FlosForge Fast — privacy policy

FlosForge Fast has no internet permission and no network code, so your fasts, drinks, symptoms and body readings cannot leave the phone. They are kept in an encrypted database, excluded from cloud backups and device transfers. There is no account, no analytics and no advertising.

What FlosForge Fast collects about you

Nothing. There is no account, no telemetry, no analytics, no crash reporting and no identifier of any kind. The app has no server of its own to send anything to, and it does not phone home to check for updates — Google Play delivers new versions.

What it stores, and where

An encrypted database on the phone: Your fasts, drinks, symptom check-ins and body readings, in a database encrypted with SQLCipher. Its key is random, and is itself protected by a key held in the Android Keystore.
Your settings: Protocol, goals, reminders, units and appearance, in the app’s private storage. If you set an app lock, only a salted hash of the PIN is kept, never the PIN itself.
Left out of backups: Every part of the app’s storage is excluded from Google’s cloud backup and from device-to-device transfer. A new phone starts empty unless you move a CSV across yourself.

Everything it can connect to

The app has no internet permission. Two things reach outside it, and both only when you turn them on or tap them.

Health Connect, if you turn it on: Off until you enable it. The app then reads water entries other apps have logged, only while you use it. It never writes to Health Connect and does not copy those records into its own database. Health Connect is part of Android and keeps its data on the phone.
Links you tap: The developer link opens flosforge.eu in your browser, and the Health Connect prompt opens Google Play. The app itself opens no connection.

What never leaves your phone

Nothing you log is transmitted: not a fast, not a symptom, not a weight or a glucose reading.
No analytics, no crash reporting, no advertising, no account.
No third-party SDKs. The dependency list is AndroidX, Room, SQLCipher and the Health Connect client, and the internet permission is stripped from the build even if a library asks for it.
Notifications show nothing on the lock screen beyond the fact that there is one.

Safeguards

Encrypted at rest: The database is encrypted with a key that never leaves the Android Keystore, so a copy of the file on its own is unreadable.
App lock: A 4 to 8 digit PIN with fingerprint or face unlock, a timed lockout after repeated wrong guesses, and the app hidden from screenshots and the recent-apps screen while the lock is on.
Deleting is real: Delete all data removes every record from the database. A forgotten PIN can only be reset by erasing the app’s data, because there is no copy anywhere else to recover it from.

Your rights, and who to ask

Because the app holds nothing about you, there is nothing for the controller to access, correct or erase on your behalf: everything it knows is in files on your own phone, under your own control. Uninstalling the app deletes its database and settings from the phone. Because the data is excluded from backups, nothing is left anywhere else. A CSV you exported is yours to delete. For anything else, write to hello@flosforge.eu. The site-wide privacy policy covers this website, your rights under the GDPR, and the supervisory authority you can complain to.

Changes

This statement is checked against each release. If a version changes what the app stores or what it can connect to, the version and date at the top change with it.