Privacy Policy

This policy describes how the Notifolio Android application handles information. Notifolio keeps its archive locally by default, with optional encrypted multi-device synchronisation.

Information Notifolio Handles

If you grant notification access, Android provides Notifolio with notifications delivered on your device. Depending on what each originating app publishes, these may include notification text, app and package names, timestamps, conversation details, channel information, lifecycle details, icons and images. Notifolio stores available captured content and related archive and capture-health metadata in its private app storage.

Notification access is optional. You can browse the app without enabling capture, and you can revoke access in Android settings. Android and the originating apps determine what content is available; capture is not guaranteed.

Where Information Is Stored and Sent

The archive is stored locally in the app's private database. There is no advertising or analytics. Sync is off by default and is not required for capture, search or exports.

If you enable server sync, the Estopia SDK authenticates your account and sends encrypted notification history, media and shared state to the Estopia service. You explicitly choose whether to include existing history; future-only publication is the default. Optional background sync offers intervals of 15 minutes, 1 hour, 3 hours, 6 hours (default), 12 hours or 24 hours, subject to Android scheduling. Sign-in alone does not upload your archive. The service processes account/device identifiers, names, public keys, approvals, encrypted operations, sizes and request timing. Notification content is encrypted by the SDK on your device; account decryption keys and recovery codes are not sent to the server in plaintext. Capture-device names are included in encrypted metadata to label device filters.

An optional app-only offline vault uses a separate local library and protected keys, without account sign-in or transmission to Estopia. You explicitly enrol devices and initiate authenticated encrypted LAN transfers on a local network. Pairing QRs identify the offline vault/device; a one-use transfer QR additionally contains a sensitive temporary session key. Encrypted approval files contain signed device membership and wrapped keys and are saved to a destination you select. Disconnected devices cannot learn membership removals immediately. Copying offline history into the main archive and publishing it to an account are separate explicit actions. Camera permission is optional and used for account/offline QR scanning, not notification capture.

Estopia encrypted apps share account-wide key trust. An approved app installation can derive the keys for other apps; per-app service scopes limit which data its sign-in can fetch but do not provide a cryptographic boundary. Browsers are not cryptographically read-only. Device approval, removal with key rotation and an account recovery code control access. Password reset does not recover encryption keys. Losing every trusted device and the recovery code may permanently lose access.

First-device setup displays a recovery code and requires confirmation that it was saved. A pending code is kept in protected local storage until confirmed, so setup can survive a restart; the stored presentation copy is removed after confirmation. An interrupted presentation without a stored code requires replacement. Protect the saved code because it can recover the account keyring. Joined installations do not need a duplicate code. Replacing the recovery code invalidates the previous one for every encrypted Estopia app.

Device pairing uses SDK QR payloads or an 8-letter code with a mandatory 6-digit safety-number comparison. Pairing QR codes carry public account/device identity and keys, not private keys or recovery codes; no external QR image service is used.

Notification permission is optional and used to display silent sync progress outside the app. Progress shows stages, activity counts, elapsed time and an estimated upload time, not archived notification content. These progress notifications are excluded from capture. Denying notification permission does not prevent sync.

Automatic Android cloud backup and device-to-device transfer of Notifolio app data are disabled. Android device encryption may protect device storage, but the database is not separately encrypted by Notifolio.

Exports and Recovery Backups

You may choose to export archive content as JSON, CSV or ZIP, or create a password-protected encrypted recovery backup. The Android document picker lets you choose the destination. Notifolio does not receive a copy. A destination you choose may be local, removable or provided by another service; that destination's provider handles its own storage and privacy practices.

Readable JSON, CSV and ZIP exports are not encrypted by Notifolio. Recovery backups are encrypted and require the password you set; Notifolio does not store or recover that password. Treat exports and passwords as sensitive.

Retention and Deletion

Normal deletion and retention remove visible archive content locally, not copies on other devices. With sync enabled, replication history, media and receipts are retained for convergence and explicit restoration; local expiry is not secure erasure of all cached sync data. An eviction ledger prevents automatic reappearance. Explicitly confirmed Delete everywhere creates a permanent encrypted deletion marker that suppresses the record on devices when they next sync, including after delayed transfers or backup restoration. It cannot erase independent exports, already decrypted copies or devices that never reconnect, and encrypted journal history may remain on the service.

Clearing app data or uninstalling removes the local and offline archives and protected sync keys, not the server archive or other devices' copies. Keep the account recovery code separately. It does not replace a password-protected archive backup or recover an app-only offline vault. Legacy recovery documents cannot enrol the replacement system.

Full encryption reset is a last resort requiring a confirmation phrase and recent sign-in. It permanently removes keys, device approvals and encrypted server items for every Estopia encrypted app, not only Notifolio. Local notifications and independent downloaded/exported copies are not erased remotely. Deleting an Estopia account also removes its encrypted server data.

Children

Notifolio is a general-purpose utility and is not designed specifically for children. Optional sync transmits the information described above only when enabled.

Changes to This Policy

This policy may be updated if the app's information practices change. The current version and its update date will be published at the policy URL provided in the app's Google Play listing.

Contact

For privacy questions, contact us at [email protected].