Privacy policy

1 · Who we are

Routine Randomizer is published by Lustig Fairchild Ltd., a company registered in Bulgaria, in the European Union, with its seat and address of management at 14 Aleksandar Malinov str., apt. 7, Varna 9000, Bulgaria.

It is registered in the Commercial Register of the Registry Agency, Republic of Bulgaria under 208942846.

For the purposes of the General Data Protection Regulation we are the controller for the limited processing this policy describes. Being established in the European Union, we are not required to appoint a representative under Article 27, and the nature and scale of the processing do not require a Data Protection Officer under Article 37. Neither appointment is made, and this policy says so rather than leaving you to infer it.

2 · What this policy covers

This policy covers Routine Randomizer on Android, as distributed through Google Play.

The App Store edition of Routine Randomizer is a separate edition with its own policy; both are listed at /routine-randomizer/privacy/. The two editions do not sync: nothing in one reaches the other by itself.

3 · What the app keeps on the device

Everything the app keeps stays in its own storage on the device:

• Your lists — each list's name, its note and its colours; how many it picks at a time, whether its picks are weighted, and whether it is a favourite; its place among your lists; and when it was made, changed and, if you deleted it, deleted.
• Their items — each item's name, its note, its weight, its colours and its place in the list; whether it is skipped for today; and when it was made, changed and, if you deleted it, deleted.
• The draws — for a list set to no repeats, which items have had their turn in the current round; and for every list, its last fifty draws: when, what came out, and what you checked off.
• Your settings — how your lists are sorted, whether only favourites show, and the text size — and a few counts kept with them, of how often the app has been opened and used and when it last asked for a rating, which decide when, rarely, to ask for one and when Rate on Google Play and Send feedback appear.
• Whether the unlock is bought, as Google Play last confirmed it, so that it works offline; and the version Google Play last offered as an update, so that an update you declined is not offered again.

A list's items are whatever you type or scan — often people's names, in a family or a class. The app reads them only to show them and to draw from them; it does not analyse or classify them. It never asks anyone's name, e-mail address or age: in the United States it asks Google Play instead, as section 8 describes. We never see any of it. It is not sent to us, and there is no code in the app that could send it. The app keeps no identifier of you or of your device.

A list or an item you delete waits, marked as deleted, in All data, in Settings › Data, until you restore it or remove it for good; removing a list removes its items and its draws with it. Erase all my data…, beside it, removes every list, item and draw, the ones marked as deleted included, once you have typed a word to confirm it; your settings are kept, and so is the unlock, which belongs to your Google account. Uninstalling the app removes everything it keeps.

4 · Scanning a printed list

Scan a printed list, beside a list's items, opens Google's document scanner. It runs inside Google Play services on your device and uses the camera itself, so the app has no camera permission. Where the scanner is not available, Android's photo picker lets you choose one picture instead, and the app sees only that one.

The app reads the picture's text on the device, with Google's text recognition built into the app, and shows you the rows it read before anything is added. It never uploads the picture or its text, and keeps nothing of them but the rows you add. The page the scanner hands back sits in the app's temporary storage, which Android clears when it needs the room, and which goes with the app.

Google's libraries behind the scan report their own working to Google, as section 7 says.

5 · What Android's backup and transfer include

If backup is turned on for your device, Android includes your lists — the ones marked as deleted too — with their items and draws, and your settings with what is kept with them, in the backup it makes to your Google Account, and the same is what moves when you transfer to a new phone. Never included: whether the unlock is bought, so a new phone asks Google Play again; the update last offered; a scanned page; and the note in section 8.

That backup is made by the operating system, stored by Google under your Google Account, and restored by Android when you set up a device. We do not receive it, cannot read it and cannot delete it. Google provides it to you, under your agreement with Google — it is not something we do with your data.

The practical consequences, stated rather than implied:

• Your lists leave the device in that backup only if backup is on, protected as Android protects the rest of your backup.
• Erase all my data removes them from the device at once, but not from a backup Android has already made: that copy stays until Android next backs the app up.
• Uninstalling the app removes everything from the device. A copy can remain in your backup until Android replaces it or Google deletes it; you manage it in your device's backup settings.
• The only controls over this are Android's and Google's. The app has no switch of its own for it.

6 · Permissions

The app asks for no permission while you use it. Android grants three at installation, without a prompt: the Google Play billing service, full network access and view network connections. They belong to Google's libraries inside the app — see section 7. The app's own code opens no connection.

The app asks for nothing else: no camera (the scanner is Google's), no microphone, no location, no contacts, no calendar, no notifications, and no access to your photos or files beyond the one picture you choose.

7 · Google's parts of the app

Five features of the app are Google's own. It is Google that collects what each one needs, under its own privacy policy. The app itself collects nothing, and none of it reaches us; the one exception, the record of a sale, is in section 12.

• The lifetime unlock. Buying it opens Google Play's own purchase screen. Each time you open or return to the app, it asks Google Play whether your account owns the unlock, and Restore purchase asks again at once. The app reads the answer on the device and unlocks what you bought; if Google Play later says the unlock is no longer on the account, the app returns to the free limits. Google Play's billing library in the app also reports to Google how its own calls fare — whether they succeed, and any trouble reaching Google Play — which Google uses to improve the library and to support errors. We receive none of it, and cannot switch it off.
• The scan. When you scan, Google's document scanner and its text recognition send Google, in Google's words, information about the device and the app, identifiers for the installation that are “not intended to uniquely identify a user or physical device”, performance figures such as how long a recognition took, the feature's settings and error codes, for diagnostics and usage analytics. Google states that this is encrypted in transit and not passed to third parties. It is not the picture, and not its text.
• The update check. When you open the app, it asks Google Play whether a newer version is available. For this, Google collects information about your device, the app's version and the parts of it that are installed. Google states that this data is encrypted in transit, is not transferred to third parties, and is deleted after a fixed retention period. If there is an update, Google Play may offer it on its own sheet, once for each version, which you can decline; one you accept is installed when you next leave the app.
• The rating card. Rarely — at most once for each version, after a draw you made, and only once the app has been opened and used a number of times — the app asks Google Play to show its rating card. Google Play decides whether it appears. Rate on Google Play, in Settings, opens the app's page on Google Play instead. If you rate the app or write a review, Google collects them and publishes them on the app's Google Play listing, as with any review. Google states that this data is encrypted in transit, and you can delete your review in Google Play at any time. The app is not told whether the card appeared or what you chose.
• The age question, in the United States only — see section 8.

The app's Data safety section on Google Play lists this data, because Google Play asks every app to include what the Google libraries it uses collect. It is collected by Google, for the purposes above, under Google's privacy policy; section 11 says in what capacity.

8 · Age signals: the United States only

Some US states require an app to rely on the age information its app store holds about the person using it. Routine Randomizer does so in the simplest way it can.

The app first asks Google Play, on the device, which country your Google Play account is in. Only if it is the United States, it then asks Google Play, once, for the age information Google Play holds for your account: an age range and how it was established, and — for an account a parent supervises — the parent's approvals and a code Google Play gives that installation. Google Play may first ask you, on its own screen, whether to share it.

The answer is read on the device and dropped at once. It is not stored, not backed up and not sent anywhere, and it changes nothing: the app is the same for everyone. All the app keeps is a note that this step has been taken — the question asked, or the account found to be outside the United States — which no backup carries, so a new device takes it again; if Google Play cannot answer, the app asks the next time it is opened. Outside the United States the question is never put.

9 · Where the app's links go

A few rows in Settings hand you over to somewhere else, and only when you tap them:

• Privacy policy opens this page of our website in your browser; the website's own privacy notice, at /privacy/, covers the visit.
• Send feedback — there once the app has been opened a few times — opens your email app with our support address and the app's name as the subject.
• Rate on Google Play and Recommended app open an app's page on Google Play.
• Share this app hands the app's Google Play address, as a line of text, to the app you choose.
• Language opens Android's own setting for the app's language.

Those sites' and apps' own terms and privacy policies apply there. Nothing is sent to us, except an email you choose to send.

10 · What we never do

The app collects no personal data and sends nothing to us. We run no servers of our own. We do not sell, rent or trade anything about you. There is no profiling and no automated decision-making. The app does not read the advertising ID and is not enrolled in any attribution or measurement framework.

That is not the same statement as “your data never leaves your device”, which would be untrue here: section 5 says what does leave it, section 7 what Google collects, and section 12 the one record that reaches us.

11 · The role of Google

Google is not our processor: it handles your data under its own terms, not on our instructions — even where, as below, it sells to you on our behalf.

• As the distributor of the app through Google Play, Google has its own relationship with you, under the Google Play terms of service and its own privacy policy. The app is free to download.
• For what you buy in the app, Google takes the payment and keeps your payment details and the record of your purchase, under the same terms and policy. In the European Economic Area, the United Kingdom and some neighbouring territories, Google is the merchant of record for the sale, acting as our agent; elsewhere it handles the payment for the sale. What it gives us is described in section 12.
• Through the Google Play app on your device, Google runs the app's update check, its rating card and, in the United States, its age question, and collects what each one needs, as described in section 7. A rating or review you leave is published by Google Play, not by us.
• As your backup provider, Google holds the Android backup described in section 5 under your Google Account and your agreement with Google.

Google's handling of your data under each of these relationships is governed by Google's privacy policy, at policies.google.com/privacy, not by this one.

12 · What we receive when you buy in the app

Anything you buy in the app is bought through Google Play's billing system, and Google takes the payment. Your payment details stay with Google: we never see your card or bank details, and Google gives us neither your name nor your e-mail address.

For each sale, Google Play gives us a record of it, in Google Play Console — the service through which we publish the app — and in its monthly reports to us:

• the order number and Google Play's own code for the purchase, the date and time, the product, its price and the tax charged;
• the country of your Google Play account, and the model of the device the purchase was made on;
• in some cases your state or region, and — where Google is not the merchant of record for the sale, as section 11 explains — your postal code and your city, which Google provides for tax.

Nothing else comes with it: nothing about how you use the app, and nothing from it. The app sends us nothing about the purchase either; it asks Google Play, on the device, whether the purchase is yours, and unlocks what you bought.

We use these records for our accounts and our tax returns, and for nothing else. They are seen only by whoever keeps our accounts and by authorities entitled to them by law. Because no name comes with them, we cannot tell whose purchase a record is unless you tell us: Google Play's receipt shows the order number, which begins GPA.

13 · Legal bases for processing

For the app itself, we process no personal data, so no legal basis arises. What the app keeps stays on the device, except that Android may include it in the backup it makes to your own Google Account; that backup is made and held by Google for you, under your arrangement with Google, and never reaches us.

Where Google Play gives us the record of a purchase, described in section 12, the basis is Article 6(1)(c): accounting and tax law require us to keep it.

Where you write to us, the basis is Article 6(1)(f), our legitimate interest in responding to correspondence about our software. You may object at any time by asking us to stop, and we will.

14 · Your rights, and how to exercise them

Under the GDPR and the UK GDPR you have rights of access, rectification, erasure, restriction and objection, and the right not to be subject to automated decision-making. Write to support@lustigfairchild.com. We answer within one month, which is the period Article 12(3) allows.

It is worth being concrete about what such a request would be about here, rather than listing rights and leaving you to guess.

Not what is in the app. What you keep in it sits on your device and, if Android backup is on, in your own Google Account's backup — never with us. Uninstalling the app removes it from the device, and the app's own erase removes what you made in it sooner; the backup is yours to manage in your device's backup settings. There is nothing for us to produce, correct or erase, because we never had it.

The record of a purchase, if you bought something in the app. We hold what section 12 lists, and no name comes with it — so send us the order number from Google Play's receipt, and we will tell you what the record says, or correct it. We cannot delete it while the law requires us to keep it, and we delete it when the law no longer does.

Your correspondence, if you have written to us. That we do hold, and it is what a request would concern: what we have, correcting it, deleting it, or asking us to stop. Ask and we will do it.

That is the whole of it. We hold nothing else about you, so for anything beyond those three the honest answer to a request is that there is nothing to give you.

One right genuinely does not apply: portability under Article 20 covers processing based on consent or on a contract, and we process correspondence on the basis of legitimate interests, and purchase records because the law requires it. We would rather say so than list a right we could not honour.

15 · Children

The app is meant for people aged 13 and over, and is not designed for children. It does not ask your age. In the United States only, it asks Google Play for the age range Google Play holds for your account, as section 8 describes, and keeps no record of the answer. We do not knowingly process children's personal data, and there is no mechanism in the app by which we could.

16 · Retention, security and international transfers

The app itself sends us nothing, so there is nothing from it to schedule for deletion. Support correspondence is kept for 24 months.

The record of a purchase, described in section 12, is kept for as long as accounting and tax law requires us to keep the records it supports, and is then deleted.

The app's own data never reaches us, so we make no international transfer of it and hold nothing of yours on any server of ours to secure. The security of your Android backup, and where in the world Google stores it, are matters for Google's privacy policy; on the device, the app relies on the operating system's own protection of app data.

17 · Notice for residents of the United States

We do not sell or share personal information as those terms are used in the California Consumer Privacy Act, and the only personal information we have in connection with this app is the record of a purchase described in section 12, which we use for our accounts and nothing else. We do not use or disclose sensitive personal information beyond what is permitted. No financial incentive is offered for personal information, and nobody is treated differently for exercising a right.

The same holds under the comparable laws of other US states. You may contact us at the address in the last section in any case.

18 · Other jurisdictions

Where local law gives you stronger rights than this policy describes, those rights apply, and nothing here limits them.

19 · Changes to this policy

Every version is dated and numbered, and superseded versions stay published at /legal/archive/ so you can read what applied before. Where a change affects you, the version number moves by a whole number rather than a decimal.

This is the first version of this policy. It covers the Google Play edition only; the App Store edition has its own.

20 · Contact, and how to complain

support@lustigfairchild.com, or by post at the address in section 1.

You also have the right to complain to a data protection supervisory authority, and you do not have to come to us first. Ours is the Commission for Personal Data Protection in Bulgaria, at cpdp.bg. You may instead complain to the authority in the country where you live or work.