on the phone
What the app keeps on the phone
For each workspace ยท yard you pair, the app keeps the yard's name, the user it calls as, and the device token that proves the pairing. It also keeps the address it reaches: the edge address for a connected yard, or the yard's own HTTPS address for a direct pairing.
The token is encrypted on the phone with a key the Android Keystore holds and never gives out; what is stored is ciphertext that key alone opens. When you sign in through the edge, the app also keeps the edge address and account. Its session token is sealed the same way.
The app also remembers which yard opens first and whether it has asked about notifications. None of what it keeps is backed up or transferred to another phone.
to your yard
What goes to your yard
Signing in sends the email and password you type to the edge at my.yardr.dev. The app holds the password while it signs in, then clears the field. It does not save the password in its account records.
Every call to a yard carries the device token, and for a yard paired through the edge, the session beside it. What you write goes to your yard: letters to the crew, decision answers, reactions, and the photos you attach.
For a yard paired through the edge, all of it travels through the edge, which relays it to the yard. A yard paired by its own address is reached directly, with no edge and no sign-in.
A yard paired by its own address receives calls at that HTTPS address. The app does not follow redirects.
A weighty approval asks for the phone's unlock first. The system draws that prompt, and the app learns only that you passed.
What the edge itself keeps about Google connections is a different page: the edge's privacy policy.
notifications
Notifications
While the app is open, it tells you of new letters and decisions itself. On Android 13 and later, it asks once after the first pairing whether it may notify you. Earlier versions use Android's notification settings.
Push notifications, when they are switched on, come through Firebase Cloud Messaging. Each push is an empty bell: the kind, an id, and a count. It carries no yard, no sender, and no text. The phone then fetches from its yards and tells of what arrived.
For that, the phone shares its push token with the relay so it can be woken. A yard paired by its own address gets no push.
The release build registers its push token with the relay through the edge, for every yard paired through the edge. A yard paired by its own address registers nothing, and neither does a debug build or one pointed at a test edge.
camera
The camera
Pairing scans the yard's QR code through Google's code scanner. Play services draws the camera and hands back the text, so the app holds no camera permission.
Attaching a photo with the camera writes one picture into the app's cache. The app reads it back, attaches it to the letter, and removes the file. The gallery's picker reads only the image you choose.
The app keeps copies of photos in letters in its cache so it can show them again. Photos you attach are resized into a new JPEG before sending, which removes their location metadata. Android may clear cache files.
not in the app
What is not in the app
No analytics, no crash reporting, and no ads: the app's dependency list holds no analytics, crash-reporting, or advertising SDK.
The app does not sell data or send it to advertising or data-broker services. What leaves the phone goes to the edge for sign-in, to your yard for yard activity, or to the relay for a push token when push is switched on.
deleting
How to delete
Forgetting a yard in the app removes that yard's kept record from the phone. Forgetting the last yard also ends the sign-in at the edge and removes the account's record, so the phone holds no credential at all.
Uninstalling the app removes everything it kept.
What your yard keeps of your letters and decisions stays with the yard, on your machine or your hosted yard. Forgetting and uninstalling do not delete it there.