Privacy Policy for DagDroid

Last Updated: June 22 2025

This Privacy Policy describes how DagDroid ("we", "us", or "our") collects, uses, and discloses information when you use our Android application, DagDroid (the "App").

Information We Do Not Collect or Store on Our Servers

• Your Airflow credentials and Web‑Server URI: The URI and any username/password or token you provide are stored only on your device (in encrypted preferences/KeyStore where available). They are never transmitted to or stored by DagDroid.
• Data fetched from Airflow (e.g. DAG names, run statuses, logs, task details, and DAG Python code). These items are processed locally and never copied to our servers.
• Analytics or Technical Usage Data: DagDroid does not collect analytics events, screen‑usage metrics, unique device identifiers, or similar telemetry.

Information We May Collect

DagDroid may collect crash‑diagnostic data only when the App unexpectedly terminates:

• Crash Reports: Stack traces and limited device state at the moment of a crash, captured through Google Play or Firebase Crashlytics (if enabled). No personal content such as Airflow data or DAG code is included.

Google User Data We Access

Signing in with Google grants the App the https://www.googleapis.com/auth/cloud-platform scope so that it can authenticate with Google Cloud. We access only the following Google user data:

• Google Account email address – obtained once at sign‑in to recognise which Google account is authorised. It is saved locally on your device (encrypted where the OS allows) and is never displayed or transmitted to DagDroid servers.
• OAuth 2.0 access and refresh tokens – short‑lived credentials needed to call Google Cloud and Airflow REST APIs. Tokens exist only in volatile memory during your session and are discarded when you remove the cluster or close the App. They are not persisted to storage.

Why We Need This Data

• To authenticate REST calls from your device to Airflow.
• To recognise which Google account is authorised.

Storage & Retention

The Google Account email is stored securely on your device to streamline future sign‑ins. OAuth tokens remain only in memory and are automatically cleared when the token expires, you remove the cluster or exit the App. No Google user data is ever copied to DagDroid servers or shared with third parties.

Revoking Access

You can revoke DagDroid’s access at any time from your Google Account’s security settings or by removing the cluster inside the App. Removing the cluster erases the stored email and clears OAuth tokens from memory.

Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to anyone. Crash Reports may be sent to crash‑reporting service providers (e.g. Google Play/Firebase Crashlytics) solely so we can diagnose and fix bugs. These providers must use the reports only to provide their services to us and may not use them for advertising or other purposes.

We may disclose information if required by law or to protect our rights, your safety, or the safety of others.

Data Security

We implement industry‑standard security measures. However, no method of electronic storage or transmission is completely secure, so we cannot guarantee absolute security.

Your Rights

Depending on your jurisdiction, you may have rights to access, correct, or delete the limited data we hold. Contact us using the email below to exercise these rights.

Children’s Privacy

DagDroid is not intended for children under 13. We do not knowingly collect personal information from children.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new policy here and update the “Last Updated” date. We encourage you to review it regularly.

Contact Us

If you have any questions, please contact us at [email protected].