Data Safety Form
This page summarizes Tefteri's data practices using Google Play's data-type categories. It supplements the Privacy Policy anddata-protection notice. It is not confirmation of the answers currently submitted in Play Console. Google Play's single declaration must cover all versions currently distributed through Play, including any version with different collection or user choices.
1. Collection, Sharing, and Security
Tefteri collects data. Collection for Play disclosure means transmission off the device, including by SDKs. Notebook content processed only locally is not collected through cloud sync unless you connect Google. Statistics, diagnostics, and update checks can still communicate online without sign-in.
External providers receive data to operate authentication, synchronization, diagnostics, analytics hosting, and update delivery. Play's definition of sharing excludes qualifying service-provider processing on our behalf and qualifying user-initiated transfers. A “not shared” declaration therefore does not mean providers never receive data. Tefteri does not sell data or use it for advertising. The final sharing answers depend on each provider's actual role and the applicable Play exceptions.
Firebase encrypts transmitted service data using HTTPS; the configured first-party analytics endpoint also uses HTTPS. An app-wide “all data encrypted in transit” answer requires verification of every transmission path, including SDKs and update delivery in distributed builds. This statement does not promise end-to-end notebook encryption.
Users can delete entries and signed-in accounts in the App, or request assistance through the Account Deletion page. Retention and deletion limits are explained below.
2. Data Types and Choices
The matrix describes the reviewed app behavior. “Optional” means the user can choose whether that collection occurs while retaining local notebook use. For a Play data type collected through several paths, its declaration must reflect all paths: a statistics opt-out does not make automatic SDK collection optional. Required/optional answers must also cover all currently distributed versions.
| Play data type | Collection and choice | Purposes |
|---|---|---|
| Personal info → Email address | Collected when you choose Google connection. Optional for local notebook use; needed for the connected account. | Account management; app functionality; developer communications for account notices; fraud prevention, security, and compliance where used for account protection. |
| Personal info → User IDs | Google/Firebase account identifiers are processed for connected accounts and owner-scoped sync. Optional Google connection. | Account management; app functionality; fraud prevention, security, and compliance. |
| Personal info → Name | Basic profile name may be supplied through Google sign-in. Optional Google connection. | Account management; app functionality for account/profile display. |
| App activity → Other user-generated content | Notes, categories, reminder details and dated entries are collected when synchronized. Local-only content stays on the device. Cloud sync is optional. | App functionality. |
| App activity → App interactions | Optional statistics send fixed operation counters and app version. Automatic Firebase Sessions foreground/session activity is separate and has no in-app opt-out; this data type cannot be treated as wholly optional because statistics can be disabled. | Analytics; SDK reliability measurement where applicable. |
| App info and performance → Crash logs | In Android builds with one-time report approval, technical reports are captured locally and uploaded only when the user approves the pending batch. Declining deletes the batch. Older distributed builds may upload automatically; the Play declaration must cover those builds too. | Analytics for failure diagnosis and reliability improvement. |
| App info and performance → Diagnostics | Technical diagnostic reports and reliability information, including applicable SDK data. Statistics-derived failure counters can be disabled. Diagnostic uploads require separate batch approval in the new Android builds; older distributed builds may upload automatically. | Analytics; app functionality where technical data supports service operation. |
| Device or other IDs → Device or other IDs | Crashlytics/installation identifiers support Firebase services independently of Google connection and the statistics switch. The new Android report flow offers a separate batch-upload choice; this does not disable every Firebase installation or configuration service. Older versions may upload automatically and may also send a persistent analytics identifier. | App functionality; analytics for crash/reliability measurement; fraud prevention, security, and compliance where applicable. |
Account profile photos may also be supplied by Google. Their handling and the applicable Photos disclosure must be checked against the shipped authentication/profile path; this page does not claim that all photos are uncollected. Sync ownership, timestamps, deletion markers, and operation receipts support app functionality and must be accounted for with the associated account/content types rather than treated as product statistics.
Tefteri is a general-purpose notebook, not a healthcare service. We do not request health information or other special-category personal data. Entering, synchronizing, or sending us sensitive personal data is prohibited, including special-category data and criminal-conviction/offence data. The App does not inspect or classify notes; if you believe you uploaded sensitive information, delete it and contact us for assistance. This prohibition does not technically prevent uploads or automatically settle Play's classification of foreseeable sensitive uploads.
3. Statistics and SDK Processing
Contract-3 aggregate-statistics versions send only protocol version 3, a fixed counter name and app version toadmin.pavlossta.com. Counters cover creation, editing, deletion and conversion of entries; synchronization outcomes and fixed failure categories; reminder scheduling and reconciliation; notification permission choices; sign-in, sign-out, export, device reset and account deletion outcomes; and caught root-interface errors. The backend stores daily totals, not an individual event history for these submissions. Statistics default on; you can disable them in Profile on each device. Explicit opt-outs are preserved. There is no durable analytics queue; an in-flight request may finish after opt-out. In Android builds implementing the current statistics notice, no measurement is submitted until onboarding is complete and the notice has been acknowledged. The welcome screen shows “Στέλνονται συνολικά στατιστικά χρήσης. Απενεργοποίηση στις Ρυθμίσεις.” Existing users see a one-time notice before collection. Dismissing that notice leaves statistics paused; acknowledgement preserves any saved opt-out and is not consent for processing that legally requires consent. Totals are not correlated with account records, sync activity, crash reports or identifiable request logs.
These payloads contain no analytics/account identifier, notebook content, screen path, engagement duration, country, device profile, or raw error detail. This limitation concerns the counter payload, not all SDK traffic. Older distributed app versions and separately operating services must be included in the Play declaration. Aggregate storage does not itself make collection ephemeral: stored totals are retained beyond the immediate request.
In Android builds implementing one-time report approval, automatic crash-report uploads are disabled. The SDK can capture and store technical reports locally before approval. After reopening the App, you may be asked to send the pending batch through Google Firebase. “Αποστολή” approves only that batch; “Όχι” deletes it, and dismissing sends and deletes nothing. Future batches require a new choice. Reports can include error traces, device/operating-system information and installation/session identifiers; they are separate from aggregate statistics. Custom handled reports remove raw messages and use allowlisted diagnostic values; automatic SDK reports have their own technical content. The statistics switch does not control this upload choice. Older distributed builds may still upload reports automatically. The new startup upload gate requires a new Android build and cannot be delivered solely through a JavaScript update. Its transitive Firebase sessions/installations libraries can process session metrics and identifiers. Remote Config processes installation and technical information, including country/language codes, time zone, and version details. Applicable Remote Config rollout metadata can also appear in crash reports. The actual shipped SDK versions and configuration determine the full disclosure.
4. Permissions, Location, and Chosen Sharing
Tefteri does not request precise device location, contact-list access, microphone access, SMS access, or physical-activity sensor access for its notebook features. It does not provide financial, audio/video capture, or advertising features. Free-text notebook content and Google profile data require their own assessment; lack of a permission does not establish that every related data type is uncollected.
Providers receive network information such as IP addresses, and Remote Config can process country information. Whether any resulting location information falls within Play's approximate-location category depends on its actual use and retention. No location permission is not proof of no location-related processing.
Reminders use local device notifications; Tefteri does not collect an Expo push token. Export creates a JSON notebook copy and opens the system share interface. The calendar action opens an event with title and date/time in the calendar interface, without copying additional note details or reading your calendar history. If you save/share a copy, the chosen provider or recipient handles it independently. These transfers must be assessed under Play's user-initiated-transfer rules.
5. Retention and Deletion
- Notebook: local content remains until deleted or applicable app/notebook data is cleared; sign-out alone does not erase it. Cloud content remains until deleted or the account is deleted. Entry deletion propagates after successful sync; minimal deletion markers/receipts can remain until account deletion.
- Account deletion: after verification, successful in-app deletion removes the account notebook and sync metadata from live Firestore, deletes the Firebase account, and clears readable records belonging to that notebook on the current device. Unreadable recovery data with unknown ownership may remain; Android app-storage clearing removes remaining installation data. Failures can require retry or assistance. This does not delete your Google account.
- Statistics: daily totals and historical raw Tefteri events are scheduled for removal from the live analytics database after 12 calendar months with daily cleanup. Provider logs/backups have separate lifecycles.
- Diagnostics and identifiers: Crashlytics reports, installation identifiers, and provider logs have separate retention and deletion processes. Account deletion does not automatically remove every diagnostic record or installation identifier. See the Privacy Policy for provider retention details.
- Requests: emailed deletion requests normally finish within 1–2 weeks after ownership verification; delays or exceptions are explained. Privacy requests receive a response without undue delay and normally within one month. A permitted extension is explained within that month. This response deadline is not a promise that every backup or independent copy disappears within 30 days.
- Independent copies: other-device notebooks, exports, saved calendar events, and necessary legal records may remain separately. Retained backups must not restore erased content without reapplying deletions.
6. Further Information and Contact
The Privacy Policy explains service providers, international transfers, correspondence retention, and rights in detail. Provider processing and all distributed app versions must be reassessed when SDKs, features, collection purposes, or user controls change. Play disclosures do not replace legally required consent or the App's privacy obligations.
Pavlos Stathopoulos, Athens, Greece
Privacy and deletion requests:privacy@pavlossta.com.