Privacy Policy
Next90 ("we", "our", or "the Application") is engineered around a strict Offline-First, Zero-Server-Collection privacy architecture. We believe your personal transformation goals, daily habit execution chains, 10-pillar self-assessments, and daily journal reflections belong exclusively to you.
1. Zero Off-Device Data Collection
Next90 does not require user registration, cloud accounts, or external database synchronization. All data you enter into Next90 is stored exclusively on your local Android device inside a sandboxed Android Room SQLite database (next90_offline.db) and an encrypted SharedPreferences vault:
- Profile Preferences: Optional display name and avatar emoji used solely to personalize your local dashboard and completion certificate.
- Transformation & Habit Execution Data: Your 90-day goals, weighted daily activities, execution status logs, and streak metrics.
- 10-Pillar Self-Assessments & Journal Entries: Your 1–10 life dimension ratings, daily reflections, mood tags, and hardware-encrypted personal reflection notes.
We do not operate analytics tracking servers, do not embed third-party advertising SDKs, and never sell, rent, or transmit your personal data to third parties.
2. Zero Dangerous Permissions & Android System Photo Picker
Next90 declares zero dangerous runtime permissions in its AndroidManifest.xml (no camera, location, contacts, microphone, or broad storage read/write permissions).
When you optionally attach a motivational cover photo or journal image, Next90 invokes the official zero-permission Android System Photo Picker (ActivityResultContracts.PickVisualMedia), which grants temporary, read-only URI access exclusively to the single image you explicitly select.
3. Cryptographic Security at Rest & Network Hardening
- AES-256-GCM Hardware Encryption: Personal reflection notes stored in the security vault are encrypted at rest using 256-bit AES-GCM keys generated and protected by the Android Hardware KeyStore (
next90_masvs_master_key_v1). - Cleartext Traffic Disabled: All unencrypted HTTP network traffic is strictly disabled via Android Network Security Configuration (
cleartextTrafficPermitted="false"). - Cloud Auto-Backup Disabled: Automatic unencrypted cloud backup is disabled (
android:allowBackup="false") so private journal entries never leave your device without your explicit action.
4. On-Demand Social Share Cards & PDF Reports
When you tap Share or Export PDF/PNG Report in the Share Studio, Next90 generates the visual card or PDF document locally inside your device's scoped cache folder (cacheDir/exports/) and opens the native Android Share Sheet via a secure FileProvider URI. No file leaves your device unless you actively choose a destination app in the Android system share sheet.
5. Google Play Data Safety Summary Table
| Data Category | Stored Locally on Device | Collected Off-Device | Shared with 3rd Parties | User Deletable |
|---|---|---|---|---|
| Display Name & Avatar Emoji | Yes (Local Room DB) | No | No | Yes (1-Tap Wipe) |
| 90-Day Goals, Habit Chains & Scores | Yes (Local Room DB) | No | No | Yes (1-Tap Wipe) |
| Daily Journal & Reflection Vault | Yes (AES-256-GCM KeyStore) | No | No | Yes (1-Tap Wipe) |
| Exported PNG Cards & PDF Reports | Scoped Cache Directory | No | User-Initiated Share Sheet Only | Yes (1-Tap Wipe) |
6. Account & Personal Data Deletion Policy
In full compliance with Google Play's User Data & Deletion Policy, you can permanently erase all local data at any time directly inside the app:
- Open Next90 and tap your Profile Avatar in the top-right corner of the Dashboard to open the Profile & Security Center.
- Scroll to the Account & Personal Data Deletion card and tap the red "Delete All Data" button.
- Confirm by tapping "Permanently Delete Everything". This immediately wipes all Room SQLite tables, SharedPreferences, exported cache files, and deletes the
AES-256-GCMmaster key from the AndroidKeyStore. - Alternatively, uninstalling Next90 or clearing storage in Android Settings permanently removes all app data.
For dedicated step-by-step deletion instructions, see our Data Deletion Policy page.
7. Children's Privacy
Next90 is a general-audience personal productivity utility intended for users aged 13 and older. Because Next90 collects zero personal data off-device, no personal information from any user (including minors) is ever transmitted to or stored on external servers.
8. Contact Us
If you have any questions about this Privacy Policy or our Google Play Data Safety compliance, please contact us at:
Official Website: https://next90.siragan.in
Email: support@siragan.in