LarasSpa - Privacy Policy

Effective: 2026-08-30

1. Controller

The controller for data processing under the GDPR is:

Lara Knuth - Dresden AI Insights
Kurhausstr. 16, 01259 Dresden, Germany
Phone: +49 1567 8333414
Email: support@larasdesk.com
VAT ID: DE458852148
Small-business operator under Section 19 UStG (German VAT Act).

2. Scope

This privacy policy applies to the Android app LarasSpa (Android package: de.laraspa). LarasSpa shows app usage patterns, focus sessions and voluntary app limits. Processing takes place locally in the app; only an export you deliberately start hands a copy to the storage location you choose.

3. Summary

LarasSpa does not transfer data automatically to the provider. There is no account, no registration, no cookies, no ads, no third-party analytics, no telemetry and no app-operated cloud. The app has no internet permission and makes no network requests of its own. You can, however, deliberately hand a JSON export to an Android DocumentsProvider you choose; that provider may be cloud-backed.

4. Data processed

LarasSpa processes the following data exclusively locally on the device:

Package names, optional activity class names, timestamps, foreground/background, lock, and screen events read from Android Usage Access when needed. LarasSpa locally derives usage duration, sessions, reopens, first use after unlock, and night or long-use signals from them.
Focus sessions you start (duration, completion), counted locally.
Voluntary app limits you set, including the relevant package name.
Your answers to the two optional reflection questions, if you answer them.
Locally derived daily pattern values with risk, protective and net scores and the associated reasons.

Android's raw usage history remains in the system store and is queried only when needed; LarasSpa does not duplicate it as a raw-event history. The local Room database stores limits, focus sessions, settings, reflection answers, and derived daily values. There is no automatic upload to LarasDesk servers or third parties.

5. Usage access (PACKAGE_USAGE_STATS)

LarasSpa uses Android Usage Access PACKAGE_USAGE_STATS to show your app usage on the device and locally derive the sessions, signals, and pattern values described in section 4. Access is granted in Android system settings and can be revoked there at any time. Without Usage Access, LarasSpa shows no usage data and cannot update these derived values; the rest of the app keeps working.

6. No network connections

LarasSpa declares no internet permission in its Android manifest and makes no first-party network requests. There is no account, telemetry, analytics, advertising, crash reporting, Firebase, app-owned cloud, or automatic LarasSpa synchronisation. Android system backup and the deliberately selected export are described separately in sections 7 and 8. Cleartext network traffic is disabled (android:usesCleartextTraffic="false").

7. Export

An export only happens if you start it yourself in settings. The JSON file contains app limits including package names, focus sessions and timestamps, settings, pattern values and their reasons, and optional reflection answers; Android's raw Usage Access history is not included. The export runs through the Android Storage Access Framework to a location you choose. The selected DocumentsProvider may be local or cloud-backed; after hand-off, the selected destination processes the copy under its own terms. LarasSpa does not upload anything automatically.

8. Local storage and backup

LarasSpa stores the Room database and other app settings locally in Android's app-private storage. The app does not create a copy on servers controlled by the LarasSpa provider. This describes Android's access isolation and is not a promise of additional encryption by LarasSpa.

Room data remains stored until you use “Delete local data” in LarasSpa, clear the app data in Android settings, or uninstall LarasSpa. The in-app action removes Room data but not the separately stored app-language preference; that preference remains until you clear the Android app data or uninstall the app. The Room database is excluded from Android system backups and device transfers by the app configuration (android:allowBackup="false", android:fullBackupContent="false", android:dataExtractionRules).

Android's own usage history follows the operating system's retention and deletion rules. Exported copies remain at the selected destination until they are deleted there and follow that destination's or DocumentsProvider's storage, backup, security, and deletion rules.

9. What does not happen

No app blocking, no overlays, no accessibility service, no device admin features.
No push notifications, no ads, no in-app purchases.
No app-owned cloud, account, automatic LarasSpa synchronisation, or tracking across apps or devices; a deliberate export may target a cloud-backed DocumentsProvider.
LarasSpa contains a voluntary donation notice. Only when you tap it does Android open the donation link in your browser at PayPal; the app itself establishes no connection and does not learn whether you donate. Processing from the browser call onwards is governed by PayPal's privacy policy.

10. Your rights

You have the rights to access, rectification, erasure, restriction of processing, data portability, objection, and to lodge a complaint with the competent supervisory authority. Because LarasSpa does not transfer data automatically to the provider, access and erasure of app data are effectively local. The in-app deletion removes Room records; the app language, Android usage history, and exported copies must be deleted through their respective controls or destination.

11. Contact

Please direct data processing enquiries to support@larasdesk.com or call +49 1567 8333414.

Data submitted when you contact us by email or telephone — for a call, this includes your number and the information you provide during the conversation — is processed solely to handle your enquiry and the associated technical administration. Calls are not recorded. The legal basis is our legitimate interest in answering your enquiry under Art. 6(1)(f) GDPR; where your contact is aimed at concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis. Your data is deleted once the enquiry has been dealt with, unless statutory retention obligations require otherwise.

12. Changes to this privacy policy

This policy will be updated if processing, storage, export, or a later feature scope changes.