Decuma Privacy Policy

Effective Date: November 4, 2026 · App ID: com.fraynelabs.decuma

1. Introduction and Controller Identity

This Privacy Policy governs the data management and privacy architecture of Decuma (Cartesian Matrix & Decimal Task Ledger, Application ID: com.fraynelabs.decuma), a mobile application developed and operated by FRAYNE LABS LTD ("We", "Us", "Our"), acting as the Data Controller under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA). We are fundamentally committed to privacy-by-design and local data sovereignty. By downloading, installing, or utilizing the Decuma application, You acknowledge the practices detailed comprehensively within this Policy.

Corporate Identity: FRAYNE LABS LTD is a company registered in England and Wales (Company No: 17405284), with its registered office located at 5 Oakland Avenue, Cheltenham, GL52 3EP, United Kingdom.

2. Local-Only Storage Architecture and Zero Telemetry

Decuma is engineered strictly as an offline-first personal task and agency ledger. We operate under a zero-collection architecture by default:

• On-Device Database: All workspaces (spaces), tasks, notes, Cartesian coordinate positions, due dates, recurrence schedules, and state transition histories are stored exclusively on Your physical device inside an on-device SQLite database (decuma.sqlite). FRAYNE LABS LTD operates no user accounts, no cloud synchronization servers, and neither receives, inspects, intercepts, nor stores Your task content or metadata.
• Zero Analytics, Advertising, or Remote Telemetry: Decuma embeds zero analytics SDKs, zero third-party crash reporters, zero advertising identifiers (no IDFA or AAID tracking), and zero remote telemetry. All behavioral and productivity metrics—including Archetype Velocity and completion flow histories—are computed strictly locally on Your device hardware from Your on-device SQLite records.
• Shared Files & Attachments: When You share text, URLs, or files into Decuma from other applications via the native OS share sheet, any attached files are copied solely into Decuma's private on-device application storage (files/attachments) and linked locally to Your task notes. Shared files are never uploaded to Our servers.

3. Optional Bring-Your-Own-Key (BYOK) AI Integrations

Decuma includes deterministic on-device natural language parsing and additionally offers optional third-party Large Language Model (LLM) assistance (such as task grouping, deadline extraction, stem anchor synthesis, title polish, and semantic board search). If You choose to enable LLM features and configure Your own API key for Google Gemini, OpenAI, or Anthropic Claude via Settings (···) → LLM / KEY:

• Hardware-Backed Key Storage: Your API key is stored locally on Your device using platform-native encrypted storage (Android Keystore via FlutterSecureStorage or iOS Keychain). API keys are explicitly excluded from operating system cloud backups, device-to-device transfers, and JSON backup exports.
• Direct Device-to-Provider Transmission: When an LLM action is triggered, relevant task headlines, details, space names, and group context are transmitted directly over encrypted TLS/HTTPS from Your device to Your selected provider's official API endpoint:
  • Google Gemini: generativelanguage.googleapis.com
  • OpenAI: api.openai.com
  • Anthropic Claude: api.anthropic.com
• Zero Intermediary Routing: AI API requests never pass through any server or proxy owned or operated by FRAYNE LABS LTD. Processing by Your selected AI provider is governed by Your direct account agreement and that provider's respective privacy policy. You may disable LLM processing (LLM: OFF) or clear Your stored API key at any time in Settings (···).

4. Lawful Basis for Processing

To the limited extent that local software execution or store entitlement verification falls within the scope of Article 6 of the UK GDPR, processing is predicated on:

• Contractual Necessity (Art. 6(1)(b)): Executing local database operations, local notification scheduling, and verifying in-app purchase entitlements via Your platform app store to deliver the core functionality of the App.
• Consent (Art. 6(1)(a)): Optional transmission of task text to third-party LLM endpoints occurs solely when You affirmatively supply a personal API key and enable LLM features in Settings, and device notification permissions are granted strictly via Your explicit, revocable OS-level consent.

5. In-App Purchases (Decuma Pro)

Optional upgrades to Decuma Pro (decuma_pro_lifetime) are processed exclusively by Google Play (Android) or the Apple App Store (iOS) via their native in-app billing infrastructure:

• FRAYNE LABS LTD never collects, receives, intercepts, or stores Your payment card numbers, billing addresses, or banking instruments.
• Financial transaction processing and receipt validation are governed directly by Google's or Apple's respective privacy policies.
• Your Pro unlock state is cached locally on Your device within preferences and secure storage solely to persist and restore Your purchased capabilities offline.

6. Local Notifications and System Alarms

Decuma schedules task reminders locally on Your device using native operating system alarm and notification managers (including POST_NOTIFICATIONS, SCHEDULE_EXACT_ALARM, and RECEIVE_BOOT_COMPLETED on Android, and local notifications on iOS) to deliver:

• Persistent, silent pinned task anchors in Your notification shade;
• Scheduled due-date and specific due-hour reminders (defaulting to 09:00 AM local time when no specific hour is set); and
• Optional waking-hour task nudges (scheduled strictly between 09:00 and 20:30 local time).

Decuma does not utilize remote push notification servers (no Apple Push Notification service or Firebase Cloud Messaging infrastructure).

7. Operating System Backups and Data Portability

• Operating System Cloud Backups: Depending on Your device-level system settings, Your local SQLite database (decuma.sqlite) and app preferences may be included in encrypted operating system backups (such as Google Android Auto Backup or Apple iCloud Device Backup). Hardware-encrypted secure storage containing Your BYOK API keys is explicitly excluded from OS cloud backups and device transfers via platform backup rules.
• Local Auto-Backup & JSON Portability: You retain complete data sovereignty. Via Settings (···) → BACKUP, You may enable automatic JSON backups (decuma_auto_backup.json) to a user-selected device or cloud-provider folder (PATH) and restore from any JSON backup file (RESTORE) at any time.

8. Your Statutory Rights under UK GDPR

Under the UK GDPR, EU GDPR, and applicable global data protection laws, You possess comprehensive statutory rights of access, rectification, portability, restriction, and erasure (Right to be Forgotten). Because Decuma stores all personal task data exclusively on Your local device without remote user accounts, You can exercise these rights directly and instantaneously at any time by editing or deleting tasks and spaces within the App, exporting Your JSON data, clearing application storage in Your OS settings, or uninstalling the App.

For any formal privacy inquiries or statutory requests, please contact our designated Data Protection Officer at support@frayne.app.

9. Statutory Data Protection Complaints Procedure (DUAA 2025 Compliance)

Pursuant to Section 164A of the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 (DUAA), We operate a mandatory, statutory internal complaints procedure. If You believe We have infringed upon Your data protection rights or mishandled a privacy inquiry, You must first raise the issue directly with Us before escalating the matter to regulatory authorities:

• Submission of Complaint: Complaints may be submitted securely via email to support@frayne.app with the subject line "Formal Data Protection Complaint — Decuma," or via the dedicated digital form located at our contact page (routed via FormSubmit.co).
• Statutory Acknowledgment: We will officially acknowledge receipt of Your complaint, providing a reference number and an outline of the next steps, within thirty (30) calendar days of receipt.
• Investigation and Resolution: We will conduct a thorough, proportionate investigation into Your claims without undue delay and aim to provide a comprehensive outcome report within three (3) months of the initial acknowledgment.
• Regulatory Escalation: If You remain dissatisfied following the conclusion of Our internal complaints procedure, You retain the absolute right to escalate the matter to the Information Commissioner's Office (ICO) via https://ico.org.uk/make-a-complaint/ or by telephone at 0303 123 1113.

10. Minors and Age Limitations

The Decuma application is not designed for, nor directed at, individuals under the age of thirteen (13). We do not knowingly collect or process personal data from minors.