English · 한국어 · 日本語 · 中文 · Español · Français · Deutsch · Português

Andante Privacy Policy

Effective date: October 5, 2026

This policy covers the Andante app for Android, published by Velocity Craft ("we"). It describes what Andante stores, what it sends, to whom, and for how long.

The short version

Andante works without an account, and your tasks live on your phone. The app does use the internet, for five things: crash reports, usage statistics, an occasional ad, a remote switch that turns those ads on or off, and Andante Cloud — an optional sync service that needs a Google or Apple sign-in and is currently available to a limited group of users. The first four never receive what you write in Andante. Your tasks reach us only if you sign in to Andante Cloud and turn sync on. They can also leave your phone through features you control that are run by Android or other apps rather than by us — Android's own backup, voice input, and files you export — as the table below describes. Everything below is the long form of this paragraph.

What we will not claim

Your tasks on this device are not encrypted by us. They sit in the app's private storage, which Android isolates from other apps. On a rooted device, or a device someone else can unlock, that isolation can be defeated.
Andante Cloud is not end-to-end encrypted. Synced data is encrypted on its way to the server and encrypted at rest by Amazon Web Services with keys AWS manages. That means we, as the operator of that storage, could technically read it. We access it only to run the service — for example, to help you recover data when you ask us to — or when the law requires it.
We cannot recover what only existed on your phone. Unless you use Andante Cloud, we hold no copy of your tasks, and even Andante Cloud does not hold everything (see below). If you lose the phone and have no backup file, that data is gone.
We avoid absolute security wording. It describes nothing you can verify, so we state conditions instead.

What Andante stores on your device

All of this lives in the app's private storage on your device:

Tasks — titles, notes, notes' images, dates, reminders, priorities, subtasks, completion history
Lists, folders, tags, and contexts
Checklists, checklist folders, their items, and cover images you attach
Routines and their completions; habits, habit categories, and logs
Weekly reviews and time capsules, including any image you attach to a capsule
Settings — theme, week start, tab layout, font choice, reminder defaults
If you sign in to Andante Cloud: your sign-in record (the email address and identifiers described below, and a sign-in token), encrypted with a key held in Android's Keystore on this phone

Device calendar events are not in that list. The calendar tab reads events from Android's calendar provider each time it draws them and keeps no copy, so they are not in the app's database, not in any backup it writes, and never sent anywhere by Andante.

What leaves your phone

Path	What happens
Crash reports (Firebase Crashlytics, Google)	When the app crashes, or records an error it recovered from, Crashlytics receives the technical details of the error, the device model, the Android and app versions, a few technical facts about the app's state (for example, whether Android restricts the app's alarms in the background), and a random installation identifier. Your tasks are not included. Firebase keeps crash reports for 90 days.
Usage statistics (Google Analytics for Firebase)	Which screens are opened — by type of screen, never which task or list — and counts of actions such as creating or completing a task, which optional features are switched on, and whether developer mode is on. Google Analytics also uses a random app-instance identifier, collects the device's advertising ID (see "Ads and consent"), and derives an approximate region from your IP address. No task titles, list names, notes, email address, or user ID are sent. It also records some information automatically: the device model, the Android version, the language setting, and session and engagement data such as when the app is first opened, when a session starts, and how long the app is in use. Event-level data is kept for no more than 14 months.
Ad switch (Firebase Remote Config, Google)	Andante asks Firebase whether App Open ads are currently switched on. The request carries a Firebase installation identifier, the app and Android versions, your country, language and time-zone settings, and the feature settings recorded for usage statistics.
Ads (Google AdMob)	See "Ads and consent" below.
Andante Cloud — only if you sign in	See "Andante Cloud" below.
Android backup (Auto Backup and device transfer)	Android may copy this app's data, including the task database, into your Google account backup or onto a new phone. This is an operating-system feature, not a transfer to us — we never see it, and cannot read it. You can switch it off in Android Settings → Google → Backup. Some files are deliberately excluded from it: the developer-mode unlock state (so that a restored phone never arrives already unlocked), your Andante Cloud sign-in record (so that your sign-in never leaves this phone), and records that only make sense on this phone, such as scheduled alarms and ad frequency.
A backup or CSV file you export	Andante writes it wherever you point Android's file picker — local storage, or a cloud drive if you pick one. From that moment the file is yours to protect. It is a plain file, not encrypted, by design: it exists to be restored and opened elsewhere.
Dictating a task with the microphone button	The microphone button where you add a task hands dictation to your phone's speech-recognition service — usually Google's — which turns what you say into text and may send the audio to its servers to do so, under that provider's own privacy policy. Andante receives only the resulting text, never the audio, and needs no microphone permission because the speech service, not Andante, uses the microphone. Nothing is dictated unless you tap the button.
Retiming a calendar event by dragging it	Andante changes that event's start and end time in Android's calendar provider. If the calendar belongs to a Google, Exchange, or other synced account, that account syncs the change as it would any edit made on the phone. This is the only calendar write Andante can perform — it cannot create or delete events.
Choosing a downloadable font	The optional font list is Google Fonts. When you choose one, Google Play Services fetches that font file from Google. The request identifies the font, not you, and no task data is involved. Keeping the default font makes no request at all.

Ads and consent

Andante is free and may occasionally show a full-screen Google AdMob ad ("App Open" ad) when you return to the app. Ads are never shown when you start the app from scratch, while an alarm is ringing or shortly before or after one, when you arrive from a notification, a widget, or a share, or while you are typing. We can switch these ads off remotely, which is what the ad switch above is for.

To show and measure ads, the Google Mobile Ads SDK collects the device's advertising ID, its IP address (from which an approximate location may be estimated), your interactions with ads, and app performance information, for advertising, analytics, and fraud prevention. In the European Economic Area, the United Kingdom, and other regions where it is required, Andante shows Google's consent form and requests ads only after you have made a choice; Google then serves ads according to that choice. You can review or change it at any time in Settings → Ad privacy options (shown where required), and you can reset or delete your advertising ID in Android settings. Your choice in that form governs ads. The form appears only while ads are switched on, so Google Analytics may collect the advertising ID without your having seen it; resetting or deleting the ID in Android settings applies there too.

Google uses this data under its own privacy policy: policies.google.com/privacy. How Google uses data from apps that show its ads: policies.google.com/technologies/partner-sites.

Andante Cloud (optional sync)

Andante Cloud keeps your tasks in sync between your devices. It is optional, off until you turn it on, and currently available only to a limited group of users. If you have never signed in to it, nothing in this section applies to you.

Signing in. You sign in with Google or Apple. The sign-in page opens in your phone's browser and is run by Amazon Cognito, an Amazon Web Services (AWS) service we use, together with Google or Apple. Andante never sees your Google or Apple password. We ask Google or Apple only for your email address — not your name or profile photo. If you use Apple's "Hide My Email", we receive the relay address Apple creates instead of your real one.

What we keep about your account: your email address; the identifier Google or Apple uses for your account and which of the two you signed in with; the account and storage identifiers Amazon Cognito assigns; and when the account was created and last changed. AWS also keeps records of requests made to the sign-in service, including the IP address they came from, for up to 90 days, for security and operations.

What is uploaded while sync is on: a copy of your tasks (title, notes, description, dates and times, reminder settings, priority, status, recurrence, subtasks, and who you are waiting for), task notes, lists, folders, tags, contexts and their links to tasks, checklists, checklist folders and items, and routines — together with a random device identifier the app creates (Android backup or device transfer can carry it to a new phone). Andante syncs when you open the app, a few minutes after you make changes, and periodically in the background.

What is not uploaded: images (cover images, note images, and time-capsule photos — a note keeps only a reference to its image), habits and habit logs, routine check-ins, task completion history, weekly reviews, time capsules, and settings.

Where it is stored, and how it is protected. In AWS's Asia Pacific (Mumbai) region, in India. Each account has its own folder that only that account's sign-in can reach; public access to the storage is blocked; connections must use HTTPS; data is encrypted at rest. Only accounts we have enabled can store data: if you sign in with an account that has not been enabled, no task data is uploaded; only the sign-in record and a random storage identifier without personal information exist.

How long it is kept:

While you use it: the current copy is kept until you delete it, in the app or by email. Each sync replaces it, and the replaced copy is kept as an earlier version, so that data lost by mistake can still be recovered, and is deleted automatically after about 30 days (the automatic deletion can take a few extra days).
Signing out stops sync on that device and removes your sign-in record from it. Data in the cloud stays.
Deleting your account in the app (Settings → Cloud sync → Delete cloud data and account) stops sync on all your devices and deletes your account record, including your email address. From that moment your synced data can no longer be reached from any device; the deleted copy and earlier versions remain in storage only as earlier versions and are permanently deleted automatically within about 30 days (the automatic deletion can take a few extra days). Data on your devices stays. Two records without personal information are kept, with no set deletion date: a marker holding only the time of deletion, which tells your other devices that the account is gone, and a random storage identifier that can no longer be signed in to.
Without the app, you can ask us by email to delete your account and data: velocitycraft.app/andante/delete-account. We complete the deletion within 30 days of verifying the request. You can also ask us to delete only your synced data and keep the account.
Accounts that are not enabled: we may delete the sign-in record of an account that is not enabled for Andante Cloud once it is more than 30 days old; the random storage identifier created when it signed in, which holds no personal information, stays with no set deletion date. If that account still has synced data from a time when it was enabled, we delete that data first.
If your account is no longer enabled, the app can no longer reach its synced data, so deleting in the app removes only the account record. In that case, email us — before deleting in the app, if you can — and we will delete both the data and the account.

Who processes your data

We do not sell your personal information. We share it only with the service providers that run parts of Andante for us, with Google for advertising as described below, and when the law requires it:

Google — Firebase Crashlytics, Google Analytics for Firebase, Firebase Remote Config, Google AdMob, Google sign-in, and Google Fonts. Google also uses advertising data under its own policies, linked above.
Amazon Web Services — Andante Cloud sign-in (Amazon Cognito) and storage (Amazon S3), in the Asia Pacific (Mumbai) region.
Apple — Sign in with Apple, if you choose it.

Andante Cloud data is stored in India. Google processes crash reports, usage statistics, and advertising data on servers in several countries. Wherever you live, your data may therefore be processed outside your country.

What is not collected

Andante does not ask for your name and does not request location, contacts, microphone, or photo-library permission (voice input goes through your phone's speech service, as described above). There is nothing to buy — no subscription and no paid tier — so no billing library is present and no payment information exists. Your task content is never sent to Crashlytics, Analytics, Remote Config, or AdMob, and no user ID is set in analytics.

A hidden developer mode can be unlocked by tapping the version row repeatedly and typing an email address. Only a SHA-256 hash of that address is stored, never the address itself. The hash stays on the device, is excluded from Android backup, and is never sent anywhere; usage statistics record only whether developer mode is on.

Permissions

Internet and network state — crash reports, usage statistics, ads, the ad switch, and Andante Cloud. Android grants these at install; Andante itself sends no task data unless you use Andante Cloud.
Advertising ID — lets Google AdMob and Google Analytics read the device's advertising ID. You can reset or delete the ID in Android settings.
Notifications — reminders, alarms, and the daily digest. Without it the app still works; it just cannot tell you anything. [Optional, but reminders are the point of the app]
Alarms & reminders (exact alarm) — fires a reminder at the minute you chose rather than whenever Android finds convenient. Andante tells you when it is missing instead of pretending a reminder is armed. [Required for alarms]
Run at startup — re-arms your alarms after a reboot, a clock or time-zone change, or an app update. [Required for alarms]
Full-screen notification, wake lock, vibration, foreground service — let an alarm appear on the lock screen and keep ringing until you answer it. [Required for alarms]
Calendar (read) — shows your existing events beside your tasks. Asked the first time you open the calendar tab, never at launch. Decline and every other part of the app is unaffected. [Optional]
Calendar (write) — asked the first time you drag an event to a new time, not before. Note that Android treats calendar read and write as one permission group, so once you have granted read, the system may grant write without showing a second dialog. [Optional]
Photos — no permission is requested. Cover images and note images use Android's photo picker, which hands the app only the image you selected and nothing else in your library.
Files — no permission is requested. Backup, export, and import use Android's file picker, which gives the app access to the one file you chose.

Notifications show your task title

A reminder or alarm notification shows the task's title, which means it can appear on your lock screen. That is deliberate — a reminder that says only "Andante" is not a reminder. It is worth knowing before you write a title you would not want read over someone's shoulder. A task with no title falls back to the app's name.

Importing from other apps

Import from TickTick, Todoist, Google Tasks, and Apple Reminders reads a file that you export from those services and hand to Andante. Andante does not connect to them, never asks for a password, and holds no access token for any of them.

Children

Andante is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has signed in to Andante Cloud, contact us and we will delete the account.

Your rights

On your device you carry out access, correction, and deletion yourself: edit or delete any item in the app, take everything with you through backup or CSV export, and uninstall to remove the rest. If Android has backed the app up to your Google account, that copy is deleted from Google's backup settings, not from Andante.
Andante Cloud: the synced data we hold is what you see in the app, and you can delete it at any time, in the app or by email. You can also ask us for a copy of the personal information we hold about you, ask us to correct or delete it, or object to how it is used, by writing to the address below.
Ads and analytics: change your ad choices in Settings → Ad privacy options (where shown), and reset or delete your advertising ID in Android settings. Crash reports and usage statistics are not linked to your name, email address, or Andante Cloud account, so we usually cannot pick out one person's records.
Depending on where you live, you may also have the right to complain to a data protection authority.

Changes

When a version of Andante changes what it collects or where it sends it, we update this policy before that version is released and change the effective date at the top.

Contact

Velocity Craft
velocitycraft.app+support+andante@gmail.com