Privacy Policy

1. Who we are and what this covers

This policy explains how the NextUp Android app (package com.nextup.calendarwidget), its home-screen widgets, and the website nextup-widget.com handle information. NextUp is developed and published by Clockworks ("we", "us"), which is responsible for the app and, where data protection law uses the term, is the data controller. For privacy questions, see Contact.

NextUp is designed so that we don't collect personal data at all: the app has no user accounts and no analytics, and sends nothing to us. Our only server-side part is a private tool we use to send sale and announcement notifications (section 2.9), which receives no data from the app. Where this policy describes data being "used", that processing happens on your device, or between your device and the services named in section 5.

2. Data NextUp uses

2.1 Calendar events (all users)

With your permission, NextUp reads the calendars synced to your phone through Android's calendar provider, for example from Google, Microsoft Exchange/Outlook or Samsung accounts. It reads:

• calendar names, colours and identifiers, so you can choose which calendars each widget shows;
• event titles, start and end times, time zone, all-day status, repeat rule, location, colour, availability (busy or free), event status (for example cancelled) and your own response (for example declined);
• an event's organiser and guests (their names, email addresses and responses), to show who is invited and to suggest guests you have invited before;
• event descriptions, to show them in full, to find a meeting link for the Join button and to apply the keyword filters you set;
• the reminders set on an event, to show them and so a notification rule can skip one your calendar app will send at the same moment.

Purpose: to show your upcoming agenda on your widgets and your day, week and month in NextUp's calendar, highlight what's happening now and next, hide declined or cancelled events if you ask it to, show an event's details when you tap it (or open it in your calendar app, if you prefer), and send the notification reminders you set up (section 2.6).

Changing your calendar: NextUp creates, edits, moves and deletes events, and answers invitations, only when you ask it to: adding an event, saving an edit, confirming a move, deleting an event or tapping Going? on an invitation. It makes each change through Android's calendar on your phone, exactly as your calendar app would, and the account that calendar belongs to (for example Google) then syncs it as it syncs any other change. When you add guests to an event on a Google calendar, Google sends them the invitation, not NextUp. Nothing else is changed, and NextUp never changes an event in the background.

Where it goes: nowhere. Calendar data is processed on your device only. A short-lived cache of your agenda and calendar is kept in app-private storage so widgets and the calendar can draw quickly; it is excluded from backups and is rebuilt from your calendar whenever it refreshes. So that you can undo a move, NextUp also keeps a short history of the moves you made in the last 24 hours (at most 30, with each event's or task's title and its old and new times), also on your device only and excluded from backups.

2.2 Google account and Google Tasks (optional, NextUp Pro)

If you choose Connect Tasks, NextUp shows an explanation, then Android's account picker, where you choose which Google account on your phone to connect, and then Google's own consent screen. We never see your Google password. You grant one permission (OAuth scope):

Which account: the account you pick on your phone identifies the connection, so NextUp keeps its email address to label it in settings, keep it separate from other connected accounts, and disconnect it. No other profile information, such as your name or picture, is requested or stored.

Where it goes: requests go directly from your phone to Google: to Google Play services on your device, which handles the connection, and to the Google Tasks API (tasks.googleapis.com). Nothing is routed through or copied to us. Task data is cached on your device the same way as calendar data (app-private, excluded from backups).

Credentials: NextUp stores no Google password and no sign-in tokens. Each time it needs to reach Google Tasks, it asks Google Play services on your phone for a short-lived access token for that account and uses it only for those requests. When you disconnect an account, NextUp asks Google to revoke its access, and removes the account and its cached tasks from the app. You can also revoke access from your Google Account at any time (section 9).

2.3 Purchases (NextUp Pro)

NextUp Pro is a one-time in-app purchase processed entirely by Google Play. We never receive your payment details, name or billing address. The app asks Google Play whether Pro is owned, and stores a record of the entitlement and the purchase token on your device (in Keystore-encrypted storage) so Pro keeps working offline. That record is deliberately excluded from backups; after a reinstall, Pro is restored by asking Google Play again. While a payment is still being processed (for example a slow card or cash at a shop), NextUp also notes on your device that it is pending, so it can tell you when it goes through or is declined. That note holds no payment details.

2.4 Settings and widget configuration

Your preferences (language, app theme, each widget's calendars, task lists, layout and colours, your notification rules, and small conveniences such as the calendar view you last used and the calendar or account you last added to) are stored on your device. They can include calendar and task list identifiers and the email addresses of connected Google accounts (with the colour you picked for each). They are never sent to us; see Backups for how Android may back them up to your own Google account.

2.5 App updates

Besides full releases through Google Play, small fixes can be delivered as over-the-air updates using Expo Application Services (EAS Update), run by 650 Industries, Inc. ("Expo"). While you have NextUp open, and at most once an hour after a check that gets an answer, the app asks Expo's update server (u.expo.dev) whether a newer version exists, and downloads it to apply the next time the app starts. A check that fails, with no connection for example, is tried again the next time you open the app. It never checks when only a widget is refreshing in the background.

What is sent: like any internet request, your IP address, plus the platform (Android), the app's version and release channel, the identifier of the update currently installed, and a random installation ID generated on your device. That ID is not linked to your name, email, Google account or anything in your calendar; it lets Expo roll out updates gradually and show us aggregate counts of how many installs run each update. If the app could not open its stored updates on your device, the next check also carries the text of that startup error once, up to 1,024 characters (an error name and a file path on your phone), and it is deleted when it is sent. No calendar, task, account or settings data is ever included.

2.6 Notification reminders (optional)

If you turn on notification rules, NextUp builds reminders on your device from your calendar events and, with NextUp Pro, your Google Tasks: an event's title and start time, or a list of the tasks that are due, shown as Android notifications. Your rules (which calendars, task accounts, keywords and times of day they cover) are stored with your settings (section 2.4). To schedule the reminders, NextUp keeps the upcoming ones in its private storage, excluded from backups, and rebuilds them whenever your calendar or rules change.

Where it goes: nowhere. Reminders are built and shown on your device, and nothing is sent to us or anyone else. On a locked phone, Android shows or hides their content according to your lock-screen notification settings. Each rule appears as its own notification category in Android's settings, so you can silence one without the others.

2.7 Contacts (optional)

When you add guests to an event, NextUp can suggest people from your contacts as you type. It asks for access the first time you go to add a guest, and never before. It reads only the names and email addresses of your contacts, on your device, to show these suggestions.

Where it goes: nowhere. Your contacts are never stored by NextUp, copied off your device, or shared. If you decline, NextUp suggests only people already invited to your own events, and doesn't ask again. You can revoke access at any time in Android's settings (section 9).

2.8 Links, places and other apps

When you tap a Join button, a link in an event's description, an event's place, or Open in Google Tasks, NextUp hands it to the app that opens it on your phone (your browser, your maps app, the video-call or Google Tasks app). For a place, that is the text of the event's location, so your maps app can find it. This only happens when you tap, and what that app or website does with it is governed by its own privacy policy.

2.9 Sale and announcement notifications

NextUp can receive two kinds of notification from us, each shown under its own category in Android's settings:

• Sales and offers: when NextUp Pro goes on sale where you buy it. Sent only while you don't have NextUp Pro, and you can switch it off in NextUp's Notification Hub (Sales on Pro).
• Announcements: news about NextUp, such as a new widget, sent to everyone.

How they reach you: through Google's Firebase Cloud Messaging. When NextUp starts, Firebase gives this installation of the app a random identifier and a registration token, which identify the app on your phone, not you. NextUp then subscribes it to topics, which is how a notification finds its phones: your language (to receive announcements in it) and, while you don't have NextUp Pro and the sale notifications are on, the country of your Google Play account (to receive a sale only where it runs). We send a notification to a topic, so we never receive your identifier, your token or any list of devices, and we have no way to send a notification to one person.

What a notification carries: a sale's name and when it ends, or an announcement's text. NextUp decides on your phone whether to show it: a sale is not shown if you have NextUp Pro or have switched sale notifications off. Google processes the identifier, the topics and delivery information (for example, whether a message was delivered) to provide the service, under the Firebase privacy and security terms.

Your choices: switch off Sales on Pro in the Notification Hub, or either category in Android Settings → Apps → NextUp → Notifications. Without the notification permission none of them show, and NextUp never asks for that permission for these notifications. Uninstalling the app ends its registration.

3. Android permissions

These are the permissions NextUp declares, and why. Only the calendar, contacts and notification permissions ask you directly.

NextUp explicitly blocks permissions it has no use for, even where a library it is built with would otherwise add them: "display over other apps", shared/external storage, vibration, biometrics/fingerprint and install-referrer access.

4. Google user data and the Limited Use requirements

Specifically, Google user data NextUp handles (your Google Tasks, and the email address of the Google account you connected):

• is used only to provide the user-facing features described in section 2.2: showing your tasks, and making the changes you ask for (marking them done, adding, editing, moving and deleting them);
• is not transferred to anyone, except to Google itself as needed to provide those features, or if required by applicable law;
• is never used for advertising, including personalised, retargeted or interest-based ads;
• is never sold, and never used to determine creditworthiness or for lending purposes;
• is never read by a human, and never used to train or improve artificial-intelligence or machine-learning models.

Because the data never reaches us, nobody at NextUp has the technical ability to read it.

5. Third parties

NextUp does not include advertising or analytics SDKs. The only third parties involved are:

• Google (Google Play, Google Play Billing, Google Play services and the Google Tasks API): to install and update the app, process the Pro purchase, connect your Google account, and provide Google Tasks if you connect it. Google's handling of your data is governed by the Google Privacy Policy.
• Google Firebase Cloud Messaging: delivers the sale and announcement notifications (section 2.9), under the Firebase privacy and security terms. NextUp includes Firebase Cloud Messaging only: no Firebase Analytics, Crashlytics or other Firebase service.
• Android and Google Play system services: if you have enabled device backup or chosen to share usage and diagnostics with Google, Android may back up app settings (section 7) or send Google crash and performance reports for all apps. These are controlled in your device settings, not by NextUp; any aggregate crash statistics we see in the Google Play Console do not identify you.
• Expo (650 Industries, Inc.): delivers over-the-air app updates (section 2.5). Expo's handling of that request data is governed by the Expo Privacy Policy.
• Your calendar provider: the accounts you have synced to your phone (for example Google or Microsoft) supply the events, and sync the changes you make in NextUp as they sync any other. NextUp reads and writes them locally, through Android's calendar, and does not contact those services itself.
• Apps and websites you open: a meeting, a link, a place or a task you tap opens in the app that handles it (section 2.8), under that app's or website's own privacy policy.
• Vercel: hosts this website and our notification tool (section 12).
• Upstash: stores our notification tool's record of what we sent (section 12). It holds no data about you.

We do not sell, rent, trade or share personal information with anyone.

6. Storage, security and retention

• All app data lives in NextUp's private storage on your device, which other apps cannot read.
• The Pro entitlement is encrypted with a key held in the Android Keystore. Your list of connected Google accounts (the email address and the colour you chose for each) is a plain file in that same private storage, and is not included in device backups. NextUp stores no Google sign-in tokens.
• To make a Google Tasks problem diagnosable, NextUp keeps a short record on your device of how Google Play services answered its requests for access: the time, the outcome and whether the app was open. At most 40 lines, with no email address, no token and no task content. It never leaves your device unless you send it (section 14).
• For the sale and announcement notifications, NextUp keeps in its private storage, excluded from backups, whether you have NextUp Pro, the notification texts in your language, the topics it subscribed to and the notifications already shown (section 2.9). The Sales on Pro switch itself is one of your settings: it is included in a backup, so it comes back as you left it (section 7).
• All network traffic, to Google and to Expo, uses HTTPS.
• Agenda caches are overwritten on every refresh and removed when you remove a widget or disconnect an account. The move history keeps only the last 24 hours.
• Everything NextUp stores is kept only until you delete it: disconnecting an account, clearing the app's storage in Android settings, or uninstalling the app removes it from your device.

No method of storage is perfectly secure, but because we hold no copy of your data, there is no NextUp server holding your data that could be breached.

7. Backups

If Android backup is turned on for your device, Android may back up NextUp's settings and widget configuration (section 2.4) to your own Google account, end-to-end encrypted by Android where your device supports it, so your widgets come back after you reinstall or move to a new phone. NextUp limits that backup deliberately: calendar events, tasks, agenda caches, the move history, scheduled reminders, your connected Google accounts, the Pro entitlement and the notification topics are excluded, and your contacts are never stored to begin with. Backups are managed by Google and your device settings; we cannot access them.

8. What we never do

• Upload your calendar events or tasks to any server of ours.
• Show ads or use advertising identifiers.
• Use analytics, fingerprinting, or crash-reporting SDKs.
• Access your location, camera, microphone, photos, files or SMS.
• Store, copy or upload your contacts.
• Sell or share personal data, or use it for profiling.
• Change your calendar or your tasks without you asking.
• Send notifications about anything other than a sale on NextUp Pro or news about NextUp, or send one to a single person.

9. Your choices and rights

Controls you have at any time

• Calendar access: Android Settings → Apps → NextUp → Permissions → Calendar.
• Contacts access: Android Settings → Apps → NextUp → Permissions → Contacts.
• Choose what's shown: pick calendars and task lists per widget in NextUp.
• Google accounts: disconnect in NextUp's settings, or revoke access from your Google Account at myaccount.google.com/connections.
• Reminders: turn them off in NextUp's Notification Hub, or in Android Settings → Apps → NextUp → Notifications, where each rule has its own category.
• Sale and announcement notifications: switch off Sales on Pro in NextUp's Notification Hub, or the Sales and offers and Announcements categories in Android Settings → Apps → NextUp → Notifications.
• Exact alarms (Android 12): Android Settings → Apps → NextUp → Alarms & reminders.
• Delete everything: Android Settings → Apps → NextUp → Storage → Clear storage, or uninstall the app. To remove a cloud backup, manage backups in your Google account.

Legal rights

Depending on where you live, for example under the EU/UK General Data Protection Regulation (GDPR) or California privacy law (CCPA/CPRA), you may have the right to access, correct, delete, restrict or port your personal data, to object to processing, to withdraw consent, and to lodge a complaint with your data protection authority.

Because NextUp does not collect personal data onto our systems, we generally hold no data about you to access or delete: the controls above let you exercise these rights directly on your device. If you have a question or a request, contact us and we will respond within 30 days. We do not sell or share personal information as those terms are defined under California law, and we will never discriminate against you for exercising your rights.

10. Legal bases (EEA and UK)

To the extent the GDPR applies to the processing performed by the app on your device:

• Contract (Art. 6(1)(b)): reading your calendar and tasks to provide the widgets and calendar you use, making the changes you ask for, and processing your Pro purchase;
• Consent (Art. 6(1)(a)): granting the calendar and contacts permissions and connecting a Google account, which you can withdraw at any time as described in section 9;
• Legitimate interests (Art. 6(1)(f)): keeping the website secure and available (section 12), delivering bug fixes through app updates (section 2.5), and telling you about sales on NextUp Pro and news about NextUp (section 2.9), which you can object to at any time by switching them off.

Where data is processed by Google (including Firebase) or Expo, including outside your country (for example in the United States), that is governed by their terms and their international data transfer safeguards.

11. Children

NextUp is a general productivity app and is not directed to children under 13 (or the minimum age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with information, contact us and we will delete it.

12. This website

nextup-widget.com is a static website hosted by Vercel Inc. It uses no cookies, no analytics and no third-party trackers, and loads no external fonts or scripts. It also hosts a private page we use to send the notifications in section 2.9: only we can log in to it, it sets a login cookie for us alone, and it keeps a record of what we sent (the text or the sale, the countries or languages, the time) with Upstash. That record holds no data about you. Like any web host, Vercel automatically processes technical request data, such as your IP address, browser user agent and the page requested, to deliver the site and protect it from abuse, and keeps these logs for a limited period. See the Vercel Privacy Policy. If you email us, see Contact for how we handle your message.

13. Changes and version history

If NextUp's handling of data changes (for example, a new feature that uses new data or permissions), we will update this policy before the change ships, increase its version number, and summarise what changed. Where a change is material, we will also tell you in the app or on Google Play before it takes effect. Every version is published at a permanent address and kept unchanged, so you can always compare versions on the version history page.

The current policy always lives at nextup-widget.com/privacy. This is version 1.0, permanently available at nextup-widget.com/privacy/v1.

14. Contact and bug reports

Questions, requests or concerns about privacy: privacy@nextup-widget.com.

Reporting a bug

NextUp never sends crash reports or diagnostics on its own, apart from the one startup error an update check can carry (section 2.5). If something isn't working, email bugs@nextup-widget.com. It helps to include your phone model, Android version, NextUp version (Android Settings → Apps → NextUp) and what you were doing when it happened.

You decide what to share. The "Report a bug" link in the app opens a draft in your own email app, pre-filled with the NextUp version, your Android version and, if you use Google Tasks, the short diagnostic record described in section 6. You can read and edit all of it, and nothing is sent until you press send. Screenshots of the app or a widget can show your event and task titles, so crop or blur anything private before attaching them.

Whatever you email us, whether a bug report or any other message, is used only to reply to you and to investigate and fix the problem. It is never shared, sold or used for anything else, and we delete it once the issue is resolved and it is no longer needed. Our mailboxes are provided by Cloudflare Email Routing, which forwards messages to our inbox.