Privacy Policy — Konjo

Last updated: August 7, 2026 | Effective date: August 7, 2026

Introduction

Konjo ("we", "our", "the app") is an ADHD-friendly productivity application designed to help you manage tasks, build habits, and stay focused. This Privacy Policy explains what data we collect, how we process and protect it, and your rights as a user.

By using Konjo, you agree to the collection and use of information as described in this policy.

Data We Collect

1. Account Data

Data	Purpose	Storage
Email address	Authentication, account recovery	Server (PostgreSQL)
Password	Authentication	Server (Argon2id hash — we never store plaintext)
First name, last name	Personalization (optional)	Device only
Profile photo	Display in app (optional)	Server (encrypted storage)

2. Productivity Data

Data	Purpose	Storage
Tasks	Task management (title, description, due dates, priority)	Device + Server (synced)
Habits	Habit tracking (name, frequency, completions, streaks)	Device + Server (synced)
Focus sessions	Pomodoro timer tracking (start, duration, completion)	Device + Server (synced)
XP events	Gamification progress (points earned, level, streaks)	Device + Server (synced)
Quick Notes	Fast text/image capture	Device + Server (synced)

3. Vault Data (Biometric-Protected)

Data	Purpose	Storage
Encrypted notes	Private note storage	Server (AES-256-GCM encrypted, per-user key)
Vault files	Private file storage	Server (encrypted storage)

Vault data is protected by biometric authentication (fingerprint/face) on your device. Without biometric verification, vault content cannot be accessed — even by us.

4. Device & Technical Data

Data	Purpose	Storage
Push notification token	Sending bedtime reminders and habit reminders	Server
Device type (Android)	Compatibility	Not stored persistently

5. Data We Do NOT Collect

Location data
Contacts or phone book
Call logs or SMS
Browser history
Advertising identifiers
Data from other apps
Biometric data (stays on device, never transmitted)

How We Use Your Data

Provide the service — Store and sync your tasks, habits, and productivity data across sessions
Authentication — Verify your identity securely via JWT tokens
Notifications — Send bedtime reminders and habit check-in notifications you configure
Gamification — Calculate XP, levels, and streaks based on your activity
Analytics — Show YOU your own productivity patterns (Focus Buddy insights). We do not analyze your data for our purposes.

We do NOT use your data for:

Advertising or ad targeting
Selling to third parties
AI/ML model training
User profiling for external services
Device fingerprinting

Data Storage & Security

Offline-First Architecture

Konjo is designed to work offline. Your data is stored locally on your device (SQLite database) as the primary source of truth. When internet is available, data syncs to our servers every 30 seconds.

Encryption

Layer	Protection
In transit	HTTPS/TLS for all server communication
Passwords	Argon2id hashing (16-byte salt, 64MB memory, 3 iterations)
Vault notes	AES-256-GCM with per-user key derived via HKDF
Vault files	Stored in encrypted S3-compatible storage
Tokens	JWT access tokens (15-min expiry) + opaque refresh tokens in Redis
Device storage	Hardware-backed keystore for tokens (Android Keystore)

Access Controls

Every API request is authenticated via JWT
Every data query enforces user ownership — you can only access your own data
Rate limiting protects against brute-force attacks (5 requests per minute on auth endpoints)
Admin accounts have no access to user vault data (encrypted with per-user keys)

Data Sync & Conflict Resolution

When you use Konjo on multiple devices or after being offline:

Changes sync automatically when connectivity is restored
Conflicts are resolved using "last-write-wins" (server timestamp)
A local conflict log is maintained for transparency
You can use the app fully without internet — nothing is lost

Data Sharing

We do NOT share your personal data with third parties, with the following exceptions:

Infrastructure providers — Your encrypted data is stored on servers we operate. Server providers do not have access to decryption keys.
Legal requirements — We may disclose data if required by law, court order, or to protect safety.

We do NOT:

Sell your data
Share data with advertisers
Use third-party analytics SDKs
Embed social media trackers

Your Rights

You have the right to:

Right	How to Exercise
Access your data	Export available in-app (planned)
Correct your data	Edit tasks, habits, notes directly in the app
Delete your data	Delete your account — all data removed within 30 days
Portability	Request a copy of your data in machine-readable format
Withdraw consent	Uninstall the app and/or delete your account

To exercise data portability or account deletion, contact: admin@konjo.com.es

Data Retention

Active account: Data retained while your account exists
Deleted account: All server-side data permanently deleted within 30 days
Local data: Removed when you uninstall the app
Soft-deleted items: Purged from server within 30 days
Refresh tokens: Expire after 30 days automatically

Children's Privacy

Konjo is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately at admin@konjo.com.es and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted in the app and on this page. Your continued use of Konjo after changes constitutes acceptance of the updated policy.

Material changes (e.g., new data collection, sharing with third parties) will be communicated via in-app notification at least 14 days before taking effect.

Contact

For privacy questions, data requests, or concerns:

Email: admin@konjo.com.es
Subject line: "Privacy Request — [Your Request]"

We aim to respond to all privacy requests within 30 days.

Jurisdiction

This policy is governed by the laws of Spain and the European Union. For EU residents, data processing complies with GDPR requirements.