Android Apps Privacy Policy
About this privacy policy
Task Venture Capital GmbH publishes the Android apps AGL, bellini, idp.global, invoice.bot, serve.zone, Skyglide, metadata.company, and nevermind.finance. This policy describes the native Android builds prepared on 30 October 2026.
For processing by Task Venture Capital GmbH, this supplement is read together with our general privacy policy at https://legal.task.vc/privacy. Privacy inquiries and requests concerning data we control can be sent to privacy@task.vc. Our address is Eickedorfer Vorweide 24, 28879 Grasberg, Germany.
App requests go to the service instance or controller configured for the app. Its operator controls the server records, integrations, and retention settings. When another operator runs that service, consult its privacy information before connecting. Signing in through an identity provider also involves that provider and its browser sign-in flow.
Request account or server data deletion
For an app account or other server data controlled by Task Venture Capital GmbH, request deletion by emailing privacy@task.vc. State the app name, the service instance address shown in the app, and the account identifier or contact address needed to locate your records. Do not send passwords, pairing secrets, private keys or recovery codes.
You can make this request without signing in, including after uninstalling the app. We may need to verify account ownership before removing an account or its associated data. The rights and statutory-retention qualifications in our general privacy policy apply, together with the app-specific retention and audit practices described below.
For a service instance operated by another organization, send the request to that operator. Task Venture Capital GmbH cannot erase records controlled by another operator or files held only on your device. The current local-only invoice.bot preview has no online app account; exported files remain under your control after uninstallation.
AGL — com.modelprofile.harness
AGL pairs your device with an AGL controller. It sends the device public key, device name and model, and the pairing information needed to authorize the device. It reads sessions, transcripts, events, and pending requests, and sends the messages, answers, permission decisions, and cancellations you submit.
The device signing key and pairing credentials are kept in app-private storage protected by the Android Keystore. The private signing key is not sent to the controller. The app does not request microphone, camera, or location access.
The controller stores device pairing records and audit events. Revoking a pairing removes its pairing record; existing audit events and conversations have separate retention. Conversation content can also be processed by the AI providers configured by the controller operator. Removing a pairing locally does not delete a controller conversation.
bellini — io.bellini.app
bellini signs in to your publication workspace. The app receives your account and organization information, publication access, article summaries and drafts, and writing-run status. It sends sign-in claims, run topics and settings, cancellations, and the draft or review status changes you choose to save.
The service can process writing topics and article content through the AI providers configured by its operator. Draft content is displayed as passive native text; the Android reader does not execute article scripts or load embedded remote resources.
Sign-in credentials are kept encrypted in app-private device storage. The Android app does not request camera, microphone, or location access. Signing out removes the local sign-in; it does not delete the organization, publication, articles, or server audit records. Ask the service operator about deletion of those records.
idp.global — global.idp.app
idp.global enrolls this device as a passport device. It sends the device public key, name, platform, capabilities, app version, enrollment information, and signed approval or alert-acknowledgment actions. It receives your passport profile, organization memberships, trusted-device information, approval challenges, and security alerts.
When a particular approval explicitly requires location evidence, the app asks for foreground approximate or precise location permission. If you approve that request, the location is sent to the IdP instance as evidence linked to the challenge and device. Ordinary approvals do not require location hardware. The app does not collect background location.
The device signing key and enrollment credentials are protected by the Android Keystore. Forgetting a device locally does not revoke its server authorization or delete your account. Use the instance web account to manage server device access. Challenge expiry does not itself delete stored challenge evidence; the operator controls retention and account-purge processing.
invoice.bot — bot.invoice.app
The current Android preview provides a local vault and setup, history, and teaching interfaces. Live supplier-portal browsing, provider calls, and automation are disabled while their network isolation is being qualified.
Vault information can include supplier addresses, usernames, passwords, one-time-password secrets, provider credentials, and local workflow records. App-managed vault material is encrypted on the device using Android Keystore protection. On supported devices, the vault device wrapping key is hardware-backed and non-exportable. Recovery exports contain wrapped vault keys and encrypted recovery records, which can include passkey private records.
The disabled portal and model-provider flows do not transmit vault credentials or invoice content in this build. Removing the app removes its app-private local data. It does not delete files you exported elsewhere or any separate supplier account. A later build enabling network automation will require an updated disclosure for those active data flows.
serve.zone — zone.serve.app
serve.zone connects to the Cloudly instances you add. It sends sign-in information and authenticated read requests, and receives cluster, node, service, deployment, health, and workload-log information. Logs can contain information belonging to the instance or its users; the instance operator controls that content.
Each instance origin and its current sign-in identity are stored together in encrypted app-private device storage. The app does not keep the Cloudly password. Refresh runs while the app is in the foreground. The app does not request camera, microphone, or location access.
Removing an instance from the app removes its local record and sign-in. It does not delete the Cloudly account, workloads, logs, or server audit data. The instance operator sets server retention and handles requests to delete that information.
Skyglide — com.skyglide.app
Skyglide sends device-authorization information, a device public key, enrollment credentials, and device/configuration requests to its configured controller. It receives membership, device, gateway, and network configuration information. The controller uses the connection source address to answer network-location checks; the Android app does not request GPS location.
When the VPN is active, the configured Skyglide gateway processes the routed network traffic and its destination information. Internet traffic is routed through that gateway when you enable Internet through Skyglide. The gateway and controller operators govern handling and retention of those network records.
The device private key stays on the device. Enrollment credentials and configuration are stored encrypted locally with Android Keystore protection, and automatic Android backup and device transfer are disabled. Removing the local enrollment does not itself delete the server device or membership account; use the controller account or contact its operator for those actions.
metadata.company — company.metadata.app
metadata.company sends company search terms, company identifiers, and authenticated read requests to the configured instance. It receives stored company records, history, source and licence notices, account and organization information, and quota information. Some company records can include information about identifiable people.
Public access depends on the instance service mode. Signing in uses the instance identity-provider flow. Native sign-in credentials are stored encrypted and bound to the selected instance origin. Recent lookup information is kept locally for app operation; the app does not request camera, microphone, or location access.
Signing out removes the local sign-in. It does not delete the identity-provider account, the instance account, public company records, or source-register information. Ask the relevant operator about account records, source-data correction, deletion, and server retention.
nevermind.finance — finance.nevermind.app
nevermind.finance pairs your device with a finance instance and receives account, membership, role, and book information. Depending on your access, it reads banking accounts and movements, invoices and customers, documents and vouchers, questions, corrections, and reminders. It sends the financial or bookkeeping actions you choose to submit.
The receipt scanner uses an Android camera app to capture pages or lets you select a PDF. Queued receipt PDFs and their recovery records are kept encrypted in app-private device storage. Raw camera JPEGs and temporary document or PDF previews use app-private temporary cache files. A selected receipt is sent to the finance instance over an authenticated file stream. Document extraction can send document content to the model provider configured by that instance operator.
The app keeps pairing credentials in Android Keystore-protected storage and disables automatic Android backup and device transfer. It does not read your contacts, SMS messages, or background location.
Signing out or removing the app does not delete the server books or accounting records. In the current service, a closed book with qualifying records becomes eligible for bulk-data purge after the end of the calendar year ten years after the latest relevant transmitted export, issued invoice, main-book entry, document, voucher, or advance return. Closed books without qualifying records become eligible after thirty days. The configured operator purge process determines when eligible bulk data is removed; an audit record is retained. Account and deletion requests are handled by the instance operator, subject to the applicable accounting retention requirements.
Security, local retention, and deletion
These Android builds include no advertising, analytics, or crash-reporting SDK. Public service connections use transport encryption. App-managed credentials are kept in app-private storage protected by the Android Keystore; automatic Android backup and device transfer of protected records are disabled.
Protected local credentials and persistent local records are retained until removed through the available app controls, uninstallation, or the app cache and history replacement rules. Temporary displayed records may be cleared earlier when the view, session, or app lifecycle changes. Files you deliberately export to another location remain there until you remove them. Removing local app data does not delete server accounts, shared content, audit evidence, or legally retained records.
Server data remains until the relevant operator retention or deletion process removes it. Expiring a session, enrollment grant, or approval challenge does not by itself promise deletion of associated audit evidence. For data controlled by Task Venture Capital GmbH, use privacy@task.vc to request access, correction, export, or deletion; the rights, statutory-retention qualifications, and contact procedure in our general privacy policy apply. For another operator, use that operator privacy contact.