Rondo ("Rondo", the "App") is a mobile application published for Android and iOS under the package name com.applogic.rondo and provided by AppLogic Single Member P.C., a single-member private company (Ι.Κ.Ε.) established in Greece ("we", "us", "our", trading as "App Logic").
By downloading, installing, accessing, or using Rondo, you agree to these Terms of Service (the "Terms"). If you do not agree, do not install or use the App. The Terms should be read together with the Privacy Policy in Part B, which forms part of this agreement.
A2. What Rondo is
Rondo is a shared-schedule and personal-tracking app. You choose one or more "modes" and can add or remove them at any time:
Mode
What it does
Parental Custody
Lets you build and view a custody/parenting-time schedule for one or more children between two parents, with rotations, schedule changes, and date-range exceptions.
Co-ownership (Object Share)
Rotates the use of any shared item (pet, car, holiday home, etc.) between 1–10 people.
Period Tracker
A single-user menstrual-cycle and symptom log with cycle prediction, optional pregnancy mode, and optional on-device reminders. This mode is private to you: its data never leaves your phone and can never be shared with anyone (see A6).
Stay Active
Reads your device's health data (steps, distance, active energy) on your device to compute a daily activity score. Your raw health data never leaves your device: only the score is stored. Nothing is shared unless you opt in to the leaderboard, which then shows a random nickname, your score, and your country (plus your city, only if you also enable the optional city leaderboard, which uses approximate location: never your exact position). See A7 / B3.3.
Rondo works offline and locally by default. Creating an account (via phone number) is optional and unlocks cross-device backup, sharing, and the leaderboard. You may also use the App as a guest, in which case your data stays only on your device.
A3. Important disclaimers: please read
Rondo is an organisational and informational tool. It is not a professional, legal, or medical service.
A3.1 Custody schedules are not legal advice or a court order
The Parental Custody mode helps you record and visualise an arrangement you have already agreed or been ordered to follow. It does not create, determine, interpret, or enforce any legal custody or parenting-time right. It is not a substitute for a court order, a parenting plan, mediation, or advice from a qualified family-law professional. Any schedule, calculation, or "handoff" shown in the App is for your own convenience only.
A3.2 Period Tracker is not a medical device
The Period Tracker provides estimates and predictions based on the data you enter. It is not a medical device, diagnosis, or treatment, and must not be used as a method of contraception or fertility planning. Predictions (including fertile-window, ovulation, and due-date estimates) can be inaccurate, especially with irregular cycles or limited data. For any health decision, and for contraception or family planning, consult a qualified healthcare professional.
A3.3 Stay Active is not fitness or medical advice
Activity scores, calendar bands, and leaderboard rankings are informational and depend on the accuracy of the data reported by your device and third-party health apps (e.g. Google Fit, Samsung Health via Health Connect). They are not medical, dietary, or fitness advice and should not be relied on for any health decision.
A3.4 No guarantee of accuracy
Schedules, predictions, reminders, and scores are generated on your device from the information available to it. We do not warrant that any output is accurate, complete, or timely. You are responsible for verifying anything important.
A4. Eligibility and age requirement
You must be at least 18 years old to use Rondo — it is an adults-only app. By using Rondo you confirm you are 18 or older and have the legal capacity to enter into these Terms.
Rondo is intended for use by adults. Where a mode involves information about children (e.g. a child's first name and schedule in Parental Custody), you confirm that you are the parent or legal guardian, or are otherwise authorised to process that information, and that you do so in the child's best interests. See Part B for how children's data is handled.
Rondo is not directed to children or minors and we do not knowingly allow persons under 18 to create an account.
A5. Your account and phone-number sign-in
Signing in is optional and uses phone-number verification (a one-time SMS code) via Firebase Authentication. Your phone number is your identifier.
Rondo enforces a single active device per phone number. Signing in on a new device signs you out of the previous one, which reverts to a local-only/guest state.
You are responsible for keeping access to your phone number and device secure. Anyone with access to your device or number may be able to access your account.
Recovery / cross-device restore. Rondo encrypts your synced data on your device before it is uploaded (see B4). You can restore your data on a new device, or after reinstalling, by signing back in with your phone number — restoring happens through the App on sign-in; there is no manual, out-of-band restore. If you permanently lose access to your registered phone number, you may be unable to sign in and recover your synced data.
Providing your phone number is optional. It is required only to create an account (a contractual necessity for sign-in, cloud backup, and sharing); without it you can still use Rondo as a guest, with your data kept on your device.
A6. Sharing schedules with other people
Sharing works by code and does not require an account. The App shows you a short code, which works once and for five minutes; you give it to the person you are sharing with, and their App uses it to open the mode. You are responsible for who you give a code to: anyone holding it during those five minutes can open that share once.
Parental Custody and Co-ownership schedules can be shared with other Rondo users. Sharing is view-only: only the owner (creator) of a schedule can edit it; the people you share with see a live, read-only copy.
The person you share with must have Rondo installed; they type the code into their App. Neither of you needs an account, and no phone number is used or looked up: there are no invite links, SMS invites or phone-number invitations.
Period Tracker and Stay Active data are never shareable.
When you give someone a code, you confirm you are entitled to share the information in that schedule (including any child's name) with them.
Removing a member, or deleting a schedule, stops all future updates and removes the shared copy from the other person's device: their app deletes its local copy the next time it opens or syncs, and shows them a notice. What we cannot undo is anything they have already seen or saved themselves (e.g. remembered or screenshotted). Time-limited rewarded-ad shares expire and are removed the same way.
A7. Health data and permissions (Stay Active)
If you use Stay Active, the App requests permission to read health data (steps, distance, active energy) through Android Health Connect, read on your device.
What we read: your steps, distance, and active energy, on your device.
What we store: your raw health data never leaves your device: only the computed daily score (0–1000) and score history are saved.
What we share: nothing, unless you join the global leaderboard, which then publishes only a random nickname (no phone or name), your score, and your country.
Optional city leaderboard (location). If you additionally opt in to ranking within your city, the App asks for approximate (coarse) location to determine which city you are in. It sees only your city: never your street, neighbourhood, exact position, or live location; no precise GPS, no tracking, and the location itself is never stored or shared. Only your city name is shown on the leaderboard. This feature is off by default: it does nothing unless you choose to enable it, and you can turn it off again at any time.
You can revoke Health Connect and location permissions in your device settings, and leave the leaderboard from the App's settings, at any time.
You are responsible for the accuracy and lawfulness of any third-party health app you connect (e.g. Google Fit). Their terms and privacy policies apply to their own processing.
A8. Premium, ads, and payments
Rondo's core features: the full calculator, all trackers, and viewing the leaderboard: are free.
Premium unlocks two things: (1) sharing schedules and (2) joining the leaderboard. You can obtain premium by:
Watching a rewarded advertisement, which grants one week of premium (no stacking; re-watchable after the week ends), or
A yearly subscription through Google Play Billing, where offered.
Additional terms:
Ads are served through Google AdMob and are subject to Google's terms. In the EEA, the UK, and Switzerland you are asked for consent before any ad or analytics data is collected, and you can change that answer at any time in Settings → Privacy options. Refusing consent does not limit any feature of the App.
Rewarded advertisements may also be offered for certain other in-app actions, separately from premium. For example, changing your leaderboard nickname is free the first time; each change after that requires watching one rewarded ad. This applies to all users, including premium subscribers.
Subscriptions are billed and managed by Google Play, and are subject to the Google Play Terms of Service and your Google account settings. Prices, taxes, renewal, cancellation, and refunds are handled by Google Play; manage or cancel your subscription in the Play Store. Statutory withdrawal/refund rights under applicable consumer law are unaffected.
The rewarded-ad premium week is stored on your device only and is intentionally not transferable to another device or restored on reinstall.
We may change the availability, structure, or pricing of premium features. If we discontinue a paid feature you have already paid for, applicable consumer law governs any remedy.
A9. Acceptable use
You agree not to:
use Rondo for any unlawful purpose, or to infringe anyone's rights (including privacy rights of the people you add to a schedule);
upload or enter data you are not entitled to process;
attempt to break, probe, reverse-engineer (except as permitted by mandatory law), overload, or circumvent the security, encryption, or entitlement/premium mechanisms of the App or its backend;
cheat, manipulate, or submit false data to the leaderboard, or use it to harass others;
use automated means to access the service in a way that disrupts it.
We may suspend or terminate access (including leaderboard participation) if you materially breach these Terms.
A10. Your content and ownership
Your data is yours. You retain all rights to the information you enter (names, schedules, logs, notes, etc.).
You grant us only the limited rights necessary to store, encrypt, sync, and display that data so the App can function, as described in Part B. Your synced data is stored in encrypted form.
Our rights. The App itself: its software, design, branding ("Rondo"), and content we provide: is owned by us or our licensors and protected by intellectual-property laws. These Terms grant you a personal, non-exclusive, non-transferable, revocable licence to use the App on devices you control, for personal, non-commercial use.
A11. Availability, changes, and third-party services
Rondo relies on third-party services including Google Firebase (authentication, cloud storage, messaging, performance monitoring, and App Check), Google AdMob, Google Play (including Play Billing and Play Integrity), and Android Health Connect. Their availability and terms are outside our control.
We may update, change, suspend, or discontinue the App or any feature at any time, and may release new versions. Some features depend on backend infrastructure that may be enabled or disabled over time.
To keep the App secure and functioning, we may require you to install the latest version; older versions may stop working in whole or in part.
We are not responsible for the data plans, SMS charges, or device costs you incur while using the App.
We may have to withdraw a feature, or a whole country. Where a law, a regulator, a court, an app store, or one of the services above requires it, we may stop offering a feature or phone sign-in in your country, and we may be required to delete the data we hold on our servers for the users affected. Where that happens we delete only what we are required to delete, and the copy on your device is left alone unless the same requirement covers it, in which case the App deletes that too.
A12. Disclaimer of warranties
To the maximum extent permitted by law, the App is provided "as is" and "as available", without warranties of any kind, whether express or implied, including fitness for a particular purpose, accuracy, or non-infringement. We do not warrant that the App will be uninterrupted, error-free, secure, or that predictions, reminders, calculations, or scores will be accurate.
We do not keep backups of your synced data. What sits on our servers is a sync copy, not a backup service: there is no second copy and no point in time restore. If data is lost, corrupted, or deleted, whether through an incident affecting us, a fault, a failure of a third-party service, or your own action, we may be unable to recover it and we are not responsible for recovering it. The only backup that exists is the one you make: Settings, My Account, "Export my data" saves a full copy to your device at any time, and we recommend you use it.
Nothing in these Terms excludes or limits any rights you have under mandatory consumer-protection law in your country, or our liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be excluded by law.
A13. Limitation of liability
To the maximum extent permitted by applicable law:
We are not liable for any indirect, incidental, special, consequential, or punitive damages, or for loss of data, profits, or goodwill, arising out of or related to your use of (or inability to use) the App.
In particular, we are not liable for any decision, dispute, missed handoff, legal outcome, health decision, or other consequence arising from reliance on a custody schedule, cycle prediction, reminder, activity score, or any other output of the App.
We are not liable for the loss, corruption, or unavailability of data held in the App or on our servers, including where it is lost in an incident affecting us or a third-party service, or deleted as described in A11. There are no backups of server-side data (A12), and keeping your own copy through "Export my data" is yours to do.
Where liability cannot be excluded, it is limited to the greater of (a) the amount you paid us for the App in the 12 months before the event, or (b) the minimum amount permitted by applicable law.
Some jurisdictions do not allow certain limitations; in those cases the above applies only to the extent permitted.
A14. Termination
You may stop using the App at any time and uninstall it. You may delete your account from within the App ("Delete my account"), which queues deletion of your server-side data (see B9). We may suspend or terminate your access if you breach these Terms or where required by law. Sections that by their nature should survive termination (e.g. disclaimers, liability limits, governing law) survive.
A15. Changes to these Terms
We may update these Terms from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the App. Continued use after changes take effect means you accept the updated Terms. If you do not agree, stop using the App.
A16. Governing law and disputes
These Terms are governed by the laws of Greece and, where applicable, the law of the European Union, without prejudice to the mandatory consumer-protection rights you enjoy in your country of residence. Disputes are subject to the courts of Greece, unless mandatory law grants you the right to bring proceedings in your own country of residence.
If you are an EU consumer, you may also use the European Commission's Online Dispute Resolution platform (https://ec.europa.eu/consumers/odr).
Part B: Privacy Policy & GDPR
B1. Who is responsible for your data (Data Controller)
For the purposes of the EU General Data Protection Regulation ("GDPR") and equivalent laws, the data controller for Rondo (com.applogic.rondo) is AppLogic Single Member P.C., trading as App Logic, a single-member private company (Ι.Κ.Ε.) established in Greece.
We are a small independent company and have not appointed a Data Protection Officer (not being legally required to). For any privacy matter, contact the e-mail above.
B2. Our privacy approach in one paragraph
Rondo is built to be privacy-first. It works locally on your device and, by default, keeps your data there. If you create an account, most of your data is encrypted on your device before it leaves it: our servers store only encrypted content plus your phone number and a few technical fields. Third parties that store or process it for us, such as Google, receive it only in this encrypted form. Sensitive raw health data (Stay Active) never leaves your device at all. The only real exceptions are the small amount of data you deliberately publish to the public leaderboard, and standard technical/advertising data described below.
B3. The data we process, and why
B3.1 Data stored only on your device (not sent to us)
Unless you enable cloud sync by signing in, all of the following stays on your device (encrypted at rest):
App settings & preferences: theme, colour palette, corner style, language, calendar history range, which modes you use.
Period Tracker logs: cycle and period lengths, per-day flow, symptoms, mood, notes, pregnancy-mode data, reminder preferences and times. (Health data: see B6.)
Stay Active raw health data: steps, distance, active energy read from Health Connect, and computed daily scores.
If you use Rondo as a guest, this is essentially all the personal data involved, and none of it reaches our servers unless you choose to share a mode. Sharing a Parental Custody or Co-ownership schedule by code uploads that one mode, encrypted, together with your anonymous account identifier, so the person you share with can open it and keep seeing your changes (B4). Everything else stays on the device.
B3.2 Data sent to our backend when you sign in
Data
Purpose
Legal basis
Phone number (E.164)
Account identity, sign-in, backup and restore, single-device enforcement (sharing no longer uses it, B4)
Contract (Art. 6(1)(b)); provision of the service you requested
Encrypted data blobs (your Parental Custody and Co-ownership schedules and notes, stored in encrypted form)
Contract / legitimate interests (Art. 6(1)(f)): securing and operating the service
Anonymous account identifier (a random id created on first launch)
Owning and sharing a mode without an account, B4
Contract (Art. 6(1)(b))
Sharing metadata (the anonymous identifiers of the people who opened your code, and when each joined; shares made by phone number before code sharing keep the phone numbers, roles and invite status they were created with)
Enabling schedules you choose to share
Contract (Art. 6(1)(b))
Premium / server-time probe field
Anti-abuse timing for the rewarded-ad premium week, stored against your account or your anonymous account identifier
Legitimate interests (Art. 6(1)(f))
In plain terms: what is readable on our servers. Only the following are stored as readable (plaintext) data:
your phone number;
the anonymous account identifiers of the people who opened your share, and when each joined; shares made by phone number before code sharing still hold those phone numbers, their role and the invite's status;
technical fields: your device's active device ID, login timestamps, and push-notification token;
a server-time field used to time the premium week;
if you join the leaderboard, your nickname, score, country, and optional city (these are public by design).
Everything else you enter: all parent / child / owner / item names, schedules, dates, exceptions and notes: is stored only in encrypted form. Period Tracker logs are not stored on our servers at all (B6). Even the type of schedule (custody, co-ownership, etc.) sits inside that encrypted blob, so the stored document does not itself reveal which kind of data it holds.
Is providing this data required? Your phone number is required only to create an account (a contractual necessity for sign-in, cloud backup, and sharing). You are not obliged to provide it: without an account you can use Rondo as a guest. As a guest, none of the data in this section is collected until you share a mode by code, which uploads that mode's encrypted data and your anonymous account identifier.
B3.3 Stay Active leaderboard (public, opt-in)
If you choose to join the leaderboard, the following becomes publicly readable to other users: a nickname (a generated handle you can refresh, no phone number or name), a country code (a 2-letter country derived from your phone number, a flag, not your number), your daily and rolling activity score (0–1000), and, only if you additionally opt in to the city leaderboard, your city. We store this under an opaque identifier (a cryptographic hash of your phone number); your phone number is never stored in the public record, and raw health data is never uploaded. Legal basis: your consent (Art. 6(1)(a)), withdrawable at any time by leaving the leaderboard.
City leaderboard & approximate location (optional). The city leaderboard is off by default. If you turn it on, the App uses approximate (coarse) location solely to determine which city you are in. We never see your street, neighbourhood, exact position, or live location; there is no precise GPS and no tracking. The location data itself is never stored or shared: only the resulting city name is published on the leaderboard. Legal basis: your consent (Art. 6(1)(a)); revoke it anytime by turning the city leaderboard off or withdrawing the location permission in device settings.
B3.4 Technical, diagnostic, and advertising data
Firebase Performance Monitoring / diagnostics: aggregated, sampled technical performance data (with an app-language attribute). Legal basis: legitimate interests (Art. 6(1)(f)).
App Check (Google Play Integrity): to protect the backend from fraud and abuse, the App attaches a Play Integrity attestation token to its requests, confirming they come from a genuine, unmodified install on a genuine device. This does not identify you and collects no personal data. Legal basis: legitimate interests (Art. 6(1)(f)) in preventing fraud and abuse.
Usage analytics (Google Analytics for Firebase): aggregated usage statistics — app opens, which screens are viewed, app language, device model, OS version, and country. It contains no schedules, names, notes, cycle logs, phone numbers, or health data, and is never used to build an advertising profile of you. Where a consent form applies (see below) nothing is collected until you agree, and turning consent off stops collection. Legal basis: consent (Art. 6(1)(a)) where required, otherwise legitimate interests (Art. 6(1)(f)) in understanding and improving how the App is used.
Advertising (Google AdMob): when ads/rewarded ads are shown, Google may process device and advertising identifiers to serve and measure ads, under Google's advertising terms. Legal basis: consent (Art. 6(1)(a)) where required, otherwise legitimate interests.
Privacy consent (Google User Messaging Platform): if you are in the EEA, the UK, or Switzerland, the App shows a Google consent form the first time you open it, before any advertising or analytics data is collected. You can accept, refuse, or choose individual purposes. Refusing does not limit any feature of the App; ads may then be shown without personalisation. You can change your answer at any time from Settings → Privacy options. Outside those regions no form is shown.
B4. Encryption & sync
Data synced to the cloud is encrypted on your device before it is uploaded.
Your schedules, names and notes are stored on our servers only in encrypted form. Period Tracker logs are never uploaded (B6).
Local data on your device is also encrypted at rest.
Restoring: your data is restored through the App when you sign in with your phone number — there is no manual, out-of-band restore. If you permanently lose access to that phone number, your synced data may be unrecoverable.
Sharing does not need an account. Every install is given an anonymous account identifier the first time it runs. When you share a mode, the App shows a short code you read to the other person; their App uses that code to unwrap the key. We never see the code, and neither person's phone number is involved. If you later sign in with a phone number, it is attached to the account the install already had.
A share made this way is tied to the install. It is held under that anonymous identifier, so uninstalling the App ends it, and there is no way for us to restore it.
B5. Children's data (Parental Custody)
Rondo is for adults. Parental Custody may contain limited information about children (typically a first name and a schedule), which you, as a parent or guardian, enter and control. It is stored encrypted under your account, shared only with the people you explicitly share the schedule with, never used for profiling or advertising, and never part of the public leaderboard. Please enter only what is necessary (first names or initials). You are also responsible for having the authority to process that child's information. We do not knowingly allow anyone under 18 to create an account. If you believe a minor has created an account, contact info@app-logic.org.
B6. Health & special-category data (Period Tracker and Stay Active)
Some data is special-category data under Article 9 GDPR (data concerning health): your Period Tracker logs and your Stay Active health metrics.
Period Tracker data never leaves your phone. It is not uploaded, backed up or synced, even when you sign in, and it cannot be shared. If you reinstall the App or change phones, it is gone with the old install.
Stay Active raw health data never leaves your device. Only a score, nickname, and country are published, and only if you opt in.
Where we process special-category data for these optional features, we rely on your explicit consent (Art. 9(2)(a)), given by choosing to use the feature and withdrawable at any time by disabling the feature, revoking Health Connect permissions, or deleting the data.
Health Connect access follows Google's Health Connect permissions model; we request only steps, distance, and active energy, read on-device, and do not transmit raw values off the device.
Withdrawing consent does not affect the lawfulness of processing before withdrawal.
B7. Who we share data with (recipients / processors)
Google (Firebase / Google Cloud): processor for authentication, cloud storage (encrypted content + phone number), push messaging, and performance monitoring, under Google's data-processing terms.
Google (AdMob / Google Play): for advertising and, where offered, subscription payments (Google Play is the merchant of record).
Other Rondo users: only the specific schedule you deliberately share (view-only), and only the leaderboard nickname/country/score you deliberately publish.
Authorities / legal: if required by law, we may disclose the limited data we hold (your content is stored in encrypted form).
We do not use your data for automated decision-making producing legal or similarly significant effects on you.
B8. International transfers
Our infrastructure providers (Google Firebase / Google Cloud) may process data on servers outside the EU/EEA, including in the United States. Such transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or an adequacy mechanism (e.g. the EU–US Data Privacy Framework), as implemented in Google's data-processing terms. Your sensitive content is transferred only in encrypted form.
B9. How long we keep data
On-device data: kept until you delete it in the App or uninstall.
Account & synced data: kept while your account is active. "Delete my account" erases your server-side records: your user document, encrypted schedule documents, leaderboard record, and sharing metadata. Erasure is completed within 9 days of your request, and signing in again before it runs cancels the request. If there is nothing of yours on our servers, there is nothing to wait for: the account is deleted at once, and everything the App holds on your device goes with it.
Leaderboard record: removed when you "Leave the leaderboard" or delete your account.
Deletion we do not choose: where a law, a regulator, a court, or an app store requires us to stop offering a feature or sign-in in a country, we may have to delete the server-side data of the users affected, and in some cases the App will also delete the copy held on the device. We delete only what we are required to delete.
Diagnostic/advertising data: retained by Google per their policies.
B10. Your rights under the GDPR
If you are in the EU/EEA (and under comparable laws elsewhere), you have the right to: access, rectification, erasure (also in-app via "Delete my account"), restriction, portability (you can export a copy of your data yourself, anytime, from Settings → My Account → "Export my data", which saves a machine-readable JSON file to your device), objection (to processing based on legitimate interests), and to withdraw consent (leaderboard, health features, ads) at any time.
Please note: because your content is stored encrypted and is decrypted in the App on your device, requests concerning its contents are best served from the device itself. The in-app export above gives you a full, machine-readable copy of the data held on your device.
To exercise any right, e-mail info@app-logic.org. We respond within one month as required by the GDPR, normally free of charge; we may need to verify your identity (typically via your registered phone number).
Right to complain. You may lodge a complaint with your local supervisory authority. In Greece this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, https://www.dpa.gr).
B11. Security
We protect your data with on-device encryption of synced content before upload (servers store it encrypted), encryption at rest of local data, phone-number authentication with single-active-device enforcement, and access-controlled backend rules. No system is perfectly secure; you are responsible for securing your device and phone number. There is no backup of server-side data and no point in time restore, so data lost or corrupted in an incident may not be recoverable. If you want a copy you control, export one at any time from Settings, My Account, "Export my data".
B12. Permissions Rondo may request
Phone number / SMS verification: to sign in (SMS handled by Firebase).
Health Connect (steps, distance, active energy): only for Stay Active, read on-device; revocable in device settings.
Approximate (coarse) location: only if you opt in to the city leaderboard, used solely to determine your city. Never precise GPS, never stored, never shared (only the city name is published); revocable in device settings.
Notifications: for optional reminders and (where enabled) sync/sharing notices.
Internet / network: for sign-in, sync, ads, and the leaderboard.
You can decline or later revoke these; the affected features simply won't work.
B13. Changes to this Privacy Policy
We may update this policy. Material changes are reflected in the "Last updated" date and, where appropriate, highlighted in the App. Continued use after an update means you accept the revised policy.