GESTO

Privacy Policy

App: GESTO (package com.hebbian.gesto)

Last updated: October 11, 2026

GESTO (“the app”, “we”, “us”) lets you draw custom gestures to launch apps and run shortcuts. This Privacy Policy explains what information the app handles, why, and your choices. By using the app you agree to this policy.

1. Information We Collect

a. Account information

If you choose to sign in, we collect and store:

  • Your email address
  • Your display name (which you can edit; if not set, it is derived from your email)

Sign-in is provided through Supabase (authentication) and optionally Google Sign-In. We do not store your password; passwords are handled by the Supabase authentication service.

b. Gesture and shortcut data

When you create gestures and shortcuts, the app stores:

  • The gesture strokes you draw
  • The actions you assign (e.g., the app package name, activity, or shortcut to launch, and any labels)
  • Related settings (e.g., stroke style, recognition delay, edge-handle position)

If you are signed in, this data is synced to your account on Supabase so you can back up and restore it across devices. If you use the app without an account, this data stays only on your device.

c. Installed-app information

To let you pick which app a gesture should open, the app reads the list of apps on your device that expose a launcher activity. Android package visibility is limited to this launcher-app query; the app does not request broad access to all installed packages. This list is used on the device to display the app picker and launch the app you choose. The list is not uploaded to our servers.

d. AI shortcut-name suggestions

If you create a multi-action shortcut, the app can suggest a name. To do this, it sends the labels of the selected actions (e.g., app and action names) to our Supabase Edge Function, which forwards them to OpenAI to generate a suggested name. This text is used only to generate the suggestion and is not used to identify you.

e. Profile avatar (optional)

If you are signed in, the app may request a profile image from Gravatar using a hashed version of your email address. If no image exists, the app shows your initial instead.

f. Advertising data

The app displays banner ads using the Google Mobile Ads SDK (AdMob). Google may automatically collect and share the following data for advertising, analytics, and fraud-prevention purposes:

  • IP address, which may be used to estimate a device’s general location
  • App and ad interactions, such as app launches, taps, ad impressions, and video views
  • Diagnostic information, such as app or SDK performance, startup time, hangs, and energy usage
  • Device and account identifiers, including the Android advertising ID and app set ID when available

This advertising data is transmitted to Google using encryption in transit. Where required, the app uses Google’s User Messaging Platform (UMP) to request consent before requesting ads. You can revisit Google’s advertising privacy choices from Settings when that option is required for your region, and you can reset or delete your advertising ID in Android settings.

g. Purchases

The app is free and currently does not sell anything: it offers no in-app purchases and does not use Google Play Billing, so it does not collect purchase or payment information. If purchases are offered in a future version, this policy will be updated before they become available.

h. Usage statistics and crash reports

The app uses Firebase Analytics and Firebase Crashlytics (provided by Google) to understand how the app is used and to fix crashes. When this is turned on, the following may be collected:

  • App usage events, such as app opens, which onboarding step you reached, whether a drawn gesture matched one of your gestures, and how many actions and samples a new gesture has. We do not send your gesture drawings, gesture names, or the names of the apps and actions you launch.
  • Device and app information, such as device model, Android version, app version, language, and approximate country derived from your IP address.
  • App instance identifiers: a Firebase app instance ID and a Crashlytics installation ID. Firebase Analytics in this app is configured not to collect the Android advertising ID and not to send ad-personalization signals.
  • Crash reports: the stack trace and device state at the time of a crash.

This is off by default in the European Economic Area, the United Kingdom and Switzerland (determined from your mobile network, SIM and device region settings), and is only turned on there if you enable it. Elsewhere it is on by default. You can turn it on or off at any time in Settings → Share usage & crash data. When it is off, the app does not send usage events or crash reports.

i. In-app review

The app may show Google Play’s in-app review prompt after you have used gestures for a while. The prompt and any rating or review you submit are handled by Google Play; the app does not receive your rating, review text, or identity.

2. What We Do NOT Collect

  • We do not sell your gesture, shortcut, or account data.
  • We do not collect the contents of other apps, your messages, or your browsing.

3. How We Use Information

  • To provide sign-in and keep you logged in.
  • To back up, sync, and restore your gestures and settings.
  • To display the app picker and launch the apps/actions you choose.
  • To generate optional AI name suggestions for your shortcuts.
  • To display and measure ads and prevent advertising fraud and abuse.
  • To understand how the app is used, measure onboarding and gesture recognition, and diagnose crashes.
  • To respond to support requests you send us.

4. Permissions We Use

  • Display over other apps (overlay): to show the floating “edge handle” and the gesture-drawing canvas on top of other apps.
  • Foreground service (special use): to keep the edge handle available so you can open the gesture canvas from any screen.
  • Launcher-app visibility: to list apps that expose a launcher activity so you can assign them to gestures (used on-device). The app does not request visibility into every installed package.
  • Internet: for sign-in, sync, AI name suggestions, consent management, advertising, and sending usage statistics and crash reports.
  • Advertising ID (when available): declared by the Google Mobile Ads SDK and used for advertising, measurement, and fraud prevention. You can reset or delete this identifier in Android settings.

5. Third-Party Services

We rely on the following services, each governed by its own privacy policy:

For more information about how Google uses information from apps that use its services, see https://policies.google.com/technologies/partner-sites.

6. Data Retention and Deletion

  • Data stored only on your device is removed when you uninstall the app or clear its data.
  • Account and synced data are retained while your account exists.
  • Advertising data is retained by Google according to Google’s policies and the user’s advertising and consent choices.
  • Usage statistics are retained in Google Analytics for up to 14 months; Crashlytics crash reports are retained for 90 days.
  • You can log out at any time in Settings.
  • To delete your account and associated synced data, contact us at the email below and we will process your request.

7. Data Security

We use industry-standard measures provided by our service providers (e.g., encrypted connections and access controls) to protect your information. No method of transmission or storage is 100% secure, but we take reasonable steps to safeguard your data.

8. Children’s Privacy

The app is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

9. International Users

Your information may be processed and stored on servers located outside your country by the third-party services listed above. By using the app, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the “Last updated” date above. Continued use of the app after changes means you accept the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Email: hebbianai@gmail.com