Privacy Policy - TODO Gamificado

1. Application Identification and Purpose

TODO Gamificado is a personal task management and productivity application enhanced with gamification mechanics developed by Vítor Alcântara de Almeida. The application is designed to help users organize daily tasks, subtasks, deadlines, and habits by transforming task completions into points that can be redeemed for leisure tickets.

Privacy Commitment: Your task data belongs exclusively to you. TODO Gamificado embraces a local-first architecture, never sells your personal data, never tracks users for advertising purposes, and maintains stringent security and transparency standards.

2. Local Data Storage (Local-First Architecture)

By default, TODO Gamificado stores all user information directly within your device's internal storage (utilizing a secure local NoSQL Hive database):

Tasks and Subtasks: Titles, descriptions, priorities, due dates, assigned points, and completion status.
User Statistics and Rewards: Points balance, point history, configured custom rewards, and redemption history.
User Preferences: Display theme (Light, Deep Dark, System), text scale, and sound preferences.

In Guest Mode (without login), the app is fully functional 100% offline without creating an account or sending any data to external servers. When you voluntarily sign in with your Google Account, cloud synchronization with Firebase Cloud Firestore is enabled to keep your tasks and progress updated across devices, while maintaining full offline capability locally.

3. Integration with Google APIs and Services

TODO Gamificado provides optional cloud synchronization and calendar integration powered by Google Services. Users can choose to use the app in Guest Mode (without login) or connect their Google Account to unlock real-time multi-device sync and calendar deadline reminders.

When you choose to sign in with your Google Account, the following scopes and data are accessed:

Google Sign-In (Authentication & Profile Identification):
Scope: email.
Purpose: Authenticates the user session with Firebase Authentication, uniquely identifies the user's private data partition, and enables atomic real-time cloud sync through Firebase Cloud Firestore. The application does not request and does not use any Google Drive access permissions.
Google Calendar (Task Deadline Synchronization):
Scope: https://www.googleapis.com/auth/calendar.events.owned (Events created by the app).
Purpose: Creates, updates, and deletes calendar events on the user's primary Google Calendar corresponding to tasks with scheduled due dates and times.
Limitation Guarantee: The application only accesses and modifies calendar events that were created by the app itself. It never reads personal events created by the user or other applications, and never shares calendar entries with third parties.

Google API Services User Data Policy Compliance (Limited Use Disclosure):

TODO Gamificado's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Data Protection Mechanisms and Security Measures for Sensitive Data

The security, privacy, and confidentiality of user data and information accessed through Google APIs are fundamental to TODO Gamificado. We maintain strict organizational, technical, and architectural safeguards to protect your personal information against unauthorized access, exposure, alteration, or destruction:

Security Procedures and Confidentiality Disclosure:
Security procedures are in place to protect the confidentiality of your data. We ensure your information is guarded using multi-layered defenses across local devices and cloud infrastructure.

Encryption in Transit: We use encryption to protect your information. All network communication between the client application, Firebase backend infrastructure, and Google APIs is transmitted strictly through encrypted channels using industry-standard HTTPS / TLS (Transport Layer Security 1.2 and TLS 1.3) protocols with robust 256-bit encryption ciphers, preventing interception or tampering during transmission.
Encryption at Rest: All cloud data synchronized through Firebase Cloud Firestore is automatically encrypted at rest using high-grade AES-256 encryption. Encryption keys are managed securely by Google Cloud security infrastructure.
Operating System Sandbox Isolation: On mobile devices, local data (Hive NoSQL database) is stored exclusively within the private, isolated application sandbox allocated by the operating system (Android and iOS). Other applications installed on the device cannot access or read TODO Gamificado databases.
Protection of OAuth Tokens and Credentials: Sensitive credentials, including OAuth access and refresh tokens obtained via Google Sign-In, are managed through platform-native secure hardware-backed storage (Android Keystore / iOS Keychain). Tokens are never written to plain-text log files, diagnostic reports, or unsecured cookies, and are never sent to third-party tracking services.
Granular Access Control and Least Privilege: Access to cloud data is governed by atomic Firebase Firestore Security Rules that enforce strict user-level ownership. A user can only read and write documents matching their unique authenticated Google User ID (`request.auth.uid == userId`). No third party, developer, or administrative human has access to your personal tasks, subtasks, or calendar records.
Sensitive Google Calendar API Safeguards: Interactions with the Google Calendar API are restricted to the minimum required scope (`calendar.events.owned`). The application only interacts with events that it creates for task deadlines. Calendar data is never queried for telemetry, never exported to analytics, and never shared externally.

5. What We DO NOT Do With Your Google User Data

No Data Sales or Commercialization: We never sell, rent, lease, or monetize your personal data or any information obtained through Google APIs.
No Third-Party Sharing: We do not share Google user data with advertisers, third-party marketing brokers, or data analytics intermediaries.
No Advertising: Google API data is never used to serve, personalize, or target advertisements.
No AI/ML Model Training: Your tasks, notes, checklists, descriptions, and calendar events are never used to train, develop, or improve generalized Artificial Intelligence (AI) or Machine Learning (ML) models or LLMs.

6. Data Retention, Deletion, and Access Revocation

You maintain complete control over your data at all times:

Local Data Deletion: You can delete any task or clear the application storage directly on your device. Uninstalling the app permanently purges all locally stored data.
Google Account Disconnection: In TODO Gamificado Settings, you can tap "Sign Out" to immediately disconnect your Google Account and cease cloud synchronization on that device.
Cloud Data Deletion: When you disconnect or request deletion, cloud synchronization stops immediately. You can request complete cloud data purge at any time by contacting support.
Revoking Access via Google: You can review and revoke TODO Gamificado's access to your Google Account at any time via Google's official permissions dashboard:
https://myaccount.google.com/permissions

7. Contact and Developer Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact the developer directly:

Developer: Vítor Alcântara de Almeida
Support & Privacy Email: vit.alcantara@gmail.com
Location: Brazil

This Privacy Policy may be updated periodically to reflect application enhancements. Any changes will always be published with an updated revision date at the top of this page.