Privacy

Rhypple is a workspace for notes, tasks, tags, bookmarks and time tracking. You can create and use a local V2 workspace without signing in. Google Drive, Calendar and timer notifications are optional features.

Data on your phone

Your local workspace content, edit history, drafts, pending edits, database information, preferences, supported attachments and downloaded workspace caches are stored in the app's private device storage. Signing out does not erase local copies or pending edits. Rhypple's activity charts and database search are calculated on your phone from workspace records. The app does not upload these records for product usage analytics.

The standalone app does not request access to your installed-app inventory, contacts, phone location or other apps' notifications. It does not provide a launcher, host other apps' widgets, or upload an installed-app list.

Optional Calendar and timer notifications

The Calendar view requests Android calendar permission when you use it. It reads events available through the phone's calendar provider to show event details and offer reviewed note or time-tracking capture. Calendar browsing does not upload your calendar to Rhypple. If you choose to save information from an event into a Drive workspace, the saved note or timer information follows that workspace's sync settings.

Optional timer notifications use your own timer state to display reminders and actions. They do not grant access to other apps' notifications. You can control timer notifications in Rhypple and Android settings. Android permission names and settings locations can vary by device.

Optional Google sign-in and Google Drive

If you connect Google Drive, Google sign-in provides your account identifier, email address, display name and profile picture information. Rhypple uses these to identify your selected account and keep workspaces bound to the correct account. OAuth access and refresh tokens are stored encrypted on the phone using Android Keystore.

The app requests Google Drive app-data access and access to files created or selected for use with Rhypple, together with your Google profile and email. Personal workspace files may use Google's hidden app-data area. An existing shared workspace may use a visible Drive folder; Google's sharing permissions determine who can access that folder.

When you select Drive storage or connect a Drive workspace, Rhypple sends workspace content, database metadata, edit history, generated sync-device identifiers and supported attachment bundles to Google Drive. Content can include notes, tags, tasks, bookmark URLs and timer records. Supported attachments can contain documents, images, video, audio or other files. Copies may be cached privately on your phone. A local database remains local unless you choose to publish, share or export it.

Google processes files under its own privacy policy and your account settings. Rhypple accesses them to create, find, open, update and sync your selected workspace. This app does not upload Drive workspace content to a Rhypple-hosted workspace-content server.

Rhypple's HTTPS token-exchange endpoint, hosted on Netlify, processes Google authorization codes and refresh tokens to complete sign-in and renew access. Network infrastructure may process routine connection information, including source IP addresses and request metadata. This endpoint does not store your notes or attachments. Network fallback may query Google or Cloudflare DNS-over-HTTPS services for service hostnames, rather than your workspace content or browsing history.

Sharing, import and export

Text or links you deliberately share from another app become drafts you can review before saving. Saving into a Drive workspace includes that content in its sync. Database import and export use the file destination you select through Android. Files saved outside the app's private storage can remain at that destination or be accessed by the app or service you choose, under its own policy.

Optional PostHog beta analytics

During beta testing, optional usage analytics helps us understand which features are useful and where the app needs improvement. Usage analytics and approximate location from network IP are enabled by default, separately from your workspace charts. Limited product events are sent to PostHog in the EU over HTTPS: fixed screen categories, foreground time on those screens and fixed feature actions such as creating notes or trackers, controlling timers, using database search, applying tags, and sync activity. Events include app version, product and platform, timestamps, and random installation and session reporting identifiers.

Analytics does not include note or task content, titles, tag names, search text, result identities, database or item identifiers, Google account details, attachments, calendar event content, installed-app names or lists, or screen recordings. There is no automatic click capture, session replay, advertising identifier SDK or advertising. The app does not identify you to PostHog or create person profiles.

A random reporting identifier can link events from this installation until sharing is disabled or reset. Reports are pseudonymous rather than a promise of complete anonymity. Turn off usage analytics in Settings → PostHog analytics to stop recording, clear unsent events and the local reporting identifier, and cancel pending requests where possible. Requests already received cannot be undone by the switch, and switching off does not delete previously received events. Re-enabling analytics creates a new random reporting identifier.

The local queue retains up to 1,000 events for up to seven days, in batches of up to 50. Retries back off to at most 30 minutes. Events may be omitted while the queue is full. Foreground time is checkpointed every 30 seconds and on visibility changes; abrupt termination can lose the final unfinished slice. These local limits do not set PostHog's server retention period.

When approximate-location sharing is enabled, PostHog uses the network IP address of the analytics connection to estimate a location such as country, region or city and associates that estimate with product events. The estimate reflects the connection used when events are uploaded; events queued offline may be uploaded later from a different network. This is IP-based GeoIP enrichment, not GPS or the phone’s location services, and it does not require Android location permission. Estimates may be inaccurate, including when you use a VPN or mobile network. The standalone app does not request Android location permission. Network infrastructure also processes routine connection information, including the source IP address.

In Settings → PostHog analytics, you can turn “Approximate location” off while continuing to share usage events, or turn “Beta usage analytics” off entirely. Turning off approximate-location sharing prevents enrichment of future analytics events; it does not erase location estimates already received. We plan to discontinue this usage tracking after beta testing. No end date is set, and ending beta tracking would not itself delete previously received reports.

Retention, deletion and security

Local workspaces, cached copies, drafts, pending changes and preferences remain until you remove them, clear the app's storage or uninstall it. Removing the app does not delete files from Drive or an export destination. Use Google's controls for the corresponding app-data area or shared folder to remove Drive workspace files. Revoking Rhypple in your Google account's third-party connections settings stops future authorized access but does not itself delete existing files.

App-managed sign-in, token exchange, Drive sync, updates, analytics and DNS-over-HTTPS use encrypted HTTPS connections. Credentials are encrypted locally with Android Keystore. This does not mean the SQLite workspace or a Drive backup is end-to-end encrypted. Android protects local app storage; shared Drive access follows Google permissions.

For support or help identifying and removing Rhypple data, contact rhypple.app@gmail.com. Do not send passwords, access tokens or private database files. We may update this policy when the app's features or data handling change; the date above identifies this text. Website: rhypple.app.

Product usage analytics in native Rhypple for iOS is enabled by default. It sends limited usage summaries to PostHog in the EU over HTTPS. This is separate from the app’s activity charts, which are calculated from your workspace records.

The summaries contain fixed counts of features such as timer starts and stops, note, task and tracker creation, search use, sync activity and visits to fixed Rhypple screen categories. They also include the app version, platform, usage date, summary timestamp and random reporting identifiers. Reports do not include note or task content, titles, search text, result identities, database or item identifiers, account details, attachments, contact or notification content, installed app names or lists, launched apps, or screen recordings. There is no automatic click capture or session replay.

A random analytics identifier is separate from your Google account, workspaces and items. It can link usage summaries from this installation until sharing is disabled or reset, so these reports are pseudonymous rather than a promise of complete anonymity. The app does not identify you to PostHog or create person profiles.

You can turn sharing off using Share usage analytics in Settings → Usage analytics. This stops new recording, clears unsent counts and the local analytics identifier, and cancels pending requests where possible. A request already received by the service cannot be undone, and the switch does not remove previously received reports. Enabling sharing again creates a new random analytics identifier.

Counts are grouped by UTC usage date. Send attempts are limited to four per UTC day, including retries, and are spaced by at least 15 minutes. Idle sync checks with no transfers are not counted. Queued counts are kept on the phone for today and the previous six UTC dates; older queued counts are discarded when the analytics ledger is next used. This local queue limit does not set PostHog’s server retention period. Non-content rate-limit metadata remains locally when sharing is turned off so the request limit cannot be reset by toggling the setting.

The app disables GeoIP enrichment and person-profile processing and sends a placeholder IP in event properties. PostHog’s receiving infrastructure can still see routine connection information such as the network source IP. This native iOS analytics disclosure is separate from analytics practices of the Rhypple website and other Rhypple applications.

Updated 15 October 2026. This policy covers Rhypple Launcher for Android, package com.rhypple.rhypplelauncher.

Rhypple Launcher is an Android home app with notes, tasks and time tracking. You can use its launcher features and create a local workspace without signing in. Google Drive features are optional.

Data on your phone

The launcher reads the installed applications Android exposes to home apps so it can show names, icons, search results and launch shortcuts. Your home-screen arrangement, folders, theme choices and app preferences are stored on your phone. These launcher features do not upload your installed-app list to Rhypple.

Local workspace content, including notes, tasks, tags, bookmarks and timer records, is stored in the app's private device storage. Your drafts, pending edits, database information and downloaded workspace caches may also remain there. Signing out does not erase these local copies or pending edits.

Widgets are added through Android's permission flow and displayed using the widget provider you choose. A widget is supplied by its own app, whose privacy policy also applies.

Optional device search can read contact names and calendar events after you enable the corresponding source and grant Android permission. These results are processed on your phone and are not sent to PostHog. Opening a result passes its selected reference to the relevant Android app. Web search passes the query you deliberately submit to your selected Android search app, whose privacy policy applies. A calendar event you explicitly capture into a Drive workspace follows that workspace’s sync settings.

Photos you select for wallpaper and home-layout preferences are handled locally. A layout backup file can contain app and shortcut references, folder names and home positions; export saves it to the destination you select through Android. It is separate from workspace Drive sync and product analytics.

Optional weather

When you choose a city, the city search is sent to Open-Meteo’s geocoding service. Fetching or refreshing weather sends the chosen place’s coordinates to Open-Meteo. “Use current location” separately asks for Android approximate-location permission and uses the network location provider; it does not use GPS or background location tracking. The selected place and last weather reading are saved locally until you clear the weather location or the app’s storage. Weather location is separate from PostHog analytics and is not sent as an analytics event property.

Optional notification access

If you enable Android notification access, Rhypple Launcher can read notification titles, message text, the originating app, posting times and available opening actions. This makes the grouped notification inbox work. History is stored only on your phone, for up to 24 hours and with a maximum of 1,024 entries. It is not included in Drive workspace sync or Android cloud backup by Rhypple Launcher. The app clears its stored notification history when notification access is revoked.

Android handles the permission decision. You can disable access at any time in Android Settings → Notifications → Notification access; the exact settings names can vary by device. Available notification-opening actions may expire, even while an item remains in the local history.

Timer notifications are a separate, optional Android notification feature. They use your local timer state to display reminders and actions. You can turn them off in the launcher settings or Android notification settings.

Optional Google sign-in and Google Drive

If you connect Google Drive, Google sign-in provides your account identifier, email address, display name and profile picture information. Rhypple uses this information to identify the account you selected and keep workspaces bound to the correct account. OAuth access and refresh tokens are stored encrypted on the phone using Android Keystore.

The app requests Google Drive app-data access and access to files created or selected for use with Rhypple, together with your Google profile and email. Your personal workspace files may be stored in Google's hidden app-data area. An existing shared workspace may instead use a visible Google Drive folder; Google's sharing permissions determine who can access that folder.

When you select Drive storage or connect a Drive workspace, the app sends the workspace content, database metadata, edit history, generated sync-device identifiers and supported attachment bundles to Google Drive. Workspace content can include notes, tags, tasks, bookmark URLs and timer records. A backup imported with attachments can contain documents, images, video, audio or other file types. Copies may be cached in app storage on the phone. A local database stays local unless you choose to publish or otherwise export it.

Google stores and processes files according to its own privacy policy and your account settings. Rhypple Launcher accesses these files to create, find, open, update and sync the workspace you choose. Drive workspace content is not uploaded to a Rhypple-hosted workspace-content server for this launcher.

Google authorization codes and refresh tokens are processed by Rhypple's HTTPS token-exchange endpoint, hosted on Netlify, to complete Google sign-in and refresh access. Network infrastructure may process routine connection information such as IP addresses and request metadata. The endpoint is not used to store your notes or attachments.

Network fallback may query Google or Cloudflare DNS-over-HTTPS services to resolve service hostnames. These requests concern network service addresses, rather than your notes, attachments or browsing history.

Sharing, import and export

When you deliberately share text or a link from another app to Rhypple Launcher, it becomes a note or bookmark draft that you can review. If you save it into a Drive workspace, it is included in that workspace's sync. Import and export use the file destination you select through Android. Files exported outside the app's private storage may be retained or accessed by the chosen destination or another app. Their handling is governed by that service or app.

Advertising and optional PostHog beta analytics

Rhypple Launcher does not include advertising, an advertising identifier SDK or a crash-reporting SDK. Its activity charts are calculated locally from your own workspace records. During beta testing, optional product usage analytics helps us understand which features are useful and where the launcher needs improvement. Usage analytics and approximate location from network IP are enabled by default. Limited product events are sent to PostHog in the EU over HTTPS.

Events describe fixed product screens, time while those screens are visible in the foreground, and feature actions such as searching, arranging Home, using app groups, creating folders, adding widgets, applying tags and controlling timers. They include app version, platform, event timestamp and random reporting identifiers. Built-in app group categories may be included. No note or task content, titles, tag names, search text, result identities, database or item identifiers, account details, attachments, contact or notification content, installed app names or lists, identities of launched apps, or screen recordings are sent. There is no automatic click capture or session replay.

The random analytics identifier is separate from your Google account, workspaces and items. It links events from this installation until sharing is disabled or reset; reports are pseudonymous rather than a promise of complete anonymity. A separate random session identifier groups visits. The app does not identify you to PostHog or create person profiles.

Turn sharing off in Settings → PostHog analytics to stop recording, clear unsent events and the local analytics identifier, and cancel pending requests where possible. A request already received by the service cannot be undone, and these controls do not remove previously received events. Enabling sharing again creates a new random analytics identifier.

The local queue retains at most 1,000 events for up to seven days, with batches of up to 50 and automatic retries that back off to at most 30 minutes. New events may be omitted while the queue is full. Screen time is checkpointed every 30 seconds and when visibility changes; an abrupt app termination can lose the final unfinished slice. These local limits do not set PostHog’s server retention period.

When approximate-location sharing is enabled, PostHog uses the network IP address of the analytics connection to estimate a location such as country, region or city and associates that estimate with product events. The estimate reflects the connection used when events are uploaded; events queued offline may be uploaded later from a different network. This is IP-based GeoIP enrichment, not GPS or Android location access. Estimates may be inaccurate, including when you use a VPN or mobile network. Network infrastructure also processes routine connection information, including the source IP address. This launcher disclosure is separate from analytics practices of the Rhypple website and other Rhypple applications.

In Settings → PostHog analytics, you can turn “Approximate location” off while continuing to share usage events, or turn “Beta usage analytics” off entirely. Turning off approximate-location sharing prevents enrichment of future analytics events; it does not erase location estimates already received. We plan to discontinue this usage tracking after beta testing. No end date is set, and ending beta tracking would not itself delete previously received reports.

Retention and deletion

Local launcher preferences, workspace copies, drafts and pending changes remain on your phone until you remove them or clear the app's storage or uninstall the app. Removing the Android app does not delete files from Google Drive or another export destination. Revoke notification access to clear the launcher's local notification history.

To remove Drive workspace files, use the controls in Google Drive for the corresponding app data or shared folder. You can also revoke Rhypple's Google account access through your Google account's third-party connections settings. Revoking access stops future authorised access but does not itself delete existing Drive files. For help identifying and removing Rhypple data, contact rhypple.app@gmail.com. Do not email passwords, access tokens or private database files.

Security

App-managed Google sign-in, token exchange, Drive sync and DNS-over-HTTPS requests use encrypted HTTPS connections. Credentials are encrypted locally with Android Keystore. This does not mean that your SQLite workspace or Drive backup is end-to-end encrypted. Access to local app storage is subject to Android's security protections; access to a shared Drive folder follows its Google permissions.

Contact and changes

For privacy, data deletion or product support, email rhypple.app@gmail.com. Website: https://rhypple.app/. We may update this policy when the launcher's features or data handling change. The update date above identifies the current text.

Read the standalone launcher policy · Contact support