Privacy Policy — Facilitator: Meeting Timer

Effective date: 10 August 2026
App: Facilitator: Meeting Timer (com.zyepro.facilitator)
Contact: facilitator@zyepro.com

The short version

Facilitator has no account, no sign-in, no ads, no analytics and no tracking, and it has no server. Everything you author stays on your device.

The app can use your local network for one thing only: showing your timer on a second device you have paired yourself, in the same room. It has no ability to reach us, because there is nothing of ours to reach.

We do not claim that nothing whatsoever leaves your device, because one component we ship is not ours — see Third-party components below, which says exactly what it is and what we know about it.

What the app stores — on your device only

• Your agendas and meeting templates. Item titles, durations, speaker names, and the alert profile you chose for each item.
• Your alert profiles. The warning levels, sounds, spoken phrases and colours you author.
• Your meeting records. While a meeting runs, the app writes a running journal to its private storage so that a crash, a battery pull or a phone restart cannot lose the meeting. When the meeting ends the journal becomes a report you can reopen: what was planned, what actually ran, time granted or taken back, and any notes you marked.
• Your notes. The timestamped markers you tap during a meeting — Decision, Action, Question, Delay, Issue — and any text you later add to them.
• Your preferences. Theme, appearance, presets, and what the audience display shows.
• Your pairing keys. If you pair a second device, the app stores a private key and the paired device's fingerprint. On Android the private key is held by the Android Keystore. These never leave your device.

None of this is sent to us. We have no server that could receive it.

The audience display, and the local network

The audience display — the second screen a room reads — works in two ways.

• On one device, it is a second window or a second process on the same machine, connected over an internal channel that never touches a network.
• Between two devices you pair, it is a direct connection over your own local network — your Wi-Fi or your LAN. You start it, you confirm the other device on screen, and the two devices talk only to each other.

That connection never leaves your local network. There is no discovery, no relay, no cloud, no account and no server of ours anywhere in it. The two devices verify each other with keys they generated themselves, and a device you have not paired is refused. What travels is what the audience screen shows — the clock, and what you chose to display. Your notes, your bank, and your schedule variance are deliberately never sent to the audience screen.

Sharing and export — always your action

• Export a report as CSV or PDF: only happens when you tap Export or Share, and on phones and tablets it uses the operating system's standard share sheet, so you choose where the file goes — a mail app, a file manager, cloud storage, whatever you pick. On desktop the file is written to a folder you can open.
• Move an agenda between devices as text: the app produces text you copy, and reads text you paste. Nothing is uploaded.

Once you hand a file to another app, that app's own privacy policy governs what happens next.

Spoken alerts and the system text-to-speech engine

If you enable spoken alerts, the app asks Android's own text-to-speech service to say a phrase — for example a warning that time is nearly up, which may include the agenda item's title or the speaker's name you typed. That text is handed to the speech engine you have selected in your device settings, which is a separate part of your device and not part of this app.

Most speech engines run entirely on the device. Some can be configured to use a network voice, in which case the phrase is processed by whoever provides that engine, under their privacy policy — not ours. If that matters to you, choose an offline voice in your device's text-to-speech settings, or use the app's sound-and-colour alerts instead of speech. We never send that text anywhere ourselves.

Permissions

The app does not request location, contacts, microphone, storage, or access to your accounts.

Third-party components

We are telling you this because it is true, not because we have to.

The QR scanner uses Google's ML Kit barcode component, which runs entirely on your device — that is why we chose it, so pairing works in a room with no internet at all. That component ships Google's own telemetry transport as part of it, and we cannot remove it. We do not use it, we send nothing through it, and we receive nothing from it. We have taken the one step available to us — the app withholds the network-state permission that its background uploader tries to use — and on the device we tested, that attempt fails and is discarded by Google's own code.

What we will not claim: that this proves nothing is ever collected by that component. It is one measurement on one device, not a proof about every path. If Google's component transmits anything, it does so under Google's privacy policy and not ours, and it carries nothing you typed into this app — we never hand it anything but a camera frame to look for a QR code in.

Data deletion

Delete individual agendas, alert profiles, notes or past meetings inside the app, or uninstall the app — uninstalling removes everything, since nothing exists outside your device.

Children

Facilitator is a professional tool for a general adult audience. It collects no personal data from anyone, including children.

Changes to this policy

If a future version of the app changes any of the above — for example, if optional online features or in-app purchases are ever added — this policy will be updated and the effective date revised before that version ships. Material changes will be called out in the app's update notes.

Contact

Questions about this policy or your data: facilitator@zyepro.com