Privacy Policy

1. Who we are

This policy explains how the DeskFlow app for Android (package com.Kuantis.deskflow) and this website handle personal data.

• Developer and controller: Kuantis (“we”, “us”), based in Colombia. Under laws such as the GDPR, we are the controller for the processing we decide on, which this policy describes.
• Contact: kuantis.dev@gmail.com
• EU and UK representatives (Art. 27 GDPR and UK GDPR): none appointed. We run no servers, and our processing of personal data is limited and occasional (Art. 27(2)), so users in the EU and the UK can contact us directly at kuantis.dev@gmail.com.

DeskFlow is made by a small team, so the same contact handles every privacy matter, including as data protection contact (encarregado, Brazil), person in charge of the protection of personal information (Quebec), privacy officer (South Korea), Information Officer (South Africa) and grievance officer (India).

Google (AdMob, Google Play and Android backup) and RevenueCat are separate companies with their own privacy policies. Section 4 explains what each one does.

The app also includes a privacy notice: Settings → About → Privacy policy, or the privacy link on the Watch & health screen. The same screen opens when you tap the privacy link on Health Connect's permission screen. This web page is the complete version.

2. Summary

What we never do:

• We don't sell your personal information for money.
• We don't use analytics or crash-reporting services, and we don't build user profiles.
• DeskFlow doesn't ask for location, contacts, camera, microphone, photos or files permissions. (Google may estimate a general location from your IP address to serve ads.)
• We never receive, upload or sell your health data, and we never use it for ads.

3. Data stored on your phone

DeskFlow works without an account or sign-up, and we don't run servers. What you enter is stored only on your device, in DeskFlow's private storage, an area of your phone that other apps can't read. This includes:

• your work schedules and shifts, lunch time and days off;
• your goals and reminder settings (water, coffee or tea, active breaks, the 20-20-20 eye rule, standing up and lunch), quiet hours and notification preferences;
• your daily logs: when you logged water, coffee or tea, breaks, eye rests, stand-ups, focus blocks and lunch, and the reminders you answered “No”;
• your achievements, streaks and focus timer;
• your preferences, such as language, time format and theme;
• technical flags, such as whether you finished the setup, whether we already asked you for a rating, your progress with rewarded videos and a local copy of your Premium status;
• if you connect Health Connect: daily totals of steps, steps during work hours, minutes of sleep and wake-up time (see section 5).

Your wellness score, insights, achievements and the home-screen widget are calculated on your phone from this data. The widget shows your progress on your home screen, so anyone who can see your screen can see it.

Daily logs older than 400 days are deleted automatically. Everything else stays until you delete it (see section 11).

Notifications. Reminders are local notifications scheduled on your phone. DeskFlow doesn't use any push notification service and never sends a push token anywhere. A push messaging component (Firebase Cloud Messaging) comes bundled with a notifications library the app uses, but DeskFlow never activates it.

CSV report. If you choose to download your report, DeskFlow creates a CSV file on your phone with your daily totals for the last 30 days (including steps and minutes of sleep if Health Connect is connected) and opens Android's share sheet. The file only goes where you choose to save or send it.

4. Data processed by other companies

4.1 Google AdMob: ads in the free version

The free version shows ads served by Google AdMob through the Google Mobile Ads SDK, together with Google's User Messaging Platform (UMP), which asks for your consent where required.

• Ad formats: banners; native ads, which match the app's design and are labeled “Ad”; interstitials, full-screen ads shown only at natural breaks such as after finishing an exercise or a focus block, and at most about once every 30 minutes; and rewarded videos, which you only watch if you choose to (see below).
• What Google may collect: your advertising ID and app set ID; your IP address, which can be used to estimate your general location; device and operating system information (such as model, Android version and language); your interactions with ads and app launches; and diagnostic information about the performance of the app and the SDK. Google may also use Android's Privacy Sandbox ad APIs (Topics, Attribution Reporting and the advertising ID offered through Android's ad services), which you control in Android's settings.
• Why: to show and measure ads, limit how often you see them, and detect and prevent fraud and abuse.
• Personalized ads: ads are personalized only where you consent or where the law allows it. In the European Economic Area, the United Kingdom, Switzerland and other regions where it's required, Google's consent form appears before ads can be personalized; if you don't consent, Google shows non-personalized or limited ads. Where Google's consent message applies, DeskFlow's Settings include an Ad privacy option to review or change your choice at any time.
• Your controls on any Android phone: reset or delete your advertising ID and adjust Android's ad privacy settings (how). If you're signed in to Google, you can also manage ad personalization in My Ad Center.
• Premium: with Premium, DeskFlow doesn't load or show ads. The ads library may still start when you open the app and check your consent status.
• No health data: Health Connect data is never shared with Google AdMob or any ad network and is never used to choose ads.

Rewarded videos

Rewarded videos are always optional and only start when you tap. They unlock one CSV report download after 3 videos; the smartwatch connection, once, after 3 videos (Premium users skip this); and some Premium features, such as monthly insights and the full exercise library, for 24 hours after 1 video. A video counts only when watched to the end, and your progress is saved on your phone. Rewarded videos are ads served by Google AdMob as described above. Unlocking the watch connection doesn't link any health data to ads: it's just a flag saved on your phone.

Google acts as an independent controller for the data it collects through AdMob. Learn more: How Google uses information from sites or apps that use our services, Google's advertising technologies and the Google Privacy Policy.

4.2 Google Play Billing: payments

DeskFlow Premium is sold as monthly and yearly auto-renewing subscriptions and as a one-time lifetime purchase. Payments are processed by Google Play under Google's terms and privacy policy. We never see or store your card or payment details.

Google shares with us limited order information needed for accounting, refunds and support (for example order number, product, date, price and country) and lets the app check whether your purchase is active. Learn more: Google Privacy Policy and Google Payments Privacy Notice.

4.3 RevenueCat: purchase validation

We use RevenueCat, Inc. (United States) to validate purchases and keep your Premium status in sync. When the app starts, it checks your Premium status with RevenueCat using an anonymous ID generated in the app. If you buy or restore Premium, RevenueCat also receives your purchase token and receipt from Google Play, the product, its price and currency, the store country and the transaction dates (purchase, renewal, expiry or refund).

The anonymous ID isn't linked to your name, email or card. Like any online service, RevenueCat's servers see your IP address when the app connects. RevenueCat acts as our service provider (processor) and processes this data only on our behalf. Access is limited to us, through RevenueCat's dashboard, and to RevenueCat and its own service providers. Learn more: RevenueCat Privacy Policy.

4.4 Android backup (Google)

DeskFlow allows Android Auto Backup. If backup by Google is turned on on your phone, Android may store a copy of DeskFlow's data (including your logs and, if you connected Health Connect, the daily totals of steps and sleep) in your Google account, and restore it when you reinstall DeskFlow or set up a new phone. On Android 9 and later, if your phone has a screen lock, app backups are end-to-end encrypted with your PIN, pattern or password. We can't access this backup.

You control it in your phone's settings (for example Settings → Google → Backup; the path varies by phone). Learn more: Back up or restore data on your Android device.

4.5 Ratings and sharing

• Google Play In-App Review: after some achievements, DeskFlow may ask Google Play, once, to show its rating window. Google decides whether to show it. If you leave a review, Google handles it under its own terms; we only see what's public on Google Play.
• Android share sheet: “Share DeskFlow” (a message with the Google Play link) and the CSV report use Android's share sheet. The content only goes to the app or person you choose.

DeskFlow doesn't include analytics SDKs, crash-reporting services, social sign-in or data brokers.

5. Health Connect

DeskFlow's use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

What DeskFlow reads

• Steps (android.permission.health.READ_STEPS)
• Sleep sessions (android.permission.health.READ_SLEEP)

Nothing else. DeskFlow doesn't ask for permission to write and never writes, changes or deletes anything in Health Connect.

When

Health Connect is optional. DeskFlow reads nothing until you open Settings → Watch & health, tap to connect and grant access on Health Connect's own permission screen. In the free version, you first unlock the watch connection once by watching 3 rewarded videos (Premium users don't need to). This doesn't give the ad network any health data.

How it's used

Only for features you can see in the app:

• Steps: the steps you take during the work hours you set count toward your circulation (stand up and move) goal and your wellness score. Today's total appears in the app, and Insights shows your average.
• Sleep: DeskFlow looks at your most recent sleep session (ending between 6 p.m. the day before and 2 p.m. today) to find your real wake-up time. This adjusts the suggested time for your coffee or tea and shows how long you slept. Insights shows your average.

Where it's processed and what's stored

DeskFlow reads the data on your phone when you open or return to the app (at most once every couple of minutes) or when you tap “Refresh now”. It saves only four daily values in your daily log on the phone: today's steps, steps during work hours, minutes of sleep and wake-up time. Individual Health Connect records aren't stored.

Limited Use, in plain words

• No transfers, except to provide the features. We never send your Health Connect data to our servers (we don't have any) or to anyone else. It only leaves the app through actions you control: the CSV report you can export includes daily steps and minutes of sleep and goes only where you send it, and if Google backup is on, the daily totals are part of the encrypted app backup in your own Google account.
• No ads. We never use it to serve ads, for ad targeting or personalized or interest-based advertising, or to build profiles.
• No sale. We never sell or transfer it to third parties, including advertising platforms, data brokers or information resellers.
• No human reading. No person reads your health data. We have no access to it at all.
• No other purposes. We never use it to determine creditworthiness, insurance eligibility or employment suitability, for lending, or for anything other than the features above. For example, it isn't used to train AI models.

Legal basis (GDPR and UK GDPR)

Health data is a special category of personal data (Art. 9 GDPR). Where the GDPR or the UK GDPR applies, the legal basis is your explicit consent (Art. 9(2)(a), together with Art. 6(1)(a)), which you give on Health Connect's permission screen. You can withdraw it at any time; this doesn't affect the app's other features or the lawfulness of processing before you withdrew it.

Your control

• Tap Stop using health data in Settings → Watch & health: DeskFlow stops reading Health Connect right away.
• Revoke the permissions in Health Connect: in DeskFlow, tap Manage permissions in Health Connect, or open Health Connect and go to App permissions → DeskFlow (step by step).
• Daily totals already saved stay in your logs on your phone until you clear DeskFlow's data or uninstall the app, or until they're deleted automatically after 400 days.
• DeskFlow works fully without Health Connect.

The privacy link on Health Connect's permission screen opens DeskFlow's privacy screen, which you can also reach from Settings → About → Privacy policy and from the Watch & health screen.

If you live in a U.S. state with consumer health data laws (such as Washington, Nevada or Connecticut), see also our Consumer Health Data Privacy Policy.

6. Android permissions

DeskFlow doesn't request permissions for location, contacts, camera, microphone, phone calls, SMS, photos or files.

7. Legal bases

Switzerland: the Swiss FADP doesn't require a legal basis for each processing activity in the same way, but we apply the same principles. Other countries: where your local law requires consent or another basis, we rely on the equivalent one, for example consent for sensitive data under the LGPD, PIPL, KVKK or LFPDPPP.

8. International transfers

• We're based in Colombia. Because we don't run servers, the data you keep in DeskFlow isn't transferred to us. If you email us, your message reaches us there.
• Google (AdMob, Google Play and backup) and RevenueCat may process data in the United States and in other countries where they or their providers operate. These countries may have data protection laws different from yours.
• Where required, these transfers rely on adequacy decisions; the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework for certified companies; the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents; or other mechanisms recognized by your local law. See Google's data transfer frameworks and the RevenueCat Privacy Policy.

9. Retention

• On your phone: until you clear DeskFlow's data or uninstall the app. Daily logs older than 400 days, including the Health Connect daily totals, are deleted automatically.
• Android backup: as long as your Google account keeps it under Google's backup settings. You can turn it off or delete it.
• Google AdMob: according to Google's policies (how Google retains data).
• Google Play: Google keeps purchase records according to its policies and legal obligations.
• RevenueCat purchase record: while your Premium is active (for a lifetime purchase, while we offer the app), and afterwards only as long as needed for refunds, disputes, fraud prevention and our legal obligations, such as tax and accounting. Then we delete or anonymize it. You can ask us to delete it sooner.
• Emails: as long as needed to answer you and handle any follow-up, then deleted, unless the law requires us to keep them longer.

10. Security

• No servers: we don't operate servers, so there's no DeskFlow database of user logs or health data that could be breached.
• Android app sandbox: app data is kept in DeskFlow's private storage, which Android isolates from other apps. On phones with a screen lock, Android also encrypts the storage.
• Encryption in transit: the Google and RevenueCat SDKs in the app connect to their services over HTTPS/TLS.
• Our accounts: we limit access to our developer accounts (Google Play Console, AdMob and RevenueCat) and protect them with strong passwords and two-step verification.
• Your part: use a screen lock, keep your phone updated and be careful about where you share CSV reports.

Breach response

We don't disclose health data without your authorization. If a security breach affecting your personal data ever occurred, we would notify the affected users and the competent authorities without undue delay where the law requires it (for example, the supervisory authority within 72 hours under the GDPR, when required). For identifiable health information, we would also notify the U.S. Federal Trade Commission (FTC) and, where required, the media, as set out in the FTC Health Breach Notification Rule (16 CFR Part 318).

11. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data or receive a copy of it (portability); to object to or restrict its processing; to withdraw your consent at any time; to opt out of targeted advertising and of the “sale” or “sharing” of personal information; to appeal our decisions; and to complain to a data protection authority. We won't discriminate against you for exercising these rights.

We answer requests free of charge, as soon as possible and within the deadline set by the law that applies to you (for example, one month under the GDPR). We may ask for information to confirm a request, such as the order number. We can't identify you from data that stays only on your phone, and we don't need to: you can delete it directly. If you live in the United States, an authorized agent can make a request for you with your written permission.

If you're not satisfied with our answer, you can complain to your data protection authority (see section 12 and section 16).

12. Regional information

European Economic Area, United Kingdom and Switzerland

Laws: the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (FADP).

• Controller and representatives: see section 1.
• Your rights: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21), including the right to object at any time to processing based on our legitimate interests. You can withdraw consent at any time without affecting earlier processing (Art. 7(3)).
• Automated decisions: we don't make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22). Google selects ads automatically, but this doesn't have such effects.
• Consent for ads: Google's consent form, based on the IAB Transparency & Consent Framework, asks before ads can be personalized or information on your device is used for ads. Change your choice in Settings → Ad privacy.
• Complaints: you can complain to the supervisory authority where you live or work: EEA data protection authorities, the UK Information Commissioner's Office (ICO) or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

United States

Laws: the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other state privacy laws, such as those of Virginia, Colorado, Connecticut, Utah, Texas and Oregon, to the extent they apply to us. We give everyone the same choices, whether or not a particular law applies.

Personal information collected in the last 12 months

Sensitive personal information: health data (steps and sleep) is processed only on your device to provide the features you ask for. We don't collect it, and we don't use sensitive information to infer characteristics about you. Retention periods are in section 9.

Do Not Sell or Share My Personal Information

We don't sell personal information for money. However, letting Google AdMob use identifiers for personalized (cross-context behavioral) advertising may count as “sharing” under the CPRA, and as “targeted advertising” or a “sale” under some other state laws. You can opt out at any time:

1. In DeskFlow: Settings → Ad privacy, when Google's privacy message is available in your state.
2. Delete your advertising ID: on Android 12 or later, go to Settings → Privacy → Ads → Delete advertising ID (the path varies by phone). Apps then can't use it for personalized ads.
3. Android ad settings: on older versions, turn on “Opt out of Ads Personalization” in Settings → Google → Ads. On newer versions, you can also turn off ad topics and app-suggested ads in Android's ad privacy settings.
4. Email us at kuantis.dev@gmail.com with the subject “Do Not Sell or Share”. Because we don't hold your advertising ID, we'll help you apply the options above.

Premium also stops ads entirely. We don't knowingly sell or share the personal information of consumers under 16.

Global Privacy Control (GPC): this website doesn't collect, sell or share personal data, so there's nothing to opt out of here; if your browser sends a GPC signal, we treat it as a valid opt-out request. The app can't receive browser signals, so please use the options above in the app.

Your rights and how to appeal

You can ask to know and access the personal information we hold about you, and to delete or correct it, and you can opt out of its sale, sharing or use for targeted advertising (see section 11). We use sensitive information only to provide the features you request, so no further limit is needed. We won't deny you the app, charge you a different price or give you a different quality of service for exercising your rights; Premium is an optional paid product available to everyone.

If we decline your request, you can appeal by replying to our answer with “Appeal” in the subject line. We'll respond within the time your state's law requires. If you're still not satisfied, you can contact your state Attorney General. California residents can also contact the California Privacy Protection Agency.

Consumer health data (Washington, Nevada, Connecticut and similar laws)

Steps and sleep from Health Connect, and the daily values derived from them, may be “consumer health data” under laws such as Washington's My Health My Data Act, Nevada's SB 370 and Connecticut's consumer health data provisions. We process this data only on your device to provide the features you choose; we don't receive it, share it or sell it, and we don't use geofencing. Our Consumer Health Data Privacy Policy explains the details and how to exercise your rights.

Do Not Track, cross-site tracking and notice of changes (CalOPPA)

• Do Not Track: this website doesn't track you, so browser Do Not Track (DNT) signals don't change anything here. In the app, ad personalization follows your consent choices and Android's advertising ID controls (see above), and we honor Global Privacy Control as described above.
• Tracking by third parties: no third party can collect personal information about your activity over time and across websites through this website. In the app, Google AdMob may collect device identifiers and ad interaction data over time and across apps to serve and measure ads, subject to your consent and Android's ad settings. No third party receives your health data.
• Material changes: we'll update the “Last updated” date and post a notice in the app or on this website before material changes take effect (see section 15).
• Reviewing your information: you can review and change the information DeskFlow stores directly in the app, and request the purchase record we hold by email (see section 11).

Brazil

Law: the General Personal Data Protection Law (LGPD, Law No. 13,709/2018). The controller is Kuantis (section 1).

• Legal bases: performance of a contract, compliance with legal obligations, legitimate interests and consent (Art. 7). Health data is sensitive personal data (Art. 11): it's processed only on your device, with the specific consent you give on Health Connect's permission screen.
• Your rights (Art. 18): confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about the entities we share data with; information about the possibility of not consenting and its consequences; and revocation of consent. You can also ask for a review of decisions made solely by automated processing (Art. 20).
• International transfers: data handled by Google and RevenueCat may be transferred outside Brazil under the mechanisms of Art. 33, such as standard contractual clauses.
• Data protection contact (encarregado): Kuantis, kuantis.dev@gmail.com.
• Complaints: you can petition the National Data Protection Authority (ANPD).

Canada

Laws: the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial laws, including Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25.

• Consent: we rely on your consent, which you give by using the app and by choosing options such as the Health Connect permission and, where shown, Google's ad consent form. You can withdraw it at any time; the related feature then stops (for example, ads become non-personalized).
• Person in charge of the protection of personal information (Quebec): Kuantis, kuantis.dev@gmail.com.
• Your rights: access, correction and withdrawal of consent; in Quebec, also data portability.
• Profiling technology: Google AdMob may use your advertising ID to personalize ads, which is a form of profiling. You can turn this off at any time by deleting your advertising ID or through Android's ad settings (how).
• Transfers: data handled by Google and RevenueCat may be processed outside Quebec and Canada, including in the United States, where local authorities may be able to access it under local law.
• Complaints: the Office of the Privacy Commissioner of Canada and, in Quebec, the Commission d'accès à l'information.

Mexico

This section, together with the rest of this policy, is our privacy notice (aviso de privacidad) under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, 2025).

• Controller: Kuantis, domiciled in Colombia, email kuantis.dev@gmail.com.
• Purposes needed for the service: providing the app's features, the Health Connect features if you turn them on, and processing and validating purchases.
• Additional purpose: personalized advertising in the free version. You can object at any time, without affecting the app's features, by deleting or resetting your advertising ID, through Android's ad settings or by writing to us.
• Sensitive data: health data is processed only on your device, with the express consent you give on Health Connect's permission screen.
• Transfers and processors: Google (ads and payments) and RevenueCat (purchase validation), as described in section 4.
• ARCO rights: you can access, rectify, cancel or oppose the processing of your data, revoke your consent and limit its use or disclosure by writing to kuantis.dev@gmail.com with your name, a description of your request, the data involved and anything that helps us find it (such as your Google Play order number). We'll answer within the legal deadlines.
• Authority: the federal authority responsible for personal data protection (currently the Secretaría Anticorrupción y Buen Gobierno).

Argentina, Colombia, Chile and Peru

Argentina

Under Personal Data Protection Law No. 25,326, you can access, rectify, update and delete your data. The owner of personal data has the right to access it free of charge at intervals of no less than six months, unless a legitimate interest is shown (Art. 14(3), Law No. 25,326). The Agency for Access to Public Information (AAIP), as the supervisory body of Law No. 25,326, has the power to handle complaints and claims from anyone whose rights are affected by non-compliance with the rules on personal data protection.

Colombia

Because we are based in Colombia, Law 1581 of 2012 and its regulations (Decree 1377 of 2013, now part of Decree 1074 of 2015) apply to the personal data we process, and this policy is our data processing policy under those rules.

• Controller and contact for requests: Kuantis, domiciled in Colombia, kuantis.dev@gmail.com. We handle queries, claims and requests directly.
• Processing and purposes: described in sections 3 to 5. The only personal data we hold ourselves are Premium purchase records (through RevenueCat) and the emails you send us. Providing sensitive data, such as health data, is optional, and it's processed only on your device.
• Your rights: to know, update and rectify your data; to request proof of your authorization; to be informed about how your data is used; to revoke your authorization or ask for deletion; to access your data free of charge; and to file complaints with the Superintendence of Industry and Commerce (SIC).
• Procedure: write to kuantis.dev@gmail.com. We answer queries within 10 business days and claims within 15 business days, extendable as the law allows.
• International transfers: data handled by Google and RevenueCat goes to the United States, which the SIC recognizes as a country with an adequate level of data protection.
• Validity: this policy applies from October 23, 2026. Personal data is kept only as long as needed for the purposes described (see section 9).

Chile

Under Law No. 19,628 on the protection of private life and, once in force, Law No. 21,719, which creates the Personal Data Protection Agency, you can request access to, rectification, deletion or blocking of your data, object to its processing and, once Law No. 21,719 applies, request portability.

Peru

Under Personal Data Protection Law No. 29733 and its regulation, you can exercise your rights of information, access, rectification, cancellation and opposition by writing to us, and complain to the National Authority for Personal Data Protection (Ministry of Justice and Human Rights). Data handled by Google and RevenueCat may be transferred abroad (cross-border flow) as described in section 8.

Japan

Under the Act on the Protection of Personal Information (APPI):

• Business operator: Kuantis (Colombia), kuantis.dev@gmail.com. The purposes of use are described in sections 3 to 5.
• Provision to third parties in foreign countries: Google LLC and RevenueCat, Inc. are mainly located in the United States. The United States has no comprehensive federal privacy law equivalent to the APPI, although some states have privacy laws; Japan's Personal Information Protection Commission publishes information about foreign systems. Both companies maintain privacy programs and security safeguards described in their policies.
• Information sent externally (Telecommunications Business Act): what the Google Mobile Ads SDK and RevenueCat send, to whom and why is described in section 4.1 and section 4.3.
• Requests: you can ask us to disclose, correct, add to or delete your retained personal data, or to stop using or providing it, by writing to kuantis.dev@gmail.com.
• Security control measures: see section 10.
• Complaints: contact us first; you can also contact the Personal Information Protection Commission.

South Korea

Under the Personal Information Protection Act (PIPA), these are the details the law requires. The items processed, purposes and retention periods are in sections 2 to 5 and 9.

• Entrustment of processing: RevenueCat, Inc. (purchase validation). Payments are processed by Google LLC through Google Play as a separate controller.
• Destruction: data on your phone is destroyed when you clear DeskFlow's data or uninstall the app; daily logs are destroyed automatically after 400 days; purchase records at RevenueCat are permanently deleted when no longer needed or at your request.
• Automatic collection: the Google Mobile Ads SDK uses your advertising ID. You can refuse by deleting it in Android's settings; ads will still appear but won't be personalized.
• Privacy officer: Kuantis, kuantis.dev@gmail.com.
• Children: DeskFlow isn't intended for children under 14.

How to refuse: use the ad privacy options or Premium (ads), or don't buy Premium and ask us to delete the record (purchases). If you refuse, ads aren't personalized, and Premium can't be validated without RevenueCat.

Remedies: the Personal Information Protection Commission; the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972); the KISA Privacy Center (privacy.kisa.or.kr, 118); the Supreme Prosecutors' Office (www.spo.go.kr, 1301); and the Korean National Police Agency Cyber Bureau (ecrm.police.go.kr, 182).

India

Under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as their provisions come into force, we act as a Data Fiduciary.

• Your rights: to get a summary of your personal data and how it's processed; to correct, complete, update or erase it; to have your grievances addressed; and to nominate another person to exercise your rights if you die or become incapacitated. You can withdraw your consent as easily as you gave it.
• Grievance officer: Kuantis, kuantis.dev@gmail.com. If you're not satisfied with our response, you can complain to the Data Protection Board of India.
• Children: the Act treats everyone under 18 as a child. DeskFlow isn't intended for children, and its ads aren't directed at children.

Indonesia

Under Law No. 27 of 2022 on Personal Data Protection (UU PDP), health data is specific personal data, and DeskFlow processes it only on your device with your consent. You have the right to information about the processing; to complete, update and correct your data; to access it and get a copy; to end its processing and have it deleted or destroyed; to withdraw consent; to object to decisions based solely on automated processing; to restrict processing; to data portability; and to sue and receive compensation for violations. Data handled by Google and RevenueCat may be transferred outside Indonesia with the safeguards the law requires. Contact us at kuantis.dev@gmail.com; you can also complain to the data protection authority established under the law.

Turkey

This section, together with the rest of this policy, is our information notice under Personal Data Protection Law No. 6698 (KVKK). The data controller is Kuantis.

• Purposes and legal grounds (Arts. 5 and 6): performance of a contract, our legitimate interests, legal obligations, and your explicit consent where required, including for health data, which DeskFlow processes only on your device.
• Transfers abroad (Art. 9): data handled by Google and RevenueCat is transferred to the United States based on the appropriate safeguards provided for in the law or, where required, your explicit consent.
• Your rights (Art. 11): to learn whether your data is processed and request information about it; to learn the purpose of processing and whether it's used accordingly; to know the third parties in Turkey or abroad to whom it's transferred; to request its correction, deletion or destruction, and that these be notified to third parties; to object to results against you arising exclusively from automated analysis; and to claim compensation for damages.
• Applications: in writing by email to kuantis.dev@gmail.com or by other methods allowed by the Communiqué on the Procedures and Principles of Application to the Data Controller. We answer free of charge within 30 days at the latest. You can also complain to the Personal Data Protection Authority.

Russia

Under Federal Law No. 152-FZ “On Personal Data”, the information you enter in DeskFlow is recorded and stored on your own device; we don't collect it or store it in databases outside Russia. Google services such as ads and Google Play payments may be limited or unavailable in Russia; where they do work, the data they handle is processed by Google and RevenueCat outside Russia as described in sections 4 and 8. You have the right to obtain information about the processing of your data; to demand its clarification, blocking or destruction if it's incomplete, outdated, inaccurate, unlawfully obtained or unnecessary; to withdraw your consent; and to appeal to Roskomnadzor or the courts.

Australia and New Zealand

Australia: to the extent the Privacy Act 1988 and the Australian Privacy Principles apply to us, you can ask to access and correct your personal information. Data handled by Google and RevenueCat may be disclosed overseas, mainly to the United States. Contact us first with any complaint; if you're not satisfied, you can complain to the Office of the Australian Information Commissioner.

New Zealand: under the Privacy Act 2020, you can ask to access and correct your personal information. Data handled by Google and RevenueCat may be disclosed overseas, mainly to the United States, with comparable safeguards. You can complain to the Office of the Privacy Commissioner.

South Africa

Under the Protection of Personal Information Act (POPIA), Kuantis is the responsible party and Information Officer (kuantis.dev@gmail.com). Health data is special personal information, which DeskFlow processes only on your device with your consent. You can ask to access your information (also under PAIA), to correct or delete it, to object to its processing and not to be subject to decisions based solely on automated processing. Data handled by Google and RevenueCat may be transferred outside South Africa under the conditions of section 72 of POPIA. You can complain to the Information Regulator.

Saudi Arabia and United Arab Emirates

Saudi Arabia: under the Personal Data Protection Law (Royal Decree No. M/19 of 1443H, as amended) and its regulations, you have the right to be informed, to access your data and get a copy, to request its correction, and to request its destruction when it's no longer needed. Data handled by Google and RevenueCat may be transferred outside the Kingdom under the conditions of the law. You can complain to the Saudi Data & AI Authority (SDAIA).

United Arab Emirates: under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and the DIFC or ADGM data protection laws where they apply, you have the right to obtain information, to data portability, to correction or erasure, to restrict or stop processing, and to object to decisions based solely on automated processing. Data handled by Google and RevenueCat may be transferred outside the UAE under the conditions of the law. You can complain to the UAE Data Office or the competent free-zone authority.

China

DeskFlow is distributed only through Google Play, which isn't available in mainland China, so we don't offer DeskFlow there. If you use it in mainland China anyway, the Personal Information Protection Law (PIPL) gives you the right to know about and decide on the processing of your information; to restrict or refuse it; to access and copy your information; to portability; to correction and deletion; to an explanation of our processing rules; and to withdraw consent. Health information is sensitive personal information; DeskFlow processes it only on your device, with the separate consent you give on Health Connect's permission screen. Data handled by Google and RevenueCat is transferred outside mainland China, mainly to the United States.

Other countries

If you live elsewhere, for example in a country with laws such as Singapore's PDPA, Thailand's PDPA, the Philippines' Data Privacy Act, Malaysia's PDPA, Vietnam's personal data protection law, Israel's Privacy Protection Law, Hong Kong's PDPO or Taiwan's PDPA, you have the rights your local law gives you, and this policy applies to you in the same way. Write to us at kuantis.dev@gmail.com.

13. Children

DeskFlow is designed for working adults; on Google Play, its target audience is 18 and over. It isn't directed to children, and its ads aren't child-directed. In line with the U.S. Children's Online Privacy Protection Act (COPPA), we don't knowingly collect personal information from children under 13, nor from children under the higher age set by local law (for example, 16 in some EEA countries, 14 in South Korea, or 18 for consent purposes in India).

If you're a parent or guardian and believe your child has used DeskFlow, contact us at kuantis.dev@gmail.com: we'll help you and delete any purchase record we hold. You can also delete the app's data or uninstall the app (how) and reset the phone's advertising ID.

14. This website

This website is a static site. It doesn't set cookies, doesn't use analytics or tracking, doesn't load fonts, scripts, maps or videos from other websites, and has no forms. Because it doesn't track visitors, Do Not Track and Global Privacy Control signals require no further action here.

It's hosted on GitHub Pages. Like any web host, GitHub receives your IP address when you visit and logs it for security purposes (see About GitHub Pages and the GitHub General Privacy Statement). We don't receive these logs. Links to other websites are governed by their own policies.

15. Changes

We'll update this policy when the app, our partners or the law change. We'll update the “Last updated” date at the top and, for material changes, post a notice in the app or on this website before they take effect, and ask for your consent again where the law requires it. Previous versions are available on request.

16. Contact and complaints

• Email: kuantis.dev@gmail.com
• EU and UK representatives: none appointed (Art. 27(2) GDPR and UK GDPR). Users in the EU and the UK can contact us directly by email.

We'll answer as soon as possible and within the deadline set by the law that applies to you. You also have the right to complain to a data protection authority, in particular where you live or work. For example:

• EEA authorities
• United Kingdom (ICO)
• Switzerland (FDPIC)
• California (CPPA)
• Brazil (ANPD)
• Canada (OPC)
• Quebec (CAI)
• Argentina (AAIP)
• Colombia (SIC)
• Japan (PPC)
• South Korea (PIPC)
• Turkey (KVKK)
• Australia (OAIC)
• New Zealand (OPC)
• South Africa (Information Regulator)
• Saudi Arabia (SDAIA)

Other authorities are named in section 12.

Translations: this policy is available in English and español. If the versions differ, the English version prevails, unless your local law requires otherwise.