Version 2.2.0, updated: 29 October 2026
This policy describes Workspace from version 2.2.0 (build 54), the Android Home launcher with package ID com.schukai.nucleus. It covers the Home screen, optional separate work apps, company connections, the local authenticator and optional direct device synchronization.
Controller and contact
The app provider is schukai, Eichenstraße 26, 82290 Landsberied, Germany. Send privacy enquiries to hey@schukai.com. Further contact details are available in the schukai imprint.
When you connect a company, the operator of the selected schukai Workspace instance also processes data. Its privacy information and responsibility for company accounts and server data apply in addition to this policy.
Home screen and local data
The launcher works without an account or company connection. It uses Android to discover available app entries, labels, icons and accessible work profiles. This information enables the app list and launching the app you select. The launcher does not send this app inventory to schukai.
Favorites, named lists, company details, appearance, filters and gesture preferences are stored locally. Only if you enable device synchronization and explicitly pair devices as described below are the selected layout data transferred to those devices. To sort by use, Workspace keeps local counts and timestamps for apps opened through the launcher. It contains no advertising or analytics services.
Opening another app transfers control to that app. Its contents, accounts and servers have their own privacy information. This does not let Workspace read messages, contacts or contents inside those apps.
Custom backgrounds and image selection
If you choose a custom background image, Workspace reads the image file you select through Android, processes it locally and stores a copy in private app storage. Workspace does not upload the image to schukai. A file or cloud provider you select through Android may process that access under its own privacy policy.
The local image copy and your chosen color, gradient and screen orientation are not part of layout export or device synchronization. Removing or replacing an image deletes the local app copy that is no longer used. The original image file with the selected provider remains intact.
Separate work apps and external stores
If you choose, Android creates a work profile after your confirmation. Workspace manages only the work profile it enrolled. That profile separates its installed apps and data from the personal profile. A favorite list alone does not create this separation.
Workspace lists supported work apps and can open, pause or, after Android confirmation, uninstall installed apps. Protection settings affect only its own work profile. A locally entered company name is not a verified company connection.
Workspace does not import, share, download or install APK files. You explicitly open available store links; the external provider handles installation and data processing under its own privacy information. Not every store is available in every work profile. Local profile management does not send an app inventory to a management server.
When upgrading from an earlier version, Workspace cleans up its pending install sessions, staged APK files and former cross-profile APK routing. Installed apps and their data, the company name and previously stored local signing-certificate fingerprints remain intact. No pending installation is completed automatically.
Android also provides controls to pause or remove the work profile. Confirming removal deletes that profile's apps and local data. It does not remove personal app data. Removing a profile does not automatically delete data a work app already stored on a server.
The separate optional locking gesture requires Android device-administrator permission to lock the personal device. This permission does not provide remote management or transfer private app contents.
Company connection and camera
Company access is off by default and can be enabled for this device in Settings. It is independent of device synchronization and the local authenticator. Workspace contacts the selected HTTPS instance only when you start a company connection. Pairing sends the pairing identifier and confirmation data, the device label “Workspace Android”, the Android platform and the app version. The server also processes the IP address required for the connection.
After your confirmation, the instance returns a session and company context. Further identity and sign-out requests use that session. Session credentials are encrypted on the device using Android Keystore and excluded from configuration exports and the Android backup configured by the app.
The camera is used with your permission to read a connection QR code. Camera frames are processed locally, not uploaded as images or saved as recordings. The pairing information contained in the QR code is used for the company connection you initiated.
The company operator's privacy information determines what server logs and account data it retains and for how long. A manually entered company is not yet a verified server connection.
Optional direct device synchronization over Bluetooth
Device synchronization is off by default. If you enable it, Android requests permission to access nearby devices. Workspace uses Bluetooth to find and connect the devices you select, not to derive your location. The QR scanner uses the camera only when you explicitly open it and grant permission; frames are processed locally and are not uploaded or saved as recordings.
Pairing uses a time-limited invitation and a code you compare and confirm on both devices. Workspace creates a separate installation identity with a private key kept in Android Keystore. The devices verify each other's certificates; Android Bluetooth bonding alone does not establish trust in Workspace. Data travels directly over Bluetooth with additional TLS 1.3 encryption and mutual certificate verification. No schukai server, cloud service or Google Nearby service is used for this exchange.
The transferred data consists of portable favorite lists with their names, identifiers, ordering, app package and component identifiers, labels and the associated design and light/dark settings. This can reveal which apps you use as favorites. Contents of those apps are not read or transferred. Company details and sessions, authenticator contents, usage counts and history, specific Android work-profile identifiers, the active list selection and other device-local settings are excluded. The background images, colors, gradients and screen orientation described above also remain local.
Workspace privately stores paired devices' names and Bluetooth addresses, certificate fingerprints and trust relationships, the time of the last successful synchronization and common comparison snapshots of layouts. When there is a conflict, the affected layouts and any selection made to resolve it are retained. These data support reconnection, change detection and visible conflict resolution. The installation identity, trust data and comparison snapshots are excluded from configuration export, diagnostic export and the Android backup configured by the app.
Synchronization runs only while the feature is enabled and Workspace is in the foreground. Previously paired devices can then reconnect and synchronize layout changes. Background delivery is not promised. Layout data can propagate through other explicitly paired devices; each direct connection requires its own trust relationship. Android can also see Bluetooth metadata and bonded devices. The app does not make devices anonymous to Android.
Turning the feature off stops connections and ongoing synchronization, but does not delete stored trust data or your layouts. Removing a paired device removes that direct local trust relationship and its comparison snapshot. It does not remove relationships on other devices or data already stored there. Comparison snapshots are replaced by later synchronizations; the installation's own identity remains until app data are cleared or the app is uninstalled.
Separate transfer of an encrypted authenticator backup
Separately from layout synchronization, you can explicitly send an existing authenticator backup encrypted with its own passphrase to a selected trusted device. Export requires fresh authentication in Guard; the receiving device must also approve receipt. Only the additionally passphrase-encrypted backup file travels over the encrypted Bluetooth connection. The vault is not automatically synchronized. Device keys, passphrases and unencrypted setup keys are not transferred.
For this transfer, the encrypted file and its device-association metadata are held temporarily in private app storage on both devices. This storage is excluded from public files, configuration exports and the Android backup configured by the app. Temporary files have a 24-hour lifetime; expired files are cleaned up the next time this storage is accessed. You can also explicitly remove the files made available there. schukai receives neither this file nor its passphrase through a server.
The received file is imported only through the existing restore flow after your separate passphrase entry, preview check and authentication. Successful transfer does not establish successful restoration. Disconnecting the devices does not delete accounts already restored on the receiving device or backup files saved separately. Continue to keep an independent usable backup and its passphrase separately.
Export, retention and deletion
You explicitly export configuration to a location you select. Exported launcher configuration contains no session credentials. If you select cloud storage, the storage provider's terms also apply. You must delete exported files and copies at their storage locations yourself.
Local preferences remain until you change them, reset them or clear app data. A layout reset does not delete other apps' data. Removing a company connection deletes the local session; a server sign-out attempt does not replace a request to delete the company account. Contact the instance operator for that.
Your browser opens linked websites. The website privacy policy additionally applies when you visit the website.
Purposes, legal bases and your rights
Processing serves the app functions you request and, for company connections, the approved sign-in. Where schukai processes personal data to perform its contract with you, the basis is Article 6(1)(b) GDPR. For company accounts, the responsible operator determines the applicable legal basis. An Android permission alone does not replace that legal basis.
Subject to applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You can object to processing based on legitimate interests and withdraw consent for the future. You can also complain to a data protection supervisory authority. Contact schukai at the address above about its processing, and the relevant operator about an independently operated company instance.
Earlier Workspace versions
Before version 2.0.0, Workspace used a different interface with online time tracking, tasks and service chat. This policy does not claim those features worked exclusively locally. The relevant service and server operator's information applies to that earlier processing. The new launcher does not convert retained legacy data into favorites or automatically delete it.
Local authenticator from version 2.1.0
If you use the authenticator, Workspace stores issuers, account names and TOTP setup keys in a separate encrypted local vault. Access requires Android device credentials or strong biometrics and hardware-backed key protection. Workspace does not obtain a copy of your device PIN or biometric templates. Leaving the activity or two minutes of inactivity locks the vault. Setup-QR scanning requests the camera only after your action and Android permission. Code generation needs no network connection and sends no keys to schukai.
Backup and restore happen only at your request. A separate backup file contains account names and setup keys encrypted with its own passphrase. You select the storage provider through Android; a chosen cloud provider may handle the encrypted file under its own terms. schukai receives neither file nor passphrase. This is separate from launcher-configuration export. Keep a copy outside the phone and its passphrase separately; without a usable backup and passphrase, schukai cannot recover lost accounts.
Codes enter the Android clipboard only after your explicit Copy action. Workspace marks them sensitive and attempts to clear its own copy after 30 seconds or on locking. Android and other apps may process further copies; Workspace cannot revoke a copy already passed to another app.
You can delete individual entries in the authenticator. Clearing Workspace app data or uninstalling the app also removes its local authenticator storage. This does not delete separately saved backup files; remove those through the storage provider you selected.