1. Who we are
Oftaro (the “App”) is a habit tracker developed and published by Tendanto Ltd, a private limited company registered in England & Wales (company no. 17481182), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“we”, “us”). Tendanto Ltd is the data controller for this policy.
This policy covers the Oftaro app for Android. It is version 1.5.
2. In short
Oftaro has no user accounts; we never ask for your name, email or phone number.
Your habits stay on your device. Oftaro has no servers of ours: your habits, their schedules and your history are never sent to us. If you turn on Google Drive backup, a copy goes to your own Google Drive, which only you can see.
Oftaro is free, with every feature. Free users see one small ad for another of our own apps above the tab bar. Oftaro Pro removes it: monthly or yearly through Google Play (new subscribers may get a free trial), or a one-time purchase.
The only ads are for our own apps, served by our own small ad server, which receives no information about you (see section 7a). The App also sends anonymous usage counts to our own server, with a random installation ID that is not linked to you (see section 7b); you can reset the ID at any time. No third-party ad networks, analytics or tracking tools. We do not sell your data or share it for advertising.
3. Information stored on your device
Your habits (names, schedules, targets, priorities, colours and reminder times), the days you marked them done or skipped, and your settings are kept in the App’s storage on your device. Uninstalling the App deletes them.
If Android’s automatic backup is on, the operating system may also include this data in the backup in your own Google account (Settings › Google › Backup); we have no access to it. With Oftaro’s own Google Drive backup on as well, your habits can therefore be in your Google account twice, in two separate places; you can turn either off on its own.
4. Export and restore
You can export your habits and history as a CSV or JSON file at any time, including from the purchase screen. The App hands the file to Android’s share sheet, so you choose where it goes (for example Files, Google Drive or email); it is not sent to us.
You can restore a JSON export into the App, for example on a new phone. You can also delete all of the App’s data on your device from Settings.
5. Google Drive backup (optional)
Drive backup is off until you turn it on in Settings. When you connect it, Google asks for your permission to let Oftaro use its own hidden app folder in your Google Drive (the “drive.appdata” permission). The App cannot see or change any other file in your Drive.
While it is on, the App saves a copy of your habits and history (the same content as the JSON export) to that folder by itself: shortly after you make changes (at most every ten minutes), at least about once a day when you use it, and when you tap “Back up now”. You can restore it on any phone where you sign in with the same Google account.
The backup travels directly from your device to Google over an encrypted connection. It is stored by Google under your account and governed by Google’s privacy policy (policies.google.com/privacy). We never receive it, and we never see your Google account name or email address.
You can stop backups at any time in Settings; this also withdraws the App’s permission. To delete the backup itself, remove Oftaro’s app data in Google Drive (drive.google.com › Settings › Manage apps › Oftaro › Delete hidden app data), or remove the App’s access at myaccount.google.com/permissions.
6. Reminders and the home-screen widget
Reminders are local notifications scheduled on your device. The home-screen widget reads today’s habits from the App’s storage on your device. Nothing is sent to a server for either.
7. Oftaro Pro, free trial and purchase (Google Play and RevenueCat)
Oftaro Pro is optional. Payment is handled by Google Play; we never see your card details. If a subscription comes with a free trial, Google Play decides who is eligible and charges you when it ends, unless you cancel in Google Play before then. The App reminds you two days before a trial ends, with a notification scheduled on your device.
To check your purchase in the App we use RevenueCat, Inc. (USA), with a random anonymous app user ID. RevenueCat receives purchase and subscription information from Google Play and processes it on our behalf. It does not receive your habits. Details: revenuecat.com/privacy
7a. Ads for our own apps
If you do not have Oftaro Pro, the App asks our ad server (api.tendanto.com, run by us) for one ad for another of our apps, when you open it and from time to time while the ad is on screen. The request contains only the App’s name, your interface language, your platform (Android) and, when it changes the ad, the ad being replaced. It carries no cookie, no advertising ID and no identifier for you or your device.
When an ad is shown or tapped, the App sends a one-day token so we can count views and taps; the server keeps only daily totals per ad. These view and tap counts also carry the random installation ID described in section 7b; the request for the ad itself never does. Like any web server, it sees the IP address of the request to deliver the answer; we do not store it with the ad data or use it to identify you. With Oftaro Pro the App makes no ad requests at all.
7b. Anonymous usage counts
To see how Oftaro is used and improve it, the App sends counts of events to our server (api.tendanto.com, run by us), for example “the app was opened”, “a habit was added”, “an onboarding page was reached”, “the purchase screen was opened” or “a purchase was made”, with the App’s version, your platform (Android) and, once a day, your interface language.
A request carries no advertising ID, no device hardware ID and no cookie, and never your habits, their names, notes or anything you type. On first launch the App creates a random installation ID that stays on your device (it is left out of Android backups and is deleted with the App). It is not linked to your account, advertising ID or device hardware. The App sends it with the usage counts and with the view and tap counts of the ad (section 7a). Our server never stores the ID itself, only an irreversible hash of it: with usage events for 48 hours, and as a daily summary (first day seen, days active, the day Pro started) for 35 days, to understand whether people come back. The server also keeps daily totals per event, platform and version. Like any web server it sees the IP address of the request to answer it; we do not store it with the counts or use it to identify you.
Usage counts are part of how the App works and cannot be turned off; they never include your habits or anything you type. In Settings › Data & backup, “Reset analytics ID” replaces the ID with a new one, which cuts the link to what our server kept for the old one. We rely on our legitimate interest in understanding and improving the App. As we cannot tell who an ID belongs to, the reset is the practical way to delete “your” data; you can also write to us (section 15). Uninstalling the App deletes the ID.
8. Permissions
The App uses notifications (reminders), Google Play billing (purchases) and internet access (only to reach Google Play and RevenueCat for purchases, our ad server for the ad shown to free users, our server for the anonymous usage counts, and Google Drive if you turn on backups).
The App never asks for your location, your contacts, the camera or the microphone.
9. Who receives data
Google Play: your purchase, for payment and refunds.
RevenueCat (our processor): an anonymous user ID and your purchase information.
Google Drive (only if you turn on backups): a copy of your habits and history, stored in your own Google account; we have no access to it.
Our ad server (free users only): the App’s name, your language and platform, as described in section 7a.
Our server: the anonymous usage counts and the hashed installation ID described in section 7b. We do not sell your data and do not share it for advertising.
10. International transfers
Google and RevenueCat may process purchase data, and Google may store Drive backups, in other countries, including the United States. Transfers from the UK and the EU rely on safeguards such as the standard contractual clauses those companies use.
11. Children
The App is not directed at children under 13, and we do not knowingly collect data from children.
12. If you email us
If you contact us for support, we use your email address and message only to answer your request, on the basis of our legitimate interest in replying to you. We keep the correspondence for up to two years after your request is resolved, then delete it.
13. Your rights
Under UK data protection law (UK GDPR) you have the rights of access, rectification, erasure, restriction, objection and portability. Users in the EU have the same rights under the GDPR and may complain to the supervisory authority in their country.
Your habits are on your device, and in your own Google Drive if you turn on backups: you can export or delete them yourself at any time. For purchase records held by RevenueCat, email support@tendanto.com. We will respond within one month.
You can complain to the UK Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to help first: support@tendanto.com.
14. Changes
If we add a feature that changes how data is processed, we will update this policy before that version is released and show the new date at the top of this page.
15. Contact us
Questions about this policy or your data? Email support@tendanto.com or write to us at Tendanto Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.