FlickDeck: Gesture Shortcuts Privacy Policy

# FlickDeck Privacy Policy Last updated: July 12, 2026 ## Overview FlickDeck is a Wear OS gesture shortcut utility. It lets you configure local gesture profiles and webhook actions on your phone, sync that configuration to your watch, and trigger configured actions during a user-armed gesture session. FlickDeck is local-first. It does not require an account, does not use a developer cloud backend, does not show ads, does not use analytics, does not use remote config, and does not include a crash-reporting SDK. ## Data FlickDeck Stores On Your Devices FlickDeck stores configuration locally in app-private storage on your phone and, after sync, a reduced mirror on your watch. This may include: - Gesture profiles. - Gesture-to-action mappings. - Action names and settings. - Webhook URLs you configure. - Home Assistant webhook URLs or IDs you configure. - Optional request bodies you configure. - Timeout, cooldown, risk, and confirmation settings. - Calibration settings such as sensitivity and screen-awake preference. - App settings needed for the local setup. The current release does not include a developer account system, billing entitlement storage, analytics history, or developer-operated cloud sync. ## Secrets And Sensitive Values Webhook URLs, Home Assistant webhook IDs, request bodies, and header-like values can be sensitive because they may grant access to a system you control. The current release is scoped to local app-private storage and redaction. It redacts sensitive-looking values from logs, user-visible diagnostics, and exports by default. It does not sync secret header values to the watch, and authenticated watch-side webhook execution that depends on synced secret headers is not supported in this release. Do not put long-lived API tokens or credentials in webhook URLs or bodies unless you are comfortable storing them in FlickDeck's local app data and sending them to the endpoint you choose when the action runs. ## Network Requests FlickDeck sends network requests only when you configure and trigger an action that requires a network request, such as a webhook or Home Assistant webhook. Those requests are sent to the endpoints you configure. For example, if you create a webhook action, FlickDeck sends the request to that webhook URL when you trigger the action. The developer of FlickDeck does not receive those webhook requests unless you deliberately configure an endpoint controlled by the developer. Public webhook URLs must use HTTPS. Plain HTTP is limited to likely local-network hosts, such as a Home Assistant instance on a trusted LAN. FlickDeck revalidates redirects and refuses public HTTP destinations, unsupported schemes, HTTPS-to-HTTP downgrades, and redirects to a different host. ## Data Collection By The Developer FlickDeck does not collect personal data on developer-owned servers. FlickDeck does not use developer-operated cloud sync, analytics SDKs, advertising SDKs, tracking SDKs, crash-reporting SDKs, or remote configuration services. If crash reporting, analytics, cloud sync, accounts, billing, or other data-collection features are added in the future, this policy must be updated before release. ## Data Sharing FlickDeck does not sell, rent, or share your personal data. User-triggered webhook requests are sent to the endpoints you choose. Those third-party endpoints are controlled by you or by the services you configure, such as Home Assistant, n8n, or a custom API. Their privacy practices are governed by their own policies. ## Backups And Exports FlickDeck may export local setup data. Exports exclude secrets by default. You are responsible for where you store exported files. ## Data Deletion You can delete local FlickDeck setup data from the phone app by using **Delete local setup**. FlickDeck then tries to sync an empty configuration to the paired watch to clear the watch mirror. If the watch is not reachable, you can delete the watch mirror by clearing FlickDeck app data in Android settings or uninstalling FlickDeck from the watch. You can also delete all local FlickDeck data by clearing app data or uninstalling the app from your phone and watch. FlickDeck does not hold server-side account data, so there is no developer server deletion request for the current release. ## Children FlickDeck is not directed to children and does not knowingly collect personal data from children. ## Security FlickDeck is designed to reduce accidental data exposure by keeping setup local, redacting sensitive values from logs and exports, blocking unsupported secret sync, validating webhook destinations and redirects, requiring confirmation for risky actions, and avoiding developer-operated data collection. No app can guarantee absolute security. ## Third-Party Services FlickDeck may interact with services you configure, such as Home Assistant, n8n, custom webhooks, or other automation tools. FlickDeck is not affiliated with or endorsed by those services unless explicitly stated. ## Changes To This Policy This policy may be updated as FlickDeck evolves. The effective date at the top will be updated whenever the policy changes. ## Contact Use the developer contact email shown on FlickDeck's Google Play listing. Do not send API tokens, webhook URLs, or other secrets in support emails.