Privacy Policy

§1 Quick summary

Before the legal detail, the short version: IDection Files has no servers of its own and no user account. It manages files on your phone and on servers or services that you set up and choose yourself. These are the only places outside your phone the app ever sends anything to, and why:

We add no analytics, advertising or tracking of any kind, and we sell data to no one. Everything else — your connectors, your trash, the audit log, your favorites, thumbnails and settings — lives only on your phone.

§2 Data controller

IDection Files is developed and published by Sergio Augusto Carvallo Crisóstomo, as an individual — there is no company behind it. For any question about this policy or your data, write to skrvaxdev@gmail.com.

§3 Data the app handles and why

Credentials for your connectors

When you add an SMB, WebDAV, FTP/FTPS, SFTP, S3 or local connector, the app stores its alias, host, port, folder (for S3, the address and the bucket), and the username and password you enter (for S3, the access key ID and the secret key). Passwords are stored encrypted in the operating system's secure storage (Android Keystore), only on your phone. They are used solely to connect to THAT server when you use it — they are never sent to us or to any third party.

Password managers

The windows where you create, unlock or change the password of an encrypted folder are standard Android forms. If you use a password manager on your phone (for example Samsung Pass, Google Password Manager or Bitwarden), Android lets it suggest, fill in and save that password, using the folder's name as the username. That happens between Android and the manager you chose, under its own privacy policy; IDection Files does not send it anywhere. The recovery key is never offered to the manager.

Google Drive backups

If you add Google Drive as a backup destination, Android asks you to choose a Google account and to allow access with the drive.file permission, which only lets the app see the files it creates itself — not the rest of your Drive. The address of the account you chose is kept on the phone to label that destination; the access Google grants is temporary and is renewed when needed.

What travels to Drive is already encrypted on your phone before it leaves: the content of each file, its name, and the folder's index are encrypted separately, so neither Google nor we can read them. Drive only sees opaque parts with random names and their sizes.

Dropbox backups

If you add Dropbox as a backup destination, Dropbox asks you to sign in and to allow access to a single folder of its own (Apps › IDection Files): the app cannot see or change anything else in your Dropbox. The address of the account you chose is kept on the phone to label that destination, and the long-lived access Dropbox grants is stored encrypted in the operating system's secure storage (Android Keystore), so scheduled backups can run without asking you again. It is used only to talk to Dropbox and is never sent to us.

As with Google Drive, what travels to Dropbox is already encrypted on your phone: Dropbox only sees opaque parts with random names and their sizes.

pCloud backups

If you add pCloud as a backup destination, you sign in on pCloud's own page, opened in your browser — including two-step verification if you use it — so the app never sees your password. The app is registered with pCloud with access to a single folder of its own (Applications › IDection Files): it cannot see or change anything else in your pCloud. The address of the account is kept on the phone to label that destination, and the access pCloud grants is stored encrypted in Android Keystore, so scheduled backups can run without asking you again. It is used only to talk to pCloud and is never sent to us.

As with Google Drive and Dropbox, what travels to pCloud is already encrypted on your phone: pCloud only sees opaque parts with random names and their sizes.

Encrypted folders

Your folder password is never stored, neither on the phone nor anywhere else: the encryption key is derived from it on the device. You can choose to open a folder with your fingerprint or face, in which case the key is protected by Android's own biometric system on the phone. When you create a folder the app shows you a recovery key once; it is up to you to keep it safe — we do not have a copy.

Optionally, you can save a copy of the folder's key in your Google account (Google Block Store). That copy is end-to-end encrypted with your phone's screen lock (PIN, pattern or password): neither Google nor we can read it. It only serves to open the folder if you reinstall the app or move to a new phone restored from your Google backup. The files themselves are not saved by this — only the key.

File servers on your network

In the Services tab you can share one folder of the phone over WebDAV, FTP/FTPS or SFTP. Servers are off by default, use a password generated by the app, listen only on your Wi-Fi network, and turn themselves off when the Wi-Fi changes or after the idle time you choose. While a server is on, anyone on that network who knows its username and password can browse and transfer the files of that folder, with the permissions you chose (for example, read only). For FTPS, the app creates its own certificate on the phone; for SFTP, its own server key. Neither ever leaves the phone.

Trash and audit log

Files you delete go to a visible trash, and the app keeps an audit log of the operations it performs (for example: which file was copied, moved, renamed or deleted, from where to where, and when). Both are kept in the IDection Files folder of your phone's storage so that you can see them — they are never transmitted.

Thumbnails, previews and the text editor

Thumbnails of images and videos are generated on the phone and cached there. The text editor opens and saves files where they are. Nothing about the content of your files is sent anywhere else.

What we do NOT do

• We add no analytics, advertising or tracking SDKs, and the app has no server of its own.
• We do not access your location, your contacts, or your messages.
• We do not read, index or upload the content of your files to any server of ours or of a third party. Files only go where you send them.
• We do not sell data to anyone, under any circumstances.

§4 Who data is shared with

Only with these destinations, and only when you use that specific feature:

• Your own servers, devices and storage services (SMB, WebDAV, FTP/FTPS, SFTP, S3 and DLNA): the credentials and files involved in what you do with that connector. The storage services tested with the app are Backblaze B2, Cloudflare R2, IDrive e2 and Wasabi (through S3) and Koofr (through WebDAV); any other compatible service works the same way. A storage service you choose handles your data under its own privacy policy, and backups reach it already encrypted on your phone.
• Google, when you use Google Drive as a backup destination (encrypted parts and the authorization of your account) or save a folder key in Google (end-to-end encrypted). These are handled under Google's Privacy Policy.
• Dropbox, when you use Dropbox as a backup destination (encrypted parts and the authorization of your account). These are handled under Dropbox's Privacy Policy.
• pCloud (pCloud AG), when you use pCloud as a backup destination (encrypted parts and the authorization of your account). These are handled under pCloud's Privacy Policy.
• Google Play (Google LLC), which processes the purchase of the Plus add-on through Google Play Billing. We only receive confirmation that the purchase exists, never your payment method or banking details.
• Devices on your Wi-Fi that sign in to a server you turned on.
• Your password manager, if you use one: the name and password of an encrypted folder, through Android's autofill.

We never receive any of this data.

§5 Android permissions and why we request them

§6 Security

Connector passwords are stored encrypted using flutter_secure_storage, backed by Android Keystore. Encrypted folders and backups use the open age format, with keys derived from your password with scrypt; file contents and file names are encrypted on the phone before they are written anywhere. Your Dropbox and pCloud sign-ins are also kept encrypted in Android Keystore. Connections to Google Drive, Dropbox and pCloud use HTTPS, and FTPS and WebDAV over HTTPS are available for your own servers.

§7 Retention and how to delete your data

Since there is no account and no server of our own, your data lives on your phone and in the places you chose. You can delete it yourself at any time, without having to contact us:

• A single connector: delete it from the Connectors section.
• The trash and the audit log: empty the trash from the app, or delete the IDection Files folder from your phone's storage.
• Google Drive access: remove IDection Files from the third-party access of your Google account (myaccount.google.com/connections). Backups already in your Drive stay there until you delete them.
• Dropbox access: remove IDection Files from the connected apps of your Dropbox account (dropbox.com/account/connected_apps). Backups already in your Dropbox stay in Apps › IDection Files until you delete them.
• pCloud access: remove IDection Files from the apps connected to your pCloud account, in your pCloud account settings. Backups already in your pCloud stay in Applications › IDection Files until you delete them.
• Key copies saved in Google: delete them from the encrypted folder's options in the app.
• Everything at once: uninstalling the app deletes its settings and saved credentials. Your encrypted folders, backups and the visible IDection Files folder stay where they are, because they are your files — delete them there if you no longer want them.

§8 Purchases: the Plus add-on

IDection Files works without ads in its free mode: your files on the phone and on your network (SMB, WebDAV, FTP/FTPS, SFTP and DLNA), the trash, protected files, the audit log, encrypted folders, backups to your own network made by hand, opening any backup on your network, and high-speed copy from another IDection Files that has its server turned on.

The Plus add-on is a single purchase — it is not a subscription and it is never charged on a recurring basis. It unlocks: the cloud (backups to Google Drive, Dropbox and pCloud, and S3-compatible storage), turning on the WebDAV, FTP and SFTP servers of the Services tab (including high-speed copy over a hotspot, on the device that offers it), and scheduled backups. Without Plus nothing you created is deleted: scheduled backups are paused and servers simply stay off.

It is processed entirely through Google Play Billing; you can restore your purchase on any device where you sign in with the same Google account, using the "Restore purchase" button on the Plus screen. If you have a Plus promo code, you redeem it in Google Play like any promo code. To know that Plus was bought, the app only asks Google Play on your phone, and remembers the answer on the phone so scheduled backups can run while the app is closed.

§9 Children

IDection Files is not directed at children under 13 and does not knowingly collect data from children. As explained in §3, the app has no server of its own, so we keep no copy of anything we could delete; uninstalling the app deletes its credentials and settings from that phone. If you wrote to us directly, we can delete that communication on request: skrvaxdev@gmail.com.

§10 Changes to this policy

If we change what data the app handles or where it goes, we will update this same page and the date in the header. Important changes (for example, a new destination for your data) will also be announced inside the app.

• Version 1.6 (October 22, 2026): pCloud is added as an optional backup destination, with access limited to the app's own folder and your backups encrypted on your phone, as with Google Drive and Dropbox. The app now offers the Plus add-on, a single purchase processed by Google Play Billing (see §8); we never receive your payment details. Nothing else changes in what data is handled or where it goes.
• Version 1.5 (October 4, 2026): the storage services tested with the app are named, in alphabetical order: Backblaze B2, Cloudflare R2, Dropbox, Google Drive, IDrive e2, Koofr and Wasabi. Nothing changes in what data is handled or where it goes.
• Version 1.4 (October 4, 2026): SFTP is listed as a connector, as a backup destination and as a file server of the Services tab (with its own server key on the phone). Password managers are mentioned: Android can let the one you use fill in and save the password of an encrypted folder. On Android 10 and earlier the app uses the classic storage permission (WRITE_EXTERNAL_STORAGE). Nothing else changes in what data is handled or where it goes.
• Version 1.3 (October 3, 2026): S3-compatible storage (for example Backblaze B2, Wasabi or your own NAS) is added as a connector and as a backup destination. Its keys are stored like any other connector password, and backups are encrypted on your phone before they are sent.
• Version 1.2 (October 3, 2026): Dropbox is added as an optional backup destination, with access limited to the app's own folder. As with Google Drive, backups are encrypted on your phone before they are sent.
• Version 1.1 (October 2, 2026): the app no longer requests access to your audio files (READ_MEDIA_AUDIO): local connectors use "All files access", like the rest of the app. Nothing changes in what data is handled or shared.
• Version 1.0 (October 2, 2026): first published version.

§11 Contact

For questions, data access or deletion requests, or any concern about this policy: skrvaxdev@gmail.com.