Automation Privacy Policy

App and developer

This policy applies to Automation for Android (com.inspolab.automation), provided by AnyDroid. Contact: support@anydroid.com.

Automation lets you create and run device routines. You can create routines manually without using AI or watching rewarded ads. Optional AI generation uses an online service; it is not on-device processing.

Routines and device permissions

Routine definitions, settings, variables, and execution history are stored on your device. Depending on the routines you configure and permissions you grant, Automation can access location (including background location), notifications, installed apps and usage, contacts, SMS and call information, calendar entries, files and media, clipboard contents, camera, microphone, nearby devices, sensors, and device settings.

Automation collects location data in the background, even when the app is closed or not in use, to detect arrival at or departure from selected areas, evaluate enabled location conditions, and run enabled current-location weather routines. A visible floating map can also keep its position view updated. These features are optional. Disable the corresponding routines or automatic execution to stop their observation, close location maps to stop their updates, or revoke location access in Android settings. Location is sent to a weather or map provider or another destination only when you configure the corresponding feature; device location is not supplied to advertising providers.

The Accessibility Service reads screen text or images, foreground-app and selected input events, and performs actions such as taps, gestures, navigation, or text entry for routines you configure. This can expose personal or sensitive information displayed by other apps. Before an app-originated request to enable a service, Automation displays a standalone disclosure with a choice to decline or agree and continue to Android settings. Access can be revoked there at any time. Saved routines follow the rules and actions you configure; accessibility data is not used for advertising. Notification access and usage access detect selected events or perform configured actions. Screen capture or recording uses Android authorization. Shizuku, root, device administrator, and other privileged access are optional and used for the corresponding actions you select. Android performs biometric authentication; Automation does not receive fingerprint images or biometric templates.

These permissions are used to provide the selected automation features. They do not, by themselves, upload your screen, messages, contacts, or routine library to our AI service or advertising providers. A routine you configure can send information to a recipient, website, app, plugin, or other service (for example, an SMS, HTTP request, email, or shared file). Those destinations receive the information you configure. Speech recognition and other external services you select may process data under their own policies.

Optional AI generation

When you submit an AI request, the app sends the text you enter, your language/locale, time zone, and a request identifier to our Google Cloud gateway. The gateway sends your request text, locale, and time zone to OpenAI to produce a routine draft or a clarification. The request is authenticated with a Firebase user identifier. Google sign-in is required to use AI, earn rewarded-ad credits, or purchase credits. Your remaining credits are associated with that account and can be restored by signing in again after reinstalling the app or changing devices. Manual routine creation and execution do not require sign-in. Firebase Authentication processes your Google account identifier and basic profile information, such as your email address, display name, and profile image when provided. Automation never receives your Google password. Google account profile information is not included in AI prompts.

To protect optional AI and rewarded-credit requests from abuse, the app uses Firebase App Check with Google Play Integrity. Google processes app and device integrity signals and technical information to issue an attestation token. Our gateway verifies the token alongside the Firebase sign-in token; we do not store the attestation token as a user profile or include it in application logs. Manual routine creation and local routine execution do not require AI attestation.

When you ask AI to modify an existing or partly completed routine, the app first asks you to confirm sending that current routine’s editable trigger, condition, action, and name settings with your request. Known password, API-key, authentication-token, certificate, and HTTP-header fields are replaced on the device with opaque placeholders; their original values stay on the device. Other routine text and settings (such as messages, addresses, URLs, or scripts) can still contain personal or sensitive information, so review them before confirming. Only the current editor draft is sent for that request, not your saved routine library, screen contents, contacts, or execution history. Information you type into the request, including any personal information, is transmitted. Avoid including passwords, API keys, financial details, or other unnecessary sensitive information. Generated drafts are returned for review; generation alone does not save or execute a routine.

Our gateway stores a fingerprint of each request and the generated draft, proposed changes, or clarification so repeat requests do not create duplicate charges. Drafts and clarifications can contain information from your input. The raw input text and existing-routine context are not stored as separate fields in our application database or deliberately included in our application logs.

We request store=false from OpenAI. This is not a guarantee of zero retention: OpenAI may retain API content for abuse monitoring, generally up to 30 days with exceptions described in its policy. OpenAI states that API data is not used for model training by default unless a customer opts in. See OpenAI API data controls.

Rewarded ads and AI credits

Optional rewarded ads use Google AdMob. Google's User Messaging Platform (UMP) manages regional advertising choices. These services may process IP address and approximate location, device and advertising identifiers, app/ad interactions, consent choices, and technical diagnostics for ad delivery, measurement, security, and fraud prevention.

To verify a reward, the app supplies its Firebase user identifier to Google AdMob. Google's signed server callback includes reward and transaction information. Our server keeps a hashed transaction identifier, a user reference, reward counts, credit balances, timestamps, and credit reservation/refund records to prevent duplicate or fraudulent rewards. The app does not grant a server credit solely because an ad screen reports completion.

Use the app's advertising privacy settings to review or change choices when UMP makes them available in your region, including consent withdrawal or applicable US state opt-out choices. You may also manage your advertising identifier in Android settings. Declining personalized advertising does not disable manual routine creation. See Google's Privacy Policy and Google's use of information from partner apps.

AI credit purchases use Google Play Billing. The app sends a hashed Firebase account identifier to Google Play to bind a purchase to your Automation account. Our server sends the purchase token to the Google Play Developer API to verify the product and completed payment before adding credits, and receives authenticated purchase/refund notifications. We do not receive full payment-card details. Advertising and purchased credits share one account balance. Signing in to the same Google account restores that account's remaining balance. Switching accounts does not transfer credits. Switching accounts does not transfer another account's credits.

Pending or cancelled payments do not grant credits. Refunded or charged-back purchases have their credits revoked; if those credits were already spent, the shortfall is offset against later credit grants. For purchase or refund help, contact AnyDroid support or use Google Play refund support. Applicable Google Play refund rules and statutory rights apply. Uninstalling the app does not request a refund.

Service operations and sharing

Firebase Authentication and Google Cloud services process account identifiers and, for Google-linked accounts, basic profile information, request metadata, timestamps, IP/network information, server errors, usage limits, and cost records to operate and secure the AI and reward services. Our application logs are designed to omit AI prompt text, authentication tokens, and generated routine content; infrastructure access logs can contain network and request metadata.

We use information to deliver requested features, verify credits, prevent abuse and duplicate requests, maintain reliability, and respond to support. Google and OpenAI process information as described above. Recipients of user-configured routines and services you choose handle data under their own policies. We may also disclose information when required by law or to protect rights and security. We do not sell routine contents or AI requests to data brokers. Advertising processing may qualify as sharing or targeted advertising under some laws; available choices are provided through UMP.

Our gateway and database are hosted in South Korea. Providers may also process information in other countries, including the United States. Applicable provider agreements and safeguards govern these transfers. Depending on the activity and applicable law, processing relies on providing the service you request, consent, legitimate interests in security and service operation, or legal obligations.

Retention, deletion, and your choices

Local app data remains until you delete it, clear app storage, or uninstall. Files or backups you export and messages you send remain at their chosen destinations. Android app cloud backup is disabled by the app.

Cached AI drafts and clarifications expire after 7 days from request acceptance. Expired content is no longer returned and is removed by our hourly cleanup. Minimal hashed request records are removed after 90 days from acceptance. Request-limit counters expire after 48 hours; reward transaction metadata and individual API cost records expire after 90 days. Ordinary application and access logs use a 30-day retention setting. Aggregate cost totals that do not identify users are retained for budget accounting. Google-linked Automation accounts and unused AI credits remain until you request deletion. Purchase receipts, including purchase tokens, product identifiers, account references, completion/consumption state, refund state, and timestamps, are retained while the account exists to restore balances, recover incomplete fulfillment, process refunds, and prevent duplicate credit grants.

Delete your AI account and server data: in Automation, open advertising privacy settings and choose AI 서버 데이터 삭제 (Delete AI server data), then confirm. This requests deletion of the currently signed-in Automation AI account, its generated results, and all remaining credits, including purchased credits. For a Google-linked account, deletion affects the balance on all devices using that account; it does not delete your Google account. Account deletion is not a Google Play refund request. Access is blocked as soon as the request is accepted. Our hourly cleanup normally removes the account's operational data and requests Firebase account deletion within 24 hours. Failed cleanup is retried and monitored. The app signs out. You must sign in again to use AI; until deletion is complete the original app account remains blocked. After deletion, signing in creates a new app account without the previous credits. Your Google account itself is not deleted. Saved routines on your device are not deleted.

During deletion we unlink reward records from the account and retain only minimal transaction hashes until their original 90-day expiry. Purchase tokens and account references are removed during account deletion. We retain a minimal, non-expiring purchase-token hash marked as deleted to prevent an erased purchase from granting credits again; it does not retain the Google account identifier or the original token. A hashed deletion marker is retained for 90 days after successful deletion to prevent delayed requests from recreating data. Incomplete deletion requests remain queued until resolved. Clearing app storage or uninstalling does not itself delete server data. Retention is enforced by scheduled cleanup, so physical removal may occur after the stated expiry.

Our operational deletion target does not mean that all service-provider backups are erased within 24 hours. Firebase states that authentication data is removed from its live and backup systems within 180 days after a deletion request. Certain Google Cloud required audit logs have a fixed 400-day retention. OpenAI's independent retention is described above. See Firebase privacy and security and Google Cloud log retention.

To request access, correction, deletion, restriction, or another applicable privacy right, email support@anydroid.com and identify Automation. We may ask for information necessary to locate and verify the relevant Automation account, but never your password or API key. Please contact us before clearing app data if you need help identifying server records. Deletion of the Automation identity or its credit records can remove access to remaining credits. Some records may need to be retained for security or legal reasons; we will explain applicable limitations.

You can stop AI use, avoid rewarded ads, delete routines, revoke Android permissions and special access, or uninstall the app. You may withdraw advertising consent through the available privacy controls. Depending on your location, you may also object to processing, appeal a privacy decision, or complain to your local data protection authority. We use encrypted connections and restricted server access, but no system can guarantee absolute security.

Children, support, and policy changes

Automation is not directed to children under 13 or the applicable minimum age in their region. If you believe a child has provided personal information to our online services, contact us so we can investigate and address it.

If you email support, we receive the contents and contact information you choose to send and retain them as needed to resolve the request and maintain relevant support records. We may update this policy as the app or its services change. The effective date above identifies the current version; material changes will be communicated where required.