Document version 2.3.2, updated: 3 November 2026
This policy describes the Workspace Android launcher from schukai, package ID com.schukai.nucleus, in the release with voluntary local diagnostic history. It covers the Home screen, separate work apps, company connections, local authenticator, optional device synchronization and diagnostics. Earlier privacy information remains available for earlier app releases. The document version identifies this policy, rather than the build number of your installed app.
Controller and contact
The controller for the app offering is schukai, Eichenstraße 26, 82290 Landsberied, Germany. Send privacy enquiries to hey@schukai.com. Further contact details are available in the schukai imprint.
When you connect a company, the operator of the selected schukai Workspace instance also processes data. Its privacy information and responsibility for company accounts and server data apply in addition to this policy.
Home screen and local data
The launcher works without an account or company connection. It uses Android to discover available app entries, labels, icons and accessible work profiles. This information enables the app list and launching the app you select. The launcher does not send this app inventory to schukai.
Favorites, named lists, company details, appearance, filters and gesture preferences are stored locally. Only if you enable device synchronization and explicitly pair devices as described below are the selected layout data transferred to those devices. To sort by use, Workspace keeps local counts and timestamps for apps opened through the launcher. It contains no advertising or analytics services.
Opening another app transfers control to that app. Its contents, accounts and servers have their own privacy information. This does not let Workspace read messages, contacts or contents inside those apps.
Custom backgrounds and image selection
If you choose a custom background image, Workspace reads the image file you select through Android, processes it locally and stores a copy in private app storage. Workspace does not upload the image to schukai. A file or cloud provider you select through Android may process that access under its own privacy policy.
The local image copy and your chosen color, gradient and screen orientation are not part of layout export or device synchronization. Removing or replacing an image deletes the local app copy that is no longer used. The original image file with the selected provider remains intact.
Separate work apps and external stores
If you choose, Android creates a work profile after your confirmation. Workspace manages only the work profile it enrolled. That profile separates its installed apps and data from the personal profile. A favorite list alone does not create this separation.
Workspace lists supported work apps and can open, pause or, after Android confirmation, uninstall installed apps. Protection settings affect only its own work profile. A locally entered company name is not a verified company connection.
Workspace does not import, share, download or install APK files. You explicitly open available store links; the external provider handles installation and data processing under its own privacy information. Not every store is available in every work profile. Local profile management does not send an app inventory to a management server.
When upgrading from an earlier version, Workspace cleans up its pending install sessions, staged APK files and former cross-profile APK routing. Installed apps and their data, the company name and previously stored local signing-certificate fingerprints remain intact. No pending installation is completed automatically.
Android also provides controls to pause or remove the work profile. Confirming removal deletes that profile's apps and local data. It does not remove personal app data. Removing a profile does not automatically delete data a work app already stored on a server.
The separate optional locking gesture requires Android device-administrator permission to lock the personal device. This permission does not provide remote management or transfer private app contents.
Company connection and camera
Company access is off by default and can be enabled for this device in Settings. It is independent of device synchronization and the local authenticator. Workspace contacts the selected HTTPS instance only when you start a company connection. Pairing sends the pairing identifier and confirmation data, the device label “Workspace Android”, the Android platform and the app version. The server also processes the IP address required for the connection.
After your confirmation, the instance returns a session and company context. Further identity and sign-out requests use that session. Session credentials are encrypted on the device using Android Keystore and excluded from configuration exports and the Android backup configured by the app.
The camera is used with your permission to read a connection QR code. Camera frames are processed locally, not uploaded as images or saved as recordings. The pairing information contained in the QR code is used for the company connection you initiated.
The company operator's privacy information determines what server logs and account data it retains and for how long. A manually entered company is not yet a verified server connection.
Optional direct device synchronization over Bluetooth
Device synchronization is off by default. If you enable it, Android requests permission to access nearby devices unless you have already granted it. Workspace uses Bluetooth to find and connect the devices you select, not to derive your location. The QR scanner uses the camera only when you explicitly open it and grant permission; frames are processed locally and are not uploaded or saved as recordings.
Pairing uses a time-limited invitation and a code you compare and confirm on both devices. Workspace creates a separate installation identity with a private key kept in Android Keystore. The devices verify each other's certificates; Android Bluetooth bonding alone does not establish trust in Workspace. Data travels directly over Bluetooth with additional TLS 1.3 encryption and mutual certificate verification. No schukai server, cloud service or Google Nearby service is used for this exchange.
The transferred data consists of portable favorite lists with their names, identifiers, ordering, app package and component identifiers, labels and the associated design and light/dark settings. This can reveal which apps you use as favorites. Contents of those apps are not read or transferred. Company details and sessions, authenticator contents, usage counts and history, specific Android work-profile identifiers, the active list selection and other device-local settings are excluded. The background images, colors, gradients and screen orientation described above also remain local.
Workspace privately stores paired devices' names and Bluetooth addresses, certificate fingerprints and trust relationships, the time of the last successful synchronization and common comparison snapshots of layouts. When there is a conflict, the affected layouts and any selection made to resolve it are retained. These data support reconnection, change detection and visible conflict resolution. The installation identity, trust data and comparison snapshots are excluded from configuration export, diagnostic export and the Android backup configured by the app.
Synchronization runs only while the feature is enabled, Workspace is in the foreground and the device is unlocked and active. Previously paired devices can then reconnect and synchronize layout changes. Background delivery is not promised. Layout data can propagate through other explicitly paired devices; each direct connection requires its own trust relationship. Android can also see Bluetooth metadata and bonded devices. The app does not make devices anonymous to Android.
Turning the feature off stops connections and ongoing synchronization, but does not delete stored trust data or your layouts. Removing a paired device removes that direct local trust relationship and its comparison snapshot. It does not remove relationships on other devices or data already stored there. Comparison snapshots are replaced by later synchronizations. The installation's own identity remains until you separately reset device synchronization, clear app data or uninstall the app.
The separate device-synchronization reset removes active local trust relationships, their comparison and conflict snapshots, the synchronization identity and temporary transfer files. Your current favorite lists and authenticator vault remain intact. Resetting does not create an additional copy of corrupt trust storage.
When starting after the update, Workspace attempts to remove private error copies of that storage left by earlier releases, even if device synchronization is off. Deletion failures are shown locally and removal is retried on later starts. Old files may remain until removal succeeds. They are not exported or uploaded instead. This cleanup does not change valid favorites or the authenticator vault.
Separate transfer of an encrypted authenticator backup
Separately from layout synchronization, you can explicitly send a separate authenticator backup to a selected trusted device. After fresh authentication and entry of your own passphrase, Guard creates an encrypted backup file from your current accounts. The receiving device must also approve receipt. Only the additionally passphrase-encrypted backup file travels over the encrypted Bluetooth connection. The vault is not automatically synchronized. Device keys, passphrases and unencrypted setup keys are not transferred.
For this transfer, the encrypted file and its device-association metadata are held temporarily in private app storage on both devices. This storage is excluded from public files, configuration exports and the Android backup configured by the app. Temporary files have a 24-hour lifetime; expired files are cleaned up the next time this storage is accessed. Workspace removes the outgoing transfer file after a successful transfer. The received transfer file is also removed after successful restoration. You can also explicitly remove the files made available there. schukai receives neither this file nor its passphrase through a server.
The received file is imported only through the existing restore flow after your separate passphrase entry, preview check and authentication. Successful transfer does not establish successful restoration. Disconnecting the devices does not delete accounts already restored on the receiving device or backup files saved separately. Continue to keep an independent usable backup and its passphrase separately.
Voluntary local diagnostic history
Diagnostic history is off by default, including after upgrading from a release with automatic diagnostics. Workspace records technical events only after you have received the information, expressly consented and turned the feature on. You can use the launcher, including favorites and Guard, without this history.
The history helps investigate loading failures, incomplete app lists and launcher reloads. It is not used for advertising or to assess your work performance. It contains timestamps, predefined codes for Workspace screens and lifecycle events, loading durations, aggregate app/icon counts and error/loading states.
The history does not record app names, package identifiers, search terms, list names, account or login details, authenticator secrets, arbitrary error-message contents or stack traces. Timestamps and screen changes may nevertheless reveal usage patterns when combined with other information. The history is not categorically treated as anonymous.
The history stays in private app storage. It is excluded from the Android backup configured for the app, Bluetooth device synchronization and normal configuration exports. It is not automatically transmitted to schukai or an analytics service. Android's app-storage protection applies; Workspace does not additionally encrypt the diagnostic file itself.
Recording remains on until you turn it off, including after an app restart. The active history contains at most 128 events. Adding entries displaces older entries when necessary; entries older than 24 hours are removed from the usable history on access. The stored file is updated on a successful write. Without further use or if storage fails, older file contents may remain longer. There is no scheduled background deletion job or promise of physical file deletion precisely after 24 hours. Prepared or exported reports are separate copies.
You can withdraw your consent for the future at any time by turning diagnostic history off. Recording stops; the existing history, its residual files inside the app and report snapshots still held inside the app are removed. Deletion failures are reported as such and can be retried. Settings, favorites and Guard are preserved. Withdrawal does not affect the lawfulness of processing based on your consent before withdrawal.
“Delete existing history” also lets you separately remove the history and pending report snapshots. If recording remains on, new events are recorded afterwards. Simply reloading the launcher or resetting a layout does not delete history. Local controls cannot recall files already exported or copies sent to support.
Workspace keeps the selected setting and a minimal local record of the information used and the time consent was granted or withdrawn, separately from the event history. No account contents or new device identifiers are collected for this, and no records are automatically sent to a server. The setting controls the function you choose. Where a consent record is personal data, it fulfils the duty to demonstrate consent under Article 7(1) GDPR, based on Article 6(1)(c) GDPR, and is retained only for as long as that evidence is needed. The event history's 24-hour cleanup does not apply to it.
When moving to this voluntary feature, older automatic diagnostic data and associated residual/report copies inside the app are cleaned up. A previous recording setting is not treated as new consent. If deletion fails, recording remains off and cleanup can be retried.
Reload launcher
“Reload launcher” reloads the Home screen and app list. If you have enabled diagnostic history, Workspace tries to save it first. Failure to save does not prevent reloading and is reported. Reloading does not turn history on without activation. Saved settings, favorites and Guard/authenticator data are not reset. The function does not promise to fix the underlying cause of a fault.
Voluntary diagnostic export and support
Only when you explicitly start and confirm diagnostic export does Workspace prepare a text report. It contains the app version, device manufacturer and model, Android version including API level, current technical loading/error states, app/icon counts and an explanation of screen codes. An existing voluntary history adds timestamps and technical events. You can request a current-state report even with history off; past events are not retrospectively recorded and exporting does not turn history on.
The report contains neither app names/package identifiers or favorites lists nor search terms, company accounts, login details or authenticator secrets. Device details, timestamps and a subsequent support request may nevertheless make it possible to associate it with you. It is not categorically anonymous.
You choose the destination through Android's document picker. A file or cloud provider you select may process the file or store it off your device; its own privacy information and any applicable transfer terms apply in addition. Workspace does not additionally encrypt the exported text report. Review it before sharing and choose its destination and recipient deliberately. Confirming export does not send an email or automatically upload the report to schukai. You make any subsequent disclosure to support yourself.
The prepared report is held locally during the document-picker operation and can be restored for that operation after an interruption. Workspace clears this pending export snapshot after the export attempt, cancellation of the picker or failure to launch it. There is no separate 24-hour limit for an export operation that remains pending. You manage and delete exported files and copies held by your selected provider yourself.
If you send a report to hey@schukai.com, we receive its content together with your email address, message and other details you choose to provide. We use these to handle your support request and investigate the problem. Contractual requests are handled under Article 6(1)(b) GDPR; other requests rely on our legitimate interest in responding under Article 6(1)(f) GDPR. We retain them as long as needed to handle the request and for legitimate, time-limited evidentiary purposes, subject to statutory retention duties under Article 6(1)(c) GDPR. Information about email/support providers is available in the website privacy policy. The local 24-hour cleanup does not delete these support records.
Export, retention and deletion
You explicitly export configuration to a location you select. Exported launcher configuration contains no session credentials. If you select cloud storage, the storage provider's terms also apply. You must delete exported files and copies at their storage locations yourself.
Local preferences remain until you change them, reset them or clear app data. A layout reset does not delete other apps' data. Removing a company connection deletes the local session; a server sign-out attempt does not replace a request to delete the company account. Contact the instance operator for that.
Your browser opens linked websites. The website privacy policy additionally applies when you visit the website.
Purposes, legal bases and your rights
Processing serves the app functions you request and, for company connections, the approved sign-in. Where schukai processes personal data to perform its contract with you, the basis is Article 6(1)(b) GDPR. For company accounts, the responsible operator determines the applicable legal basis. An Android permission alone does not replace that legal basis.
For voluntary diagnostic history, where schukai processes personal data for this purpose, the basis is your consent under Article 6(1)(a) GDPR. We obtain your consent to the corresponding storage of or access to information on your device under section 25(1) TDDDG. The launcher's core functions do not depend on this consent. You can withdraw it at any time by turning recording off; a general reliance on legitimate interests does not replace consent to this history.
Storage of your chosen function setting is exempt from terminal-equipment consent under section 25(2)(2) TDDDG insofar as strictly necessary for this control. This does not assert a blanket exemption for all diagnostic data. For an explicitly requested current-state export, where personal data are processed to provide that requested service and the applicable conditions are met, the basis is Article 6(1)(b) GDPR. Reports voluntarily sent to support are processed separately under the bases described above.
Subject to applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You can object to processing based on legitimate interests and withdraw consent for the future. You can also complain to a data protection supervisory authority. Contact schukai at the address above about its processing, and the relevant operator about an independently operated company instance.
Earlier Workspace versions
Before version 2.0.0, Workspace used a different interface with online time tracking, tasks and service chat. This policy does not claim those features worked exclusively locally. The relevant service and server operator's information applies to that earlier processing. The new launcher does not convert retained legacy data into favorites or automatically delete it.
Local authenticator from version 2.1.0
If you use the authenticator, Workspace stores issuers, account names and TOTP setup keys in a separate encrypted local vault. Access requires Android device credentials or strong biometrics and hardware-backed key protection. Workspace does not obtain a copy of your device PIN or biometric templates. Leaving the activity or two minutes of inactivity locks the vault. Setup-QR scanning requests the camera only after your action and Android permission. Code generation needs no network connection and sends no keys to schukai.
Backup and restore happen only at your request. A separate backup file contains account names and setup keys encrypted with its own passphrase. You select the storage provider through Android; a chosen cloud provider may handle the encrypted file under its own terms. schukai receives neither file nor passphrase. This is separate from launcher-configuration export. Keep a copy outside the phone and its passphrase separately; without a usable backup and passphrase, schukai cannot recover lost accounts.
Codes enter the Android clipboard only after your explicit Copy action. Workspace marks them sensitive and attempts to clear its own copy after 30 seconds or on locking. Android and other apps may process further copies; Workspace cannot revoke a copy already passed to another app.
You can delete individual entries in the authenticator. Clearing Workspace app data or uninstalling the app also removes its local authenticator storage. This does not delete separately saved backup files; remove those through the storage provider you selected.
Further privacy rights and material changes
schukai does not sell personal data.
The data processing and contact channels described in this notice also apply when the app is used outside Germany. Mandatory rights under applicable privacy law remain available and are not limited to the GDPR rights expressly mentioned here. Depending on the applicable law and its conditions, these may include confirmation of processing, access, correction, deletion, anonymisation or blocking of data processed unlawfully or no longer needed, data portability, objection and withdrawal of consent. Requests concerning data processed by schukai can be sent to hey@schukai.com. You may also complain to a competent data protection authority.
Where the Brazilian LGPD applies to the processing, its rights remain available, including confirmation and access, correction, anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data, statutory data portability, information about recipients and about the possibility and consequences of refusing consent, withdrawal of consent and consent-related deletion. Statutory exceptions and retention duties continue to apply. Requests can be submitted through the privacy contact above; the right to complain to the ANPD remains unaffected.
If the processing described here changes materially, we will expressly inform affected users about the change, when it starts, its consequences and the relevant rights. For changes to an app function, a prominent in-app notice will be provided before the affected processing starts. Where a service or support change also affects older app versions, we will additionally ensure suitable direct notice through an existing contact or service channel that may lawfully be used, in good time before the change starts. Quietly changing a website or merely publishing an update is insufficient for this purpose. Where consent is required, it will be obtained before the processing that depends on it. A privacy notice does not constitute agreement to a contractual amendment.