NextStep App Privacy Policy

1. Data We Collect

To provide our services, NextStep collects the following minimal categories of data:

• Personal & Account Information: When you create an account, we collect your email address and profile name via Google Sign-In or email registration (powered by Firebase Authentication). You may also use the app locally as a guest.

• User-Generated Productivity Data: Routines, tasks, schedule times, visual icons/colors, and completion logs created within the app are saved locally and synced to your secure private cloud account (Firebase Firestore) if signed in.

• AI Prompts & Inputs: When you use AI-assisted routine generation or task breakdown features, the prompt text you submit (e.g., routine description or goals) is processed to produce structured routines.

• Purchase & Entitlement Information: If you purchase NextStep Pro or a subscription, transaction metadata (such as store product IDs, purchase dates, and subscription status) is processed via Adapty to grant and verify your premium entitlements. We never collect or store your payment card details; all financial transactions are processed securely by Google Play Billing.

• App Diagnostics & Performance: We collect anonymized crash logs, fatal error reports, and non-identifying performance metrics via Firebase Crashlytics to diagnose bugs and maintain app stability.

• Basic Analytics: Aggregated, non-personally identifiable app usage metrics (e.g., feature interactions, session durations) are collected via Firebase Analytics to help us improve user experience. Advertising ID (AAID) collection is explicitly disabled in our app manifests.

2. Artificial Intelligence & Machine Learning Processing

NextStep offers optional AI-powered productivity tools (such as routine idea generation and task breakdown) powered by Firebase AI Logic and Google Gemini:

• On-Device Processing First: Where your hardware and Android OS version support it, AI requests are processed directly on your device using on-device models (such as Gemini Nano via AICore) without sending your prompt off your phone.

• Secure Cloud Fallback: If on-device inference is unavailable on your device, prompts are sent securely over HTTPS to Google's cloud Gemini API services via Firebase AI Logic solely to generate your requested routine or task breakdown.

• No Model Training: Prompts and routine data submitted through NextStep's AI features are never used by VX9Studio or Google to train, retrain, or improve foundational AI models.

• User Control: AI features are completely opt-in and triggered only when you explicitly tap to generate or optimize routines. You can edit, modify, or delete any AI-suggested tasks at any time.

3. How We Use Your Data

Your data is used strictly for the following purposes:

• Delivering Core Productivity Features: Saving, scheduling, and running your daily visual routines and persistent alarms.

• Cross-Device Synchronization: Syncing your routines and tasks securely across your Android phones, tablets, and companion Wear OS smartwatches.

• Authentication & Security: Verifying your account credentials, maintaining session integrity, and protecting against unauthorized access.

• In-App Purchase Management: Validating subscription receipts, verifying Pro entitlements, and managing restore-purchase requests via Adapty.

• App Integrity & Abuse Prevention: Validating genuine device requests and guarding against unauthorized tampering using Firebase App Check and the Google Play Integrity API.

• Stability & Diagnostics: Pinpointing crashes, fixing regressions, and improving application responsiveness.

4. Data Sharing and Third-Party Service Providers

We never sell, rent, monetize, or trade your personal data. We share data only with the following trusted infrastructure and service providers bound by strict confidentiality and data protection agreements:

• Google Firebase (Google LLC): Provides cloud authentication (Firebase Auth), real-time encrypted database hosting (Cloud Firestore), dynamic configuration (Remote Config), AI integration (Firebase AI Logic), anti-abuse verification (Firebase App Check), and crash diagnostics (Firebase Crashlytics).

• Adapty Tech Inc. (Adapty): Processes Google Play purchase tokens and manages subscription status to unlock NextStep Pro features.

• Google Play Services: Handles Google Play In-App Billing, Wearable Data Layer communications between your phone and Wear OS watch, and Play Integrity checks.

• No Third-Party Advertising: NextStep contains zero third-party advertising SDKs and does not participate in cross-app ad tracking.

5. Wear OS Companion Synchronization

NextStep includes an optional Wear OS companion app for smartwatches:

• Direct Local Sync: Communication between your phone and your Wear OS watch occurs directly over the Google Play Services Wearable Data Layer (via Bluetooth or local Wi-Fi).

• Minimal Footprint: Only active routines and task completion triggers needed for on-wrist notifications and quick timer controls are transferred between paired devices.

• No Separate Wear Account: The watch app mirrors your phone's active state without independent third-party data tracking.

6. Data Security (Encryption in Transit and at Rest)

We apply rigorous industry-standard security measures to protect your information:

• Encryption in Transit: All network communications between NextStep, Google Firebase, Adapty, and AI endpoints are strictly encrypted using TLS 1.3 / HTTPS protocols.

• Encryption at Rest: All synchronized routines, tasks, and profile records are encrypted at rest on Google Cloud Firestore.

• App Integrity: Firebase App Check with the Google Play Integrity API cryptographically attests that API requests originate from authentic, unmodified NextStep application binaries.

7. Device Permissions

NextStep requests only the minimum Android permissions required for its visual ADHD routine functionality:

• Alarms & Reminders (USE_EXACT_ALARM / SCHEDULE_EXACT_ALARM): Required to trigger precise routine countdowns, visual alert sheets, and time-boxed task transitions.

• Post Notifications (POST_NOTIFICATIONS): Required to display persistent timer notifications and countdown alerts.

• Foreground Service (FOREGROUND_SERVICE_SPECIAL_USE): Required to maintain reliable countdown timers during active routine sessions without system termination.

• We do not request or access your fine or coarse location, camera, microphone, contacts, or external storage files.

8. Data Retention Policy

• User Productivity Data: Your routines, tasks, and account profile are retained as long as your account remains active so you can access your data across devices.

• Crash Logs & Diagnostic Reports: Firebase Crashlytics crash reports and non-identifiable diagnostic logs are automatically purged after 90 days.

• Local Cache: If you use the app as a guest without creating a cloud account, all routines and tasks are stored strictly on your device's local SQLite database and can be purged at any time by clearing app storage.

9. Data Deletion Policy & Account Removal

You have the absolute right to request the complete deletion of your account and all associated personal data at any time.

How to delete your data directly from inside the NextStep app:

1. Open the NextStep app on your Android device.

2. Navigate to Settings by tapping the gear icon in the top corner.

3. Tap 'Account' to view your profile settings.

4. Tap 'Delete Account' and confirm the prompt.

Upon confirmation, your account credentials, saved routines, task history, and cloud records are immediately and permanently erased from our active databases. Encrypted database backups are fully purged within 30 days.

Alternative deletion requests: If you uninstalled the app or cannot access your device, email us at hello@vx9studio.com from your registered account email address. Our team will verify and delete your account within 48 hours.

10. Children's Privacy

NextStep is intended for general audiences and does not knowingly collect personal identifiable information from children under the age of 13. Furthermore, NextStep explicitly disables advertising identifier tracking to comply with Google Play Families Policy guidelines. If you believe a child has provided us with personal information, please contact us immediately, and we will delete the data promptly.

11. Changes to This Privacy Policy

We may periodically update this Privacy Policy to reflect app enhancements, new features, or updated regulatory requirements. Any updates will be published directly on this page with a revised 'Last Updated' date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, suggestions, or concerns regarding this Privacy Policy or your personal data, please contact VX9Studio:

• Developer: VX9Studio

• Email: hello@vx9studio.com

• Website: https://vx9studio.com