Cistella Privacy Policy

Effective date: October 24, 2026

This Privacy Policy explains how Cistella: Project Tracker ("Cistella") handles information when you use the app. Cistella is provided by Daniel Dahlén, an independent developer based in Sweden ("the developer").

Information you create in Cistella

Cistella stores the information you enter, including workspaces, projects, tasks, parts, suppliers and links, costs and budgets, notes, journal entries, time records, photos and captions, and settings. The phone is the primary store for this information. Optional backups, exports and Desktop Access can create or transmit additional copies as described below. The developer does not operate a server-side Cistella project database or require a Cistella account.

Photos and media

Cistella does not request broad photo-library access. Photos you import through system selection or camera flows are copied into private app storage without modifying or deleting the original gallery file. This behavior was introduced in Android build 7 (1.0.0+7). Existing photo records are not automatically migrated, and older records may still refer to temporary files.

The storage copy does not strip embedded photo metadata. Depending on the source and system picker, photos may retain information such as capture dates, camera details or location tags. This information can travel with photo bytes in backups, exports and Desktop Access. Cistella does not use these features to obtain your device's live location.

Google Drive backups

Connecting Google Drive is optional. You can use core project tracking without connecting Google. Authorizing Drive does not create a separate Cistella account.

Google data we access

Cistella requests the https://www.googleapis.com/auth/drive.appdata permission to create, list, download and delete Cistella backup files in your Google Drive app data storage, separate from your general Drive files. This includes backup contents and file IDs, names, creation times and sizes. Cistella does not request access to your entire Google Drive.

Google Sign-In can provide your email address and display name to identify the connected account. Cistella uses Google authorization credentials to make Drive requests; the Google sign-in software manages the connection information needed to reconnect. You authorize access through Google, not by giving Cistella your Google password.

How we use Google data

Cistella uses this access to upload backups, show available backups, download a backup for restore, and delete backups you select or older backups covered by your configured retention setting. Account information identifies the connection, and file metadata identifies and orders the available backups. Restoring a backup brings its project content back into local app storage.

Sharing and transfer of Google data

The Drive integration transfers backup files directly between your device and Google, not through a developer-operated backup server. Google receives the backup files and requests needed to provide this service and handles them under its privacy policy. Restored content can subsequently be included in exports or shared with an authorized Desktop Access browser as described below. Contacting support is a separate action; send only information you choose to disclose.

Cistella does not sell Google user data or use it for advertising. The Drive integration is for backup and restore, not for transferring your Google data to advertisers or data brokers.

Protection of Google data

Backups can include your project records, photos, settings and file metadata. If you enable automatic backups, backups can run without another manual upload action. Drive transfers use HTTPS. You can choose password-encrypted or unencrypted backup archives; an unencrypted archive can be read by someone who obtains that file. Encrypted archives still have visible envelope information, such as file size and format metadata.

Starting with build 15 (1.0.0+15), new encrypted backups use standard AES-256 ZIP encryption around one backup.zip payload. Compatible tools decrypt that entry and then open the inner ZIP. Project/photo filenames stay inside the encrypted payload; outer filenames, sizes and timestamps remain visible. Standard ZIP AES uses 1,000-iteration PBKDF2-HMAC-SHA1, with weaker password-guessing resistance than the previous custom format: choose a strong, unique passphrase. Older backup formats remain supported for restore, not new encrypted exports; existing archives are not converted. Older app builds are not promised to read the new format. Prepared for closed testing; Google Play availability is separate.

Retention, deletion and revoking access

Starting with build 15, the keep count applies separately to Google Drive and new automatic local backups. Local cleanup follows a successful automatic save and preserves that new backup, manual local saves, exported files and legacy or ambiguous local backups. Failed or unsafe cleanup can leave extra copies. Existing Google Drive retention is unchanged; earlier builds keep their previous local behavior until updated.

Drive backups remain until deleted by you or by successful backup cleanup; there is no fixed time-based expiry in Cistella. Disconnecting Google Drive does not automatically delete existing backups. Backup cleanup can fail, so a configured keep count is not a guarantee that only that number of files remains. Review and delete unwanted backups separately.

Disable automatic backups before deleting copies if you do not want new ones created. While connected, delete unwanted Drive backups using Cistella's backup management screens and check that deletion succeeded. Disconnect in Cistella settings to end the app connection. You can separately revoke authorization in your Google Account's third-party connections settings; revoking access does not delete backups or restored local data. See Cistella Data Deletion for Drive app data, local records and external copies. Google controls retention of its own service records.

Local exports and Android system backup

Starting with build 15, native theme JSON save/open uses system pickers. Exported files contain all custom themes, not project records, photos or built-in templates. You choose a destination offered by the picker, which may include configured document providers. These copies have a separate lifetime from the app's theme catalog. Repeated imports skip unchanged matching themes; existing themes and older duplicate entries are not deleted.

You can save backup archives outside the app and download photos or backups through Desktop Access. These copies remain wherever you or the receiving browser save them and are not removed when you later delete a Cistella record.

Android system backup and device-to-device transfer are separate from Cistella's optional Drive connection. Cistella has not disabled Android's default backup participation; eligible app data may be backed up or transferred depending on your Android version, device provider and system settings. This does not mean a backup occurs on every device. Manage these copies and settings through Android and the relevant provider.

Purchases

Premium purchases are processed by Google Play. Cistella uses purchase and ownership information to unlock, confirm and restore Premium features. Its Google Play integration performs startup ownership checks and product queries, as well as checks following purchase, restore or redemption actions. Contact with Google Play is not limited to making a new purchase. Cistella does not receive your payment-card or bank-account details from Google Play.

Google's billing software also includes technical diagnostics that can transmit API results or errors, app and SDK versions, device and network context, and client-session identifiers to Google. Reports may be queued locally, and this reporting is not controlled by the optional Drive connection. Google handles its services and associated records under its applicable terms and privacy policy. These technical reports are distinct from using your project content for advertising.

Desktop Access

Desktop Access is an optional, user-started phone-hosted server. An authorized browser can receive project records and photos, send edits or uploads, and download files. You can stop the session from the app or its Android notification. This does not upload your project database to a developer-operated cloud service.

The current local-network connection uses HTTP, not an encrypted HTTPS connection. A PIN controls access but does not encrypt the browser connection. Someone able to observe or interfere with that network may see or alter transferred content or session credentials. Use only a network and devices you trust; network trust does not provide encryption. Stopping a session does not erase files already downloaded or guarantee removal of content retained by a browser.

External images and links

An external image embedded in Markdown notes is requested only after you tap to load it; the image host is shown before loading. This tap-to-load behavior was introduced in build 7. That host receives the requested URL and network information such as your IP address, and may retain information under its own policies. An HTTP image URL is not encrypted in transit. Versions before build 7 may load external images when notes are viewed without this separate tap. Ordinary attached project photos do not need an external image-host request.

Opening an external supplier, help or other website link takes you to that destination, whose own privacy practices apply.

Notifications

Cistella may use notifications for app features such as timers or foreground services. Notifications are used to support app functionality and are not used for advertising.

Analytics and advertising

Cistella does not include third-party advertising. We do not sell your personal information. Cistella does not use your project data for third-party advertising or tracking.

How information is protected

Cistella uses app storage and platform access controls for local records and copies. Optional password-encrypted backups protect archive contents, not every connection or all visible file metadata. Keep your device and backup passwords secure. Cistella does not claim that all data is encrypted in transit: Desktop Access and HTTP external-image requests have the limitations described above.

Retaining and deleting information

Project records remain on the device until you remove them or clear app storage. Items in Trash remain until you restore or permanently delete them; there is no automatic Trash expiry. Deleting an individual record can leave app-owned photo files without a remaining record. Interrupted imports can also leave unused files. Clearing app storage removes the app's local records and private files, but is not a promise of forensic erasure or deletion of external copies.

Backups, exports, gallery originals, browser downloads and system-managed copies have separate lifetimes. Disconnecting a service or removing a record does not remove those copies. Google controls retention of its purchase and service records; Cistella cannot delete them by clearing local app data. See Cistella Data Deletion for the separate controls.

If you contact support, the information you choose to send is used to respond to your request. Do not send passwords or sensitive backup contents. You can ask about deletion of your support correspondence using the contact below; any retention needed to handle the request or meet legal obligations will be explained in the response.

Your choices

Children's privacy

Cistella is not directed to children under 13. Cistella does not knowingly collect children's personal information. If you are a parent or guardian and believe a child has used Cistella in a way that requires privacy support, contact us so we can help address the issue.

Changes to this policy

This policy may be updated from time to time. Updates will be posted at https://agentlehand.com/cistella/privacy-policy/.

Contact

If you have privacy questions or requests, contact: [email protected].