Privacy Policy

Last updated: September 10, 2026

Important: This Privacy Policy describes how WhenDo (formerly published as "Taskly") collects, uses, and protects your information when you use our mobile application. WhenDo is an automation app: it runs on your device, and the overwhelming majority of what it does never leaves your device. This policy is written to be specific about the few things that do.

Interpretation and Definitions

Definitions

For the purposes of this Privacy Policy:

Application refers to WhenDo, the mobile software application provided by us.
Company (referred to as "we", "us" or "our") refers to the developer of WhenDo.
Device means any mobile device that can access the Application such as a smartphone or tablet.
Personal Data is any information that relates to an identified or identifiable individual.
Service refers to the Application.
Task means an automation rule you create or import in the Application, consisting of triggers, conditions and actions.
You means the individual using the Application.

At a Glance: What Stays and What Leaves

Because WhenDo needs powerful permissions to work, we think you deserve a plain answer up front:

Stays on your device	Leaves your device
Your tasks and their settings Everything the accessibility service reads from your screen Screenshots, on-screen text recognition (OCR) and text translation Photos taken and audio recorded by task actions Your location, Wi-Fi network name (SSID) and geofences Calendar events read by tasks Clipboard content, global variables, logs Lists of apps installed on your device	The text you type when you ask AI to generate a task A task you explicitly choose to upload and share Anonymous usage and diagnostic events (Firebase Analytics) A request for remote configuration and the online task library A device integrity token used to block abuse of our AI service Purchase records handled by Google Play Billing Any network request that you yourself configure inside a task

Stays on your device

Leaves your device

Your tasks and their settings
Everything the accessibility service reads from your screen
Screenshots, on-screen text recognition (OCR) and text translation
Photos taken and audio recorded by task actions
Your location, Wi-Fi network name (SSID) and geofences
Calendar events read by tasks
Clipboard content, global variables, logs
Lists of apps installed on your device

The text you type when you ask AI to generate a task
A task you explicitly choose to upload and share
Anonymous usage and diagnostic events (Firebase Analytics)
A request for remote configuration and the online task library
A device integrity token used to block abuse of our AI service
Purchase records handled by Google Play Billing
Any network request that you yourself configure inside a task

We never operate a user account system. You do not register, log in, or give us your name, email address or phone number to use the Application.

Information We Collect

Data Processed Only on Your Device

The following is processed locally and is not transmitted to us or to anyone else:

Accessibility data. Screen content, the name of the app in the foreground, and the user interface elements your tasks look for.
Screen text recognition and translation. When a task uses text recognition (OCR) or text translation, it runs through Google ML Kit's on-device models. The images and text are processed on your device. ML Kit may download its language models from Google Play services the first time they are needed; your content is not sent along with that download.
Camera and microphone. Only used while a task action you configured takes a photo or records audio. The resulting files stay on your device. We do not access your photo library.
Location. Used to identify your current Wi-Fi network name (SSID), to run geofence triggers, and to show your position while you configure a location-based task. Map tiles are supplied by OpenStreetMap and CARTO (see OpenStreetMap Copyright and License); requesting a map tile reveals the map area you are viewing to those providers. We do not track your location in the background unless a task you created requires it, and we never transmit your location to our servers.
Calendar. Tasks can read calendar events as triggers, and — if you add such an action — create or delete calendar events. Calendar content is never uploaded.
Phone state. Used to detect incoming calls and other call states as triggers. We do not read your call log, contacts or messages.
Installed apps. Tasks can target other apps, so the Application reads the list of apps on your device to let you pick one. This list is never uploaded.
Task data and logs. Your tasks, global variables and diagnostic logs are stored in the Application's private storage.

AI Task Generation

The Application offers an optional feature that turns a description you write into an automation task. This feature is the main case where your input leaves your device.

What is sent: the text you type, plus a catalogue of the Application's built-in automation components needed to build a valid task.
What is not sent: your screen content, screenshots, location, contacts, calendar, the list of apps installed on your device, or any file on your device.
Where it goes: your request is passed through a relay service we operate on Google Cloud Run and forwarded to OpenAI, which generates the task. Our relay service does not log or store the content of your request; it only forwards it. OpenAI processes the request under its own API policies (API data is not used to train its models).
Abuse prevention: requests carry a Firebase App Check token derived from Google Play Integrity. It tells our relay that the request came from a genuine copy of the Application. It is not an identifier of you and is not used for analytics.
Your choice: if you never use the AI feature, nothing you write is ever sent anywhere. Tasks you build by hand are created entirely offline.

Online Task Library and Sharing

The Application can fetch a library of ready-made tasks from our Firebase Firestore database. Fetching the library sends a request to Google's servers but sends none of your personal data.

If — and only if — you explicitly choose to upload a task to share it, the content of that task file is stored in that database and becomes available to other users. Please review a task before sharing it: anything you typed into it (a phone number, an address, a message body, a URL, a password field) is part of the task and will be uploaded with it. You can contact us to have a task you uploaded removed.

Network Actions You Configure

The Application lets a task perform HTTP/HTTPS requests and shell commands that you define. When such a task runs, data goes wherever you pointed it. We are not the recipient of that data and have no control over it; the third party you chose handles it under their own privacy policy.

Analytics and Diagnostics

We use Firebase Analytics to understand which features are used, so we can decide what to improve. It collects:

Anonymous usage events (for example: a screen was opened, a feature was used, a purchase screen was shown) and, where applicable, a low-detail label such as which entry point was used
Device model, operating system version, application version, language and coarse region
An app instance identifier generated by Firebase, and the Android advertising ID

We do not attach your name, email, account, screen content, task content, precise location, or the names of the apps you automate to these events. See the Firebase Privacy Policy for details of Firebase's own processing.

The Application also uses Firebase Remote Config to fetch settings (such as feature switches and price displays) from Google's servers. It sends device and app metadata, not your content.

Purchases

Paid features are sold through Google Play Billing. Your payment happens inside Google Play — the Application never sees your payment card, billing address or Google account. We receive from Google the record of whether a purchase for this application exists, so the Application can unlock the features you bought. The Application also uses the Google Play In-App Review API to show the official rating dialog; the review you write goes to Google Play, not to us.

Permissions and Why They Are Needed

Every permission below serves an automation capability. Android also requires some of them for reasons that are not obvious, which is why they are listed even when you may never use the corresponding feature.

Permission	Android identifier	Why WhenDo requests it
Accessibility Service	`android.permission.BIND_ACCESSIBILITY_SERVICE`	The core of the app: reading screen elements and performing clicks, input, scrolling and gestures for your tasks
Internet and network state	`android.permission.INTERNET, android.permission.ACCESS_NETWORK_STATE`	AI task generation, the online task library, analytics and remote configuration, and network actions you configure; network state also serves connectivity triggers
Precise and approximate location	`android.permission.ACCESS_FINE_LOCATION, android.permission.ACCESS_COARSE_LOCATION`	Geofence triggers, reading the Wi-Fi network name (SSID), and showing the map while you configure a task
Wi-Fi state	`android.permission.ACCESS_WIFI_STATE`	Wi-Fi connection triggers and conditions
Bluetooth	`android.permission.BLUETOOTH, android.permission.BLUETOOTH_ADMIN, android.permission.BLUETOOTH_CONNECT`	Bluetooth device connection triggers, and switching Bluetooth on or off as an action
NFC	`android.permission.NFC`	Using an NFC tag as a trigger
Camera and flashlight	`android.permission.CAMERA, android.permission.FLASHLIGHT`	Take-photo actions, and turning the flashlight on or off
Microphone	`android.permission.RECORD_AUDIO`	Audio recording actions inside your tasks
Calendar	`android.permission.READ_CALENDAR, android.permission.WRITE_CALENDAR`	Calendar events as triggers, and add/delete calendar event actions
Phone state	`android.permission.READ_PHONE_STATE`	Incoming call, hang-up and other call state triggers
Notifications	`android.permission.POST_NOTIFICATIONS`	Showing task status, notification actions you configure, and warnings when a task cannot run
Do Not Disturb access	`android.permission.ACCESS_NOTIFICATION_POLICY`	Reading and changing Do Not Disturb mode as a condition or action
Display over other apps	`android.permission.SYSTEM_ALERT_WINDOW`	The floating control panel, the element picker and the on-screen clicker
Modify system settings	`android.permission.WRITE_SETTINGS`	Actions that change system settings such as screen brightness
Set alarm	`android.permission.SET_ALARM`	Actions that create an alarm or timer in your clock app
Run at startup	`android.permission.RECEIVE_BOOT_COMPLETED`	Restoring your always-on tasks after the device reboots
Background execution and feedback	`android.permission.FOREGROUND_SERVICE, android.permission.FOREGROUND_SERVICE_SPECIAL_USE, android.permission.WAKE_LOCK, android.permission.VIBRATE`	Keeping scheduled and always-on tasks running reliably, and vibration feedback
Purchases	`android.permission.BILLING`	Purchasing paid features through Google Play
Shizuku (optional)	`moe.shizuku.manager.permission.API_V23`	Only used if you choose to run WhenDo through Shizuku, which lets advanced actions run with higher privileges. Nothing is sent anywhere; if you do not use Shizuku this permission does nothing
Advertising ID and attribution	`android.permission.AD_ID, android.permission.ACCESS_ADSERVICES_AD_ID, android.permission.ACCESS_ADSERVICES_ATTRIBUTION, android.permission.BIND_GET_INSTALL_REFERRER_SERVICE`	Required by the Firebase Analytics library, which uses them for install attribution. We do not show ads in WhenDo and we do not build advertising profiles
Push messaging	`com.google.android.c2dm.permission.RECEIVE`	Declared by the bundled Firebase Cloud Messaging component. We do not currently send push notifications through it

Important safeguards for the accessibility service:

It is used exclusively to run the automation you configured
We do not record, store or transmit screen content or your interactions
All automation logic runs locally on your device
You can disable it at any time in your device settings, and the Application stops observing your screen

Screen content read through the accessibility service is processed in memory and discarded after use. It is never stored, logged or transmitted to any server — including when you use AI task generation.

How We Use Your Information

To provide the Service — running the tasks you create
To provide the AI feature — turning your description into a task
To improve the Service — analysing anonymous usage patterns to decide what to build and fix
To keep the Service working — diagnosing crashes and performance problems
To protect the Service — verifying that AI requests come from a genuine copy of the app
To deliver what you paid for — unlocking purchased features

We do not sell your personal data. We do not share it with data brokers, advertisers or any third party for their own marketing.

Data Storage, Backup and Security

Local storage: your tasks, settings, variables and logs are stored in the Application's private storage on your device.

Device backup: Android's backup feature is enabled for this application. If you have Google Backup turned on, Android may copy the Application's data — including your tasks and their settings — into your own Google account, and restore it when you set up a new device. That backup belongs to you and is governed by Google's terms; we have no access to it. You can turn it off in your device's system backup settings.

Transport security: all requests to our relay service and to Google's services use encrypted HTTPS connections.

Technical Support

If you contact us for support, you may voluntarily attach log files or a task file to your email. These help us reproduce the problem, but:

Sending them is entirely your choice
They are used only to diagnose your issue
We delete them once the support case is resolved
You can ask us to delete them at any time

Data Retention

On your device: data stays until you delete it or uninstall the Application. Uninstalling removes all locally stored data.
AI requests: our relay service does not retain the content of your requests.
Tasks you uploaded to share: retained until you or we remove them.
Analytics: retained by Firebase according to the retention period configured in Firebase Analytics, after which it is deleted automatically.
Support emails: deleted once the case is resolved.

Your Rights and Controls

Permissions: every permission can be granted or revoked in your device settings at any time. Revoking one only disables the tasks that depend on it.
Accessibility service: can be turned off at any time in your device settings.
AI feature: optional — simply do not use it, and nothing you write is transmitted.
Advertising ID: you can delete or reset it under Settings → Privacy → Ads on your device, which also stops it being attached to analytics events.
Device backup: can be disabled in your device's system backup settings.
Deleting your data: uninstalling the Application removes all local data. For a task you uploaded to the online library, email us and we will remove it.
Access and complaints: because we hold no account for you, we usually hold nothing that identifies you. If you believe we do, email us and we will look into it.

Children's and Minors' Privacy

The Application is a general-purpose automation tool intended for adults. It is not directed to anyone under 18, and our Google Play listing declares a target audience of 18 and over. The Application grants powerful control over the device — including accessibility automation and running commands — which is why we do not aim it at minors.

We do not knowingly collect personal information from children or other minors. If you believe someone under 18 has provided us with personal information, please contact us and we will delete it.

Third-Party Services

The Application relies on the following third-party services:

Service	Used for	Their policy
OpenAI	Generating a task from the description you write	openai.com/policies/privacy-policy
Google Firebase (Analytics, Remote Config, Firestore, App Check)	Anonymous usage analytics, remote settings, the online task library, abuse prevention	firebase.google.com/support/privacy
Google Play (Billing, In-App Review, Integrity, ML Kit)	Purchases, the rating dialog, integrity checks, on-device text recognition and translation models	policies.google.com/privacy
Google Cloud Run	Hosting the relay that forwards AI requests	policies.google.com/privacy
OpenStreetMap and CARTO	Map tiles shown while configuring a location task	openstreetmap.org/copyright

Google Play also provides us with aggregated, anonymous install and stability statistics for the Application. That data comes from Google, not from anything the Application collects.

International Transfers

The services above are operated by companies based in the United States, so the limited data described in this policy may be processed there. We rely on those providers' standard contractual safeguards for such transfers.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy inside the Application and updating the "Last updated" date at the top. Significant changes to what leaves your device will be called out in the release notes. You are advised to review this policy periodically.

Note on our name: this application was previously published as "Taskly" and is now published as "WhenDo". It is the same application from the same developer; only the name has changed.

Contact Us

If you have any questions about this Privacy Policy, want data removed, or need technical support, you can contact us:

By email: simplelifefirst@gmail.com

Summary: WhenDo runs your automation on your device. Your screen content, tasks, photos, recordings, location and calendar stay there. Three things leave: the text you type into the AI feature, a task you deliberately choose to share, and anonymous usage statistics. There is no account, no ads, and we never sell your data.