Privacy Policy

1. Data We Collect

Data created by you (stored locally)

When you use DriveVault, the following data is created and stored exclusively on your Android device:

• Video recordings — Camera footage saved as MP4 files on your device storage
• GPS and telemetry data — Latitude, longitude, speed, altitude, and compass heading recorded alongside each clip
• Clip metadata — Timestamps, duration, file size, camera mode, and lock status stored in a local Room database
• App settings — Your preferences for recording quality, storage limits, camera mode, and other options

Data created during bug reporting (optional, user-initiated)

If you choose to submit a bug report or feature request via the in-app support center (Settings → Support & Feedback), the following data is transmitted to the developer's GitHub repository tracker:

• Report details — A title and description written by you describing the issue or request
• Contact details — An optional name and email address so the developer can follow up with you
• Attachment — An optional image or screenshot from your device selected by you
• Device diagnostics — Basic system diagnostics (app version, Android OS version, device model, manufacturer, system locale, time zone, free/total storage, and free/total memory) to help identify and fix the issue. This is included by default but can be unchecked prior to submission

Data collected automatically (app health)

DriveVault uses Firebase to monitor app health and stability. This data is anonymized and cannot be linked to you personally:

Data	Purpose	Identifiable?
Crash reports	Fix bugs and improve stability	No
Performance metrics	Monitor app speed and responsiveness	No
Analytics events	Understand feature usage patterns	No
Firebase Cloud Messaging token	Receive push notifications (if enabled)	Device token only
Advertising ID & device info (Google AdMob)	Serve and measure banner/interstitial ads	Advertising ID

Firebase Analytics events are limited to privacy-safe interactions such as "recording started" or "clip exported." We do not log your location coordinates, speed, routes, or any video content to Firebase.

2. Data We Do NOT Collect

3. Third-Party Services

Firebase

DriveVault uses Google Firebase for:

• Crashlytics — Automatic crash reporting
• Analytics — Anonymized usage patterns
• Performance Monitoring — App responsiveness metrics
• Cloud Messaging — Push notification delivery
• Remote Config — Feature flag management

Firebase data is processed under Google's privacy policy: policies.google.com/privacy

Immich (optional, user-configured)

If you choose to enable Immich sync, DriveVault will upload clips to your own Immich server. Key points:

• This feature is off by default and requires manual setup
• You provide the server URL and API key — we do not host or operate any Immich servers
• Your API key is stored locally using Android EncryptedSharedPreferences
• Uploaded data goes directly from your device to your server — it never passes through our systems
• You can disable and disconnect Immich sync at any time in Settings

Immich's privacy practices are governed by your own server configuration. Learn more at immich.app.

Cloud Clip Sharing (Optional Feature)

DriveVault includes an optional anonymous clip sharing feature. When you use it:

• This feature is off by default and requires the "Allow Anonymous Clip Sharing" setting to be enabled in Settings → Clip Sharing.
• What is uploaded: the video file only — no GPS coordinates, speed, route data, or metadata are included in the uploaded file.
• Anonymous authentication: Uploads are authorized via an anonymous API client token (Supabase Anon Key) with Row-Level Security (RLS) policies enforced. No account creation, email address, name, or linkage to your personal identity is required.
• Storage path: clips are stored at a randomly generated UUID path (e.g., shared-clips/<uuid>/clip.mp4) in Supabase Storage. The UUID is cryptographically random and unguessable — it acts as the primary access control mechanism.
• Access: anyone who has the share link can view the clip. There is no password or login required for viewers.
• Retention: shared clips are automatically deleted after 24 hours. A background worker (ShareCleanupWorker) running in the app queries expired clips, deletes the files from Supabase Storage, and deletes the corresponding record from the database.
• Viewer page: the share link points to a page hosted on GitHub Pages at chartmann1590.github.io/DriveVault/view. This page uses the Supabase JavaScript client to query the clip's metadata and render the direct video link from Supabase Storage. No viewer data is logged or stored.
• You can disable this feature at any time in Settings → Clip Sharing → Allow Anonymous Clip Sharing.

Clip sharing data is processed under Supabase's privacy policy: supabase.com/privacy

GitHub Issues API (Optional Bug Reporting)

If you choose to submit a bug report or reply to comments in the support center (Settings → Support & Feedback):

• What is sent: Your report details (Title, Description), optional contact details (Name, Email), and optional screenshot file, plus device diagnostic details (if not opted-out).
• Public tracker: Submitted reports are opened directly as issues in the public GitHub issue tracker of the DriveVault repository. Do not include sensitive private data in your reports, as they will be publicly visible.
• File storage: Optional screenshots are uploaded directly to the repository assets directory using GitHub's contents API and will also be publicly viewable.
• Communication: The app queries the GitHub API to display comments from developers and allows you to submit replies directly from the app.

GitHub data processing is governed by GitHub's privacy statement: docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

Google AdMob (Advertising)

DriveVault is ad-supported. We use Google AdMob to show banner and interstitial ads on secondary screens (clip library, clip detail, settings). Key points:

• Ads never appear on the recording screen, in any state, and are never shown while a recording is actively in progress — even if you navigate to another screen while the foreground recording service keeps running.
• Data collected by AdMob: to serve and measure ads, Google AdMob may collect your advertising ID, IP address, device and app information, and general location (derived from IP), and may use this data (and data from other Google services) to personalize ads, subject to your device's ad settings.
• Your controls: you can opt out of personalized advertising and reset or delete your advertising ID at any time in your device's Settings → Privacy → Ads (or Google Settings → Ads on older Android versions).
• AdMob does not have access to your video recordings, GPS telemetry, or clip library contents — that data is never sent to Google or any ad network.

AdMob's data collection and use is governed by Google's privacy policy (policies.google.com/privacy) and How Google uses data when you use partner sites or apps (policies.google.com/technologies/partner-sites).

OpenStreetMap

The mini map overlay uses OpenStreetMap tile servers to render map images. When the map is visible, your device may request map tiles from OSM servers. These requests contain approximate viewport coordinates but no personally identifiable information. See OSM's privacy policy.

4. Permissions

DriveVault requests the following Android permissions. Each is required for core functionality:

Permission	Purpose	Data stored?
Camera	Record video of your drives	Locally as video files
Microphone	Record audio with video clips	Locally within video files
Location (Fine / Coarse)	GPS coordinates, speed, heading overlay	Locally per clip
Notifications	Show recording status and controls	Not stored
Read Media / Storage	Save exports to gallery, read clips	Local files only
Foreground Service	Keep recording running in background	Not stored
Wake Lock	Prevent recording interruption	Not stored
Internet	Optional Immich sync, map tiles, anonymous clip sharing	Only if sync or sharing enabled

5. Data Storage & Security

Local storage

• Video files are stored in the app's external files directory on your device
• Clip metadata is stored in an encrypted Room SQLite database
• Settings are stored using Android DataStore with encrypted preferences
• Immich API keys are stored using Android EncryptedSharedPreferences

Data retention

• Recordings are kept until you delete them or they are auto-deleted by loop recording
• Locked clips are never auto-deleted
• You can delete all app data at any time by clearing app data in Android Settings or uninstalling the app

Encryption

Sensitive data such as Immich API keys are encrypted at rest using the Android Keystore system. Video files are stored using standard file system permissions that restrict access to the DriveVault app.

6. Data Sharing

DriveVault will only share your data when you take an explicit action, with one exception for advertising:

• Share button — Uses Android's share sheet to send clips to apps you choose
• Export — Saves video, GPX, or JSON files to a location you select
• Immich sync — Uploads to your self-hosted Immich server (only when configured)
• Google AdMob — Automatically, to serve ads on non-recording screens (see Section 3). This is the only data sharing that is not user-initiated; you can limit it via your device's ad settings as described above.

We never share your video recordings, GPS telemetry, or clip library contents with anyone, and we never sell your data.

7. Children's Privacy

DriveVault is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has used the app and you have concerns, please uninstall the app to remove all local data.

8. Your Rights

Because DriveVault stores data locally on your device, you have full control:

• Access — All your data is visible within the app's clip library.
• Delete — Delete individual clips, or clear all app data via Android Settings.
• Export — Export any clip's video, metadata, or GPS data at any time.
• Opt out — Disable Firebase Analytics, or disable Immich sync and Anonymous Clip Sharing in Settings. For bug reports, you can opt out of diagnostics prior to submission.
• Bug Report Removal — Since submitted bug reports and comments are stored publicly on GitHub, you can request their removal or editing at any time by contacting the developer or commenting directly on the issue on GitHub.

9. International Users

DriveVault does not operate servers or transfer data internationally. All data remains on your device. If you use Immich sync, data transfer to your Immich server is governed by the location of your server and applicable laws.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected in the "Last updated" date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Contact