Roundtable collects nothing,
because it can't.

This policy covers the Roundtable Android app (com.naskait.roundtable) published by Naska-IT. Last updated 4 November 2026.

Who we are

Naska-IT — DRAGAN JOVANOVIĆ PR RAČUNARSKO PROGRAMIRANJE NASKA-IT GORNJI STRIŽEVAC, Ćirinci 60, Gornji Striževac, 18330 Babušnica, Serbia. Contact: [email protected]. Full company details are on our imprint page.

What we collect: nothing

We receive no personal data from this app. No account, no email address, no sign-in, no analytics, no advertising identifier, no crash-reporting SDK, no telemetry of any kind. There is no server to receive it — the app's entire design is that a vote happens between phones in one room, and that is also why there is nothing to breach, subpoena or hand over, including by us.

The one exception is an email you choose to write. Report in the app opens a draft in your own mail app; if you send it, we receive what any email brings us — your address and what you wrote. See Reporting and blocking.

What leaves your phone, and where it goes

When you join a vote, three things travel from your phone to the host's phone — the one running the vote, in the same room, over Bluetooth and Wi-Fi Direct. They travel metres, not to the internet:

Your display name

Whatever you set it to. Before you first host or join, the app asks for it, and suggests the name your phone already has in its settings — often its owner's, such as "Marta's Pixel" — or, where there is none, its make and model. Nothing is sent until you have seen the name and confirmed it, and you can change it on the home screen at any time. It is shown to everyone in that room, which is its purpose — it is how the host knows who is at the table.

A random per-install identifier

Generated on your phone the first time the app runs. It is not your advertising ID and not your device ID. It exists so a phone that briefly loses signal rejoins as itself and cannot vote twice, and so a host can tell two people with the same name apart — each is shown with a short tag made from it. The host's Past votes do not keep the identifier itself: they keep a key made from it and a secret that only the host's phone has, so the host's own records recognise the same person from one meeting to the next, and the key matches nothing on any other phone. In rounds that are not secret the key sits beside each ballot; in a secret round it records only that you were at the table. It stays on the host's phone, and is not in any spreadsheet the host exports. Clearing the app's data replaces your identifier with a new one.

Which answer you chose

So the host can count it. Who else learns it depends on the kind of ballot the host chose, which every phone is shown before anyone votes:

• Open — when the vote closes, every phone in the room is shown who chose what, as in a show of hands. The voters' phones show it and keep no record of it; the host's phone keeps it in Past votes.
• Host only — the host's phone sees who chose what and keeps it in Past votes; every other phone sees only the counts.
• Secret — nobody, the host included, learns what you chose. See the secret ballot.

Nothing else is transmitted when you join. There is no message type in the protocol for anything else.

When you host a vote, your phone tells the phones around it that the room exists:

Your display name, the room's code, and whether the ballot is secret or open

Broadcast to any phone in radio range that is looking for a room, so people can find yours. The question is broadcast too, but only if you choose to show it before the vote starts.

A random host key

Generated on your phone, and separate from your per-install identifier. The phones that join your room receive it, so that someone who blocks you stops seeing your rooms. The key itself is never broadcast: what goes on the air is a six-letter code made from it and the room's code. The code on the air changes with every room, so it does not link your rooms for anyone nearby — but your display name is broadcast as you set it. People who have joined one of your rooms keep your host key and can recognise your later ones; that is how Block works.

The vote itself

The question, the answers, the clock, the names of the people in the room while it fills, and the result when it closes — and, in an Open round, who chose what — to the phones in your room, which is what running a vote is.

Guests without the app

A host can seat someone who does not have the app — typing their name in, and handing over the host's own phone for them to vote on. The name is shown to the room like anyone else's, marked as a guest; the ballot is cast on the host's phone and never travels, and Past votes keep it under that name, as they keep anyone's.

The secret ballot

When the host chooses a secret ballot, your choice is never written next to your name — not in the host's roster, not in the data sent between the phones, and not in the history saved afterwards. The host's phone learns that you voted, so it can show turnout and stop you voting twice, and it never learns what you picked. The running tally stays sealed until the vote closes so that an early answer cannot steer a later one.

This is enforced in the app's code and pinned by its automated tests, not by policy.

Reporting and blocking

Before you first host or join a vote, the app asks you to agree to its room rules: what may not be put on other people's screens, and what you can do when someone does. That you agreed is stored on your phone and nowhere else.

Report

Opens an email to [email protected] in your own mail app, filled in with what was on your screen — the room's name, its question and answers, or the name of the person you are reporting. You see it, can change it, and can discard it; nothing is sent unless you send it. If you do, we use your email address and your report only to deal with that report, keep them no longer than that takes, and pass anything that harms a child, or any other crime, to the authorities.

Block

Kept only on the phone that blocks. When a host blocks you, the host's phone keeps your random per-install identifier and the name you used, so that its rooms can turn your phone away; your phone is told only that the host did not let you in. When you block a host, your phone keeps that host's random host key and name, so its rooms stop appearing in your list. Either is undone with Unblock on the home screen, or by clearing the app's data.

What stays on your phone

Stored in the app's own private storage, readable by no other app:

• The display name you chose, your random per-install identifier and your random host key.
• Votes you have hosted (Past votes). The question, the answers, the counts and the date — and, in an Open or Host only round, who chose what, each ballot beside the voter's name and the key described above. That is what the host saw on screen while the vote ran; the record keeps it. In a secret round it keeps who was at the table and never who chose what. It stays on the host's own phone until they delete it or uninstall, and leaves only if the host makes a file of it — see below.
• Statistics, worked out from those records whenever the host looks at them: for each person, how many rounds they were at, how often they voted and voted with the winner, their yes-rate on yes/no votes, and who votes alike. Nothing is collected for them beyond the records themselves, and a secret round adds only who was there.
• A room that is running, written down as it goes so that a host whose phone restarts can carry on within ten minutes. It holds the seats and the running count, never a secret round's choices, and is deleted when the session ends.
• Questions you chose to save for re-use, and agendas you brought in (below).
• People you have blocked: the random identifier or host key each one reached your phone with, and the name they used.
• That you agreed to the room rules, and whether the app lock is on.
• Whether this phone has bought the Pro upgrade.

Automatic cloud backup is switched off in the app's manifest (allowBackup="false"), so none of this is copied to Google Drive or to a new phone behind your back. To delete all of it: Settings → Apps → Roundtable → Storage → Clear data, or simply uninstall the app. Past votes can also be deleted from inside the app, on the Past votes screen. Because none of it ever reaches us, there is nothing for us to delete on your behalf.

Files you make yourself

Past votes leave the host's phone only as a file the host chooses to make, and go wherever the host sends it — at which point they are covered by whatever the host sends them with.

A spreadsheet (CSV export)

The questions, answers, counts and dates, and, for Open and Host only rounds, the names beside each choice. No identifier or key is in it, and a secret round has no names in it.

An encrypted backup

All of Past votes in one file, with the secret the person keys are made from, encrypted with a passphrase you choose. The app does not keep the passphrase, and without it nobody can open the file — not us, and not anyone holding a copy of the app. Restoring it brings the records back on this phone or a new one.

Agendas from your own AI

The app can copy a prompt for you to paste into an AI app you already use, to prepare a meeting's votes by talking them through. What you tell that AI is between you and it, under its own privacy policy. Roundtable never contacts it: the agenda comes back only as text you share to Roundtable, paste in, or open as a file, and it is kept on your phone like a saved question.

The app lock

Optional, and off until you turn it on. It uses Android's own prompt — your fingerprint, face, or the phone's screen lock — and the app is told only whether it succeeded: it never sees or stores anything biometric. While it is on, Past votes and the lock screen are kept out of screenshots and the recent-apps view.

Permissions, and why each one exists

Bluetooth (scan, advertise, connect) and nearby Wi-Fi devices

How one phone finds and talks to another with no network. Both are declared to Android with neverForLocation, a formal statement that the app does not derive your position from these scans.

Location — only on Android 12 and older

On those versions Android itself refuses to let an app scan for nearby devices without it. The app never reads your location, and the permission is capped so that phones on Android 13 and newer are never even asked for it. Before Android asks, the app explains this in its own words.

Biometric

For the optional app lock: Android asks for your fingerprint, face or screen lock, and tells the app only yes or no.

Vibration

The short buzz when the host takes your vote.

Billing

To offer the one-time Pro upgrade through Google Play. See below.

Internet

Not requested. The app has no ability to use a network.

Purchases

Roundtable Pro is a single one-time purchase, handled entirely by Google Play. The app never sees or stores your payment details, and it asks the Play Store app on your phone — not a server of ours — whether this phone owns the upgrade. Whatever Google collects in order to take a payment is covered by Google's privacy policy; what reaches us is Play Console sales reporting, not identified individuals.

Children

Roundtable is meant for people aged 13 and over. It is not directed to children and is not designed for or marketed to them. We do not knowingly collect data from anyone, of any age, because we do not collect data.

Your rights

Under the GDPR and similar laws you have rights of access, correction, erasure, restriction, objection and portability over personal data a company holds about you. The app sends us none, so there is nothing for us to produce or erase — the data described above lives on your own phone and under your own control. The only exception is an email you send us yourself, such as a report; to see it or have it erased, write to the same address. If you believe otherwise, or want to ask about any of this, write to [email protected] and we will answer.

Our website privacy policy covers naska-it.com itself, which is a separate matter from the app.

Changes

If this policy changes, the updated version appears at this address with a new date above. A change that meant the app started collecting something would require a new app release and a new permission, both of which are visible on the Play listing before you install them.