibit using, transferring, or selling Google user data to create, train, or improve foundational or generalized machine learning and artificial intelligence models.

11. Contact Us

For security audits or privacy queries, reach out directly: support@neubofy.in