✦ Privacy Policy

Nocrastinate – Privacy Policy

We are committed to protecting your privacy and personal data.

Modern Apps Ltd built the Nocrastinate app.

This Privacy Policy explains how personal data is processed when you use the App.

Personal data you enter into the App (such as tasks, events, reminders, and streaks) may be processed locally on your device and, where optional features are enabled, through backend services for sync, account functionality, email delivery, optional end-to-end encryption, and analytics.

1. Data Controller

Modern Apps Ltd is the data controller for personal data processed through the App under applicable UK and EU data protection laws.

2. Local Data Storage

By default, app data is stored locally on your device.

If your device is lost, reset, or the App is uninstalled, local data may be permanently lost.

3. Accounts & Cloud Sync

If you create an account or use Plus features, we use Google Firebase to provide:

authentication
cloud sync
cross-device functionality
backend services required to operate the App

When cloud sync is enabled, selected app data is stored in Firebase so that it can be synchronised between your devices.

Cloud data is associated with your Nocrastinate account and is processed to:

save and synchronise your app data
restore data across devices
maintain account state
provide the cloud features included with Nocrastinate Plus

If your Nocrastinate Plus subscription lapses, cloud-stored account data may be retained for up to 30 days. If you do not resubscribe during this period, the cloud-stored account data will be deleted.

If you resubscribe during the 30-day period, deletion of the retained cloud data will be prevented, subject to the data still being available.

This cloud-data retention and deletion process does not automatically delete data stored locally on your device.

Firebase processes data on our behalf under its own privacy and security policies.

For more information, see: https://firebase.google.com/support/privacy

Data Storage and Processing Locations

Our Cloud Firestore database and deployed Cloud Functions are hosted in the European Economic Area (EEA), specifically Frankfurt, Germany (europe-west3).

Firebase Authentication is operated by Google from data centres in the United States. As a result, account information processed through Firebase Authentication is processed in the United States.

Google may also process certain technical and operational data in other locations as necessary to provide and maintain its services.

Where personal data is transferred outside the UK or EEA, appropriate safeguards are used in accordance with applicable data protection legislation.

4. Email Communications

If you create an account, we may send essential service emails such as:

password resets
verification emails
account notifications

We use Mailgun to deliver these emails.

When used:

your email address is processed for delivery
Mailgun may temporarily store email addresses and metadata in logs
logs are retained for up to 24 hours for security, reliability and troubleshooting
email data is not used for marketing

Mailgun acts as a data processor and processes data on our behalf in accordance with its own privacy and security policies.

For more information, see: https://www.mailgun.com/legal/privacy-policy/

Data Processing Location

We use Mailgun’s EU infrastructure to process and deliver transactional emails. Email messages, delivery information and associated event logs are processed within Mailgun’s European region.

Certain account-level information, such as account details and API keys, may be processed or replicated outside the EU as part of Mailgun’s global account infrastructure.

5. Firebase Analytics & Crash Reporting (Optional)

Analytics and crash reporting are optional and only enabled with your consent.

If enabled, data collected may include:

crash logs and diagnostics
device information
app usage and interactions
approximate location (derived from IP address)

This data is used only to:

improve stability
fix bugs
improve performance

You may disable this at any time in settings.

Review Firebase Crashlytics privacy policy: https://firebase.google.com/support/privacy

6. Google Calendar Synchronisation (Optional)

Nocrastinate offers two optional Google Calendar integration features:

Import from Google Calendar (available to all users): Allows you to select specific Google Calendars to import events from and view alongside your tasks and habits.
Export to Google Calendar (available to Nocrastinate Plus members): Allows you to synchronise Nocrastinate events with a writable Google Calendar of your choice, or choose “None” to keep individual events local to Nocrastinate.

These features can be enabled or disabled separately.

Google Permissions Requested

Depending on the features you enable, Nocrastinate requests access to:

https://www.googleapis.com/auth/calendar.readonly: To view your calendar list and import events.
https://www.googleapis.com/auth/calendar.events: To create, edit, move and delete Google Calendar events associated with Nocrastinate.

Google’s permissions determine the calendars and events the App can access. The calendar.events permission is not technically restricted to only the calendar you select; Nocrastinate uses it to provide the export functionality described in this section.

Data Accessed and How It Is Used

Calendar and Event Details: Depending on your settings, the App accesses calendar names, IDs, access permissions, event titles, dates, times, recurrence information, reminders and related event metadata to import or synchronise events.
Identifiers and Sync Metadata: The App uses Google Calendar IDs, Google event IDs and synchronisation tokens to associate events with their calendars, retrieve changes, prevent duplicates and maintain synchronisation.
Calendar Selection: When you first enable Export to Google Calendar, you choose a default destination calendar. New events use this calendar by default, but you can choose a different calendar or select “None” on the event creation or editing screen. Each Nocrastinate event can be associated with only one Google Calendar for synchronisation at a time. Only calendars for which Google reports suitable write permissions are offered as destinations.
Imported Events: Events imported from Google Calendar are identified as originating from Google. They are not automatically exported back to Google Calendar by Nocrastinate, preventing synchronisation loops and unintended duplicates.
Changes and Deletions: Changes to linked Nocrastinate events are synchronised with their associated Google Calendar events. Moving an event to another calendar updates its association; if Google’s move operation fails, the App attempts to delete the event from the original calendar and create it in the new one. Choosing “None” or deleting a linked event in Nocrastinate deletes its corresponding Google Calendar event when export is enabled. Deletions made in Google Calendar may be reflected in Nocrastinate through synchronisation.

Data Storage and Protection

Local Storage: Calendar data is stored locally on your device.
Cloud Sync (Nocrastinate Plus): If you enable cloud sync, relevant imported event details, Google Calendar and event IDs, synchronisation tokens and calendar preferences may also be stored in Firebase Cloud Firestore to synchronise your data across your devices. Access is protected by Firebase Authentication and security rules.
Security: Data transmitted between your device, Google Calendar APIs and Firebase is protected using HTTPS/TLS. Data stored in Firebase is protected by the encryption-at-rest measures provided by Firebase and Google Cloud. Google authorisation credentials are handled separately on each device and are not stored in Firebase as part of this synchronisation process.

Data Sharing and Google Limited Use Disclosure

No Sale or Advertising: Modern Apps Ltd does not sell or rent Google user data or share it with third parties for advertising or unrelated purposes.
No AI Training: Google user data is not used to train generalised artificial intelligence or machine-learning models.
Google Limited Use Compliance: Nocrastinate’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Managing Your Data, Disconnecting and Revocation

Disabling Sync: You can disable Import from Google Calendar, Export to Google Calendar, or syncing for individual calendars. When you stop importing a calendar, the App asks whether you want to keep or remove its imported events. If you keep them, they remain in Nocrastinate and, where applicable, Firebase. If you remove them, the relevant event data and synchronisation state are cleared.
Disconnecting Your Account: You can disconnect Google Calendar through the App’s settings. Nocrastinate calls Google’s disconnect functionality to revoke the App’s previous authorisation. The stored connection configuration and synchronisation tokens are cleared from your device and Firebase. You can choose whether to retain or delete imported events. If retained, those events remain stored locally and, where cloud sync is enabled, in Firebase; their associated calendar and event identifiers may be preserved to help prevent duplicates if you reconnect.
Existing Google Events: Disabling export or disconnecting Google Calendar does not automatically delete events already created in your Google account.
Google Account Permissions: You can also review or revoke Nocrastinate’s access through your Google Account Permissions.

Nocrastinate data is also subject to the App’s data lifecycle rules, including soft deletion and tombstone records described in Section 8.

7. End-to-End Encryption (Optional)

Nocrastinate Plus users may optionally enable end-to-end encryption (E2EE) for supported cloud-synchronised data.

E2EE uses AES-256-GCM authenticated encryption, with encryption keys derived using PBKDF2-HMAC-SHA256.

When E2EE is enabled:

encryption and decryption of protected data take place on your device
protected data is encrypted before it is uploaded to Firebase
Firebase does not receive those encrypted fields in plaintext
Modern Apps Ltd does not have access to the user’s unencrypted encryption key
Modern Apps Ltd and the Firebase service therefore cannot decrypt the protected data on the user’s behalf

E2EE uses a password-based encryption key and a separately generated recovery key.

If you sign in using Google or Apple and enable E2EE, you will be asked to create an encryption password for this purpose. This password is separate from your Google or Apple account credentials.

A recovery key is provided when E2EE is enabled. You can view the recovery key from the Encryption section of the Profile page in Settings.

You are responsible for keeping your encryption password and recovery key secure.

If you lose both your encryption password and recovery key, Modern Apps Ltd cannot recover or decrypt your E2EE-protected data for you.

E2EE can be enabled or disabled from the Encryption section of the Profile page in Settings.

Not all information associated with cloud-synchronised data is encrypted. Certain technical metadata, such as identifiers, synchronisation information, structural information, and other information required to operate cloud sync, may remain unencrypted.

When E2EE is disabled, supported data is stored and synchronised using the App’s normal cloud-sync system rather than the additional client-side encryption layer.

8. Data Lifecycle (Soft Delete & Tombstones)

When data is deleted:

it is marked as deleted (soft delete)
it may be retained temporarily for sync consistency

To prevent deleted items reappearing on offline devices, minimal tombstone records may be retained.

These records:

contain only identifiers and deletion status
do not include user content
are used solely for synchronisation
are removed after a limited retention period

9. Security & Encryption

Data transmitted between the App and backend services is protected using standard transport-layer security (TLS).

Cloud data stored through Firebase is protected using the security measures provided by Google Cloud and Firebase, including encryption at rest.

In addition, Plus users may choose to enable the optional client-side end-to-end encryption described in Section 7.

When E2EE is enabled, the additional encryption layer is applied on the user’s device before protected data is uploaded to cloud storage.

No method of electronic storage or transmission is completely secure. While we take reasonable technical and organisational measures to protect personal data, we cannot guarantee absolute security.

10. Data Sharing

We do not sell, rent, or share personal data for advertising purposes.

We may disclose or process data through third-party service providers where necessary to operate the App, including:

Google Firebase / Google Cloud for authentication, cloud storage, synchronisation, and backend functionality
Mailgun for sending account-related emails
RevenueCat for subscription and entitlement management
Google for optional Google Calendar integration
Apple and Google for app distribution and related platform services

These providers process data in accordance with their applicable terms and privacy policies. Where they act as our data processors, they process data on our behalf to provide the relevant services.

Where E2EE is enabled, supported protected data is encrypted on your device before being uploaded to cloud storage.

11. App Store & Platform Data

The Apple App Store and Google Play may independently collect analytics or crash data.

We do not control this collection. Review their privacy policies: Google Play Privacy Policy (for Android) or Apple App Store Privacy Policy (for iOS)

12. Your Rights

Depending on your location, you may have rights to:

access your data
request deletion
withdraw consent for analytics
restrict processing

You can exercise these rights by contacting us.

13. Changes to This Policy

We may update this Privacy Policy from time to time.

Any updates will be published on this website which is also accessible through the app.

14. Effective Date

1st November 2026

15. Contact

Modern Apps Ltd
[email protected]

Have questions about our policies?

Feel free to reach out if you need clarification on any terms.