PRIVACY POLICY · VERSION 1.0.0
Offline means less data to protect.
A detailed account of what Lanternfield stores locally, what it never collects, how the release avoids transmission, and how the user can erase the limited state.
Last updated: 23 August 2026
01Scope02Offline design03Data we do not collect04Local app data05Purpose of local data06Legal bases07Device permissions08Network activity09Sharing and sale10Third-party services11Retention12Erasure13Backup and device transfer14Security15Children and families16Health, safety, and professional limits17Policy changes18Publisher and contact
1. Scope
This policy covers Lanternfield, its bundled learning content, and its private on-device state.
The covered release is version 1.0.0 of Lanternfield. The policy applies to the installed Android application, its 48 content cards, bundled images, accessibility controls, utility panel, and the limited progress state described below. It does not describe websites, accounts, or remote systems because none are used by the app at runtime.
Lanternfield uses general low-demand activity and sensory-choice principles: small setup, optional company, adjustable light and sound, short windows, easy exits, and stopping before an activity becomes a burden. It is not a symptom tracker, therapy program, diagnosis tool, treatment plan, crisis service, or substitute for professional care.
2. Offline design
Lanternfield is designed to work after installation without an Internet connection, account, remote API, embedded browser, or cloud service.
All primary text, card imagery, navigation, policy text, and interface resources needed for normal use are packaged inside the installation. Opening a module, viewing a card, changing an accessibility preference, saving a supported choice, or returning to a previous item does not require a connection.
Offline design also means there is no sign-in recovery, cross-device history, remote collaboration, live content feed, web portal, or server copy of the app state. Reinstalling on another device begins with a separate empty local state.
3. Data we do not collect
The app does not collect names, contact details, precise location, photos, audio, identifiers, health details, payment data, advertising IDs, diagnostics, analytics, telemetry, or free-text submissions.
There are no fields for a real name, alias, email address, telephone number, street address, birthday, demographic profile, organization record, participant story, or free-text submission. The software does not inspect the device address book, media library, installed-app list, clipboard, or files.
The app also does not generate a publisher-visible user identifier. It does not use advertising IDs, IP-based tracking, cookies, pixels, device fingerprinting, attribution tags, analytics events, crash uploads, or usage reports. A tap is handled only as an on-device interface action.
4. Local app data
The app can store only selected bandwidth, favorite activity-card IDs, manual glow-step position, text size, and Reduce Motion preference. This state remains in the app's private local storage.
Lanternfield retains the selected bandwidth, favorite activity-card identifiers, manual glow-step position, text size, and Reduce Motion preference. It does not store mood entries, symptoms, diagnoses, medication information, journals, audio, photographs, contacts, or precise location.
The saved values are small application-state values, not a hidden activity transcript. They are written to the app’s private storage area so the chosen place and supported preferences can be restored on the same installation. The publisher cannot open, search, or retrieve that storage remotely.
5. Purpose of local data
Local state exists only to restore the user's chosen place, structured selections, accessibility preferences, and locally saved progress.
Completion markers prevent a user from having to rediscover the same place. Saved-card identifiers make selected bundled content easier to revisit. Predefined choices restore only an option already present in the interface, while text size and Reduce Motion restore the selected presentation.
No local value is used to infer identity, eligibility, health status, skill, risk, location, household circumstances, or behavior outside the app. There is no scoring model, recommendation profile, advertising segment, ranking, or automated decision about a person.
6. Legal bases
Because the app does not receive or transmit personal data, no remote processing legal basis is invoked by the software. The user controls optional local state through direct interaction.
The publisher does not receive personal data from the app, so it does not perform remote collection, profiling, behavioral advertising, or account administration through this software. No consent banner is shown because the app sets no cookie and initiates no transfer that such a banner would control.
Local persistence occurs only when the user interacts with supported controls. The user may avoid saving progress, overwrite supported selections through later use, or remove all retained state with the in-app erase action or Android system controls.
7. Device permissions
The app requests no camera, microphone, contacts, location, notification, storage, calendar, Bluetooth, advertising, Internet, or network-state permission.
The Android manifest contains no Internet or network-state permission and no permission for camera, microphone, contacts, precise or approximate location, notifications, calendar, nearby devices, Bluetooth, advertising ID, body sensors, phone state, SMS, call log, or external storage.
Normal Android platform facilities still run the application and draw its interface, but the app does not request access to protected device sources. If an operating-system screen ever displays a permission request under this package, that behavior would be inconsistent with this described release and should not be accepted as expected behavior.
8. Network activity
The release contains no runtime network client, remote image loader, telemetry library, advertising SDK, cloud synchronization, or embedded web content.
The release has no HTTP client, WebView, remote-image component, download manager, upload path, socket workflow, or background synchronization worker. Card images and website-style visuals shown inside the app are decoded from packaged resources, not fetched by URL.
Airplane mode or a device with no network connection does not remove core content. The app does not test connectivity, record an IP address, contact a publisher endpoint, fetch a remote configuration, or silently add new cards after installation.
9. Sharing and sale
The app does not share, sell, rent, disclose, or broker app data because it does not transmit app data from the device.
Because application state remains inside private storage and no transmission path exists, the software cannot send it to advertisers, data brokers, affiliates, social networks, analytics providers, or the publisher. There is no data-sale or targeted-advertising switch because those activities are absent.
The app also provides no share button, public profile, group space, leaderboard, message, invite, or export file. If a user separately discusses an app prompt or takes a device screenshot, that action occurs outside the app’s data handling and under the user’s control.
10. Third-party services
No third-party analytics, ads, crash reporting, authentication, maps, social, payment, messaging, or cloud-storage service is integrated.
No third-party SDK is integrated for advertising, analytics, attribution, crash reporting, login, maps, payments, social features, chat, cloud databases, customer support, or push notification delivery. The runtime does not embed third-party webpages or external media players.
The application uses Android and user-interface libraries that are compiled into or supplied by the platform to render the local experience. They are not configured as remote data recipients and do not change the no-transmission behavior described in this policy.
11. Retention
Local state remains until the user erases it in the app, clears app storage, or uninstalls the app. No publisher-side retention exists.
Supported local state has no publisher-set expiration because the publisher never receives it. It normally remains available to the same installation across ordinary closes and device restarts until the user erases it, Android clears the app’s storage, or the app is uninstalled.
There is no archive, server backup, deletion queue, dormant account, or residual publisher copy after erasure. A later clean installation starts with default preferences and no completed or saved cards because app backup and transfer are disabled.
12. Erasure
Use Erase local data in the app utility panel to remove saved progress and preferences. Android system controls can also clear app storage or uninstall the app.
The utility panel includes Erase local data with a confirmation step. Confirming clears supported progress, saved card identifiers, predefined selections, and accessibility preferences, then returns the experience to its initial local state. The bundled card text and images remain because they are part of the installed software, not user data.
Android Settings can also clear storage for the app, and uninstalling removes the application’s private storage. The publisher cannot perform remote erasure, recover erased values, or erase a particular record because there is no account and no server-held record to address.
13. Backup and device transfer
Android cloud backup and device-to-device transfer are disabled for app data. The software does not provide its own export or synchronization feature.
The Android application configuration disables cloud backup and device-to-device transfer for app data. The software has no custom export, import, synchronization, migration, or restore function. Local progress therefore should not be treated as a durable record or the only copy of an important real-world decision.
A device manufacturer or operating-system administrator may control the device itself outside the application. This release does not ask those systems to copy its private state and does not provide the publisher with a restore channel.
14. Security
Data minimization, private app storage, disabled backup, no network permission, and no third-party SDKs reduce exposure. Device security still depends on the user's operating system and access controls.
The privacy design reduces exposure by collecting nothing remotely, storing only a narrow set of supported values, keeping them in application-private storage, disabling backup, omitting network permission, and avoiding third-party tracking components. Release builds are signed so Android can verify package integrity and update identity.
No software can protect a device whose operating system, screen lock, physical access, administrative profile, or backup environment has been compromised. Users should keep Android updated, use appropriate device access controls, and erase local app state before transferring a device when that matches their needs.
15. Children and families
The app creates no child profile, account, social space, message, public post, purchase, camera capture, precise-location record, or targeted advertising. Adults and guardians direct any real-world activity appropriate to their household.
The app has no child account, age gate, profile, public interaction, user-generated content, purchase, ad, message, contact discovery, location capture, camera capture, or behavioral tracking. It does not ask a child to disclose personal information and has no mechanism for sending such information to the publisher.
The prompts are broad, but adults and guardians remain responsible for deciding whether particular language, materials, movement, social context, supervision, and real-world activity are appropriate for a child or household. Erase controls apply to the same limited on-device state regardless of who used the device.
16. Health, safety, and professional limits
Lanternfield provides general structured learning prompts. It does not diagnose, treat, certify, supervise, register, deliver emergency response, or replace qualified medical, legal, financial, safeguarding, educational, coaching, or other professional judgment.
It is not a symptom tracker, therapy program, diagnosis tool, treatment plan, crisis service, or substitute for professional care.
The app does not assess a person, establish eligibility, guarantee an outcome, monitor a real-world situation, or detect urgency. Users remain responsible for current rules, environmental conditions, consent, accessibility, materials, physical limits, supervision, and qualified guidance relevant to activity outside the software.
17. Policy changes
A future software release may update this policy when product behavior changes. The policy shipped in the installed version describes that version's behavior.
This policy is tied to the behavior of version 1.0.0. A future release that adds a permission, network feature, account, third-party recipient, new local-data category, export mechanism, or materially different purpose would require a corresponding policy review before that release is represented by the same statements.
When only wording is clarified and product behavior is unchanged, the revised page should preserve the same collection, storage, transmission, retention, and deletion facts. The policy packaged with an installed release remains the best description of that specific release when a later page describes newer behavior.
18. Publisher and contact
Publisher: BONNEY LOVE. The software contains no contact form, support account, live chat, mailing list, or messaging channel.
The publisher display name for this release is BONNEY LOVE. Lanternfield itself contains no contact form, chat, mailing list, ticket system, or publisher inbox, and no contact details are collected through the application.
A verified publisher-controlled contact and the final public policy URL can be supplied through the application marketplace or other publisher-controlled publication surface. No unverified email address, street address, or third-party contact channel is presented by this software.