Privacy Policy

App: DocTrack (Android, package com.mdtayoburrahman.doctrack)
Effective date: 16 October 2026 · Version: 1.1

This Privacy Policy explains how the DocTrack mobile application ("DocTrack" or "the app") handles information. DocTrack is developed and published by Md Tayobur Rahman, an individual developer based in Bangladesh ("the developer", "we", "us", "our"). By installing or using the app you acknowledge that you have read this policy.

Summary

1. Scope and roles

This policy applies to the DocTrack Android app only. It does not apply to Google's services or any website or service you open from the app; those have their own policies.

• Your content (documents, owners and images) stays on your device and, if you choose, in your own Google Drive. We cannot access it, so we do not act as a controller or processor of that content. You decide what to store and you are responsible for it, including information about other people (see section 13).
• For the limited technical data described in sections 6 to 10, the developer is the controller. Google acts as our service provider (processor) for Firebase Crashlytics, Google Analytics for Firebase and Firebase Cloud Messaging, and as an independent controller for the advertising data it processes through Google AdMob (section 9). Google Play and Google Drive are provided by Google under your own agreement with Google.

2. Information stored on your device

The following is created by you and stored in the app's private storage on your device:

• Documents: type, number, issue date, expiry date, issuing authority, notes, reminder settings and archive/snooze status.
• Owners: names of people, companies or vehicles, and optional phone numbers or vehicle plate numbers.
• Images: photos or scans you attach. They are resized and saved only inside the app's storage.
• Settings: reminder schedule, theme, language and privacy choices.
• App lock: if you set a PIN, only a salted, one-way cryptographic hash is stored. Fingerprint or face unlock is handled entirely by Android; the app never receives biometric data.
• Backup settings: whether Google Drive is connected, the email address of the connected Google account (shown on the backup screen), and, if you set a backup password, an encryption key protected by the Android Keystore. Your backup password itself is never stored.
• In-app notification history: copies of reminders and messages shown in the Notifications screen (kept for up to 60 days).

This information never leaves your device unless you turn on Google Drive backup (section 4) or choose to export or share it (section 5). It is deleted when you uninstall the app or clear its storage.

3. Camera, photos and text recognition

• The camera is used only when you open Scan or Add photo. You can refuse the camera permission and still use the app.
• When you choose an existing image, Android's photo picker gives the app access only to the image you select. The app does not request access to your photo library.
• Text recognition uses Google ML Kit, which runs entirely on your device. The app does not send images or recognised text to us or to Google for recognition.

4. Google Drive backup (optional, Premium)

If you tap Connect Google Drive:

• You sign in through Google's own consent screen. The app requests only the scope https://www.googleapis.com/auth/drive.appdata, which allows it to read and write only the hidden application data folder created by DocTrack in your Google Drive. The app cannot see, open, change or delete any of your other Drive files, and other apps cannot see DocTrack's backups.
• To show which account is connected, the app reads the email address of that Google account and stores it on your device only.
• A backup contains your DocTrack database, attached images and a small technical manifest (format version, app version, number of documents and images, date). If you enable a backup password, the backup is encrypted on your device with AES-256-GCM using a key derived from your password (PBKDF2-HMAC-SHA256) before it is uploaded. If you forget the password, the backup cannot be restored by anyone, including us.
• Backups are transferred directly between your device and Google over an encrypted connection and are stored by Google under the Google Privacy Policy and your agreement with Google. The developer never receives, views or stores your backups and has no technical means to access them.
• The app keeps your 5 newest backups and deletes older DocTrack backups from the hidden folder.
• Disconnect at any time in Settings › Backup & restore › Disconnect Google Drive; this also asks Google to revoke the app's access. To delete the backups, open Google Drive on the web › Settings › Manage apps › DocTrack › Options › Delete hidden app data.

Google API Services – Limited Use

DocTrack's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data obtained through Google APIs is used only to provide the backup and restore feature you requested; it is not used for advertising, not sold, not transferred to third parties (except as necessary to provide the feature, to comply with law, or as part of a merger or acquisition with notice to you), and not read by humans unless you give explicit permission (for example, when you ask for support), it is necessary for security purposes, or it is required by law.

5. Export and sharing you start

If you use Export PDF, the app creates the PDF on your device and saves it to the location you choose. If you share a file or open a link, the receiving app or service handles it under its own terms. We do not receive exported files.

6. Reminders and push notifications

• Expiry reminders are calculated and shown by your device. No reminder data is sent to us.
• News and tips (optional): the app uses Firebase Cloud Messaging so we can occasionally send announcements. Firebase assigns your installation a random push token and a Firebase installation ID. The app subscribes the token to general topics (all users who allow news, and your plan type: Free or Premium) so messages are sent to groups, not to named individuals. Turn this off in Settings › Privacy › News and tips, or block notifications in Android settings.

7. Crash reports (Firebase Crashlytics)

To find and fix errors, the app sends crash and error reports to Firebase Crashlytics, a Google service. A report may include: device model and manufacturer, Android version, app version, available memory and storage, orientation, time of the crash, the technical stack trace, the names of the last screens used, a random installation identifier, and app settings that help diagnose problems (whether Premium or App lock is on, and the app language).

Crash reports never include your document numbers, names, dates, notes, images or backup contents. Turn crash reports off in Settings › Privacy › Send crash reports; unsent reports are then deleted from your device.

8. Usage statistics (Google Analytics for Firebase)

To understand which features are used and improve the app, the app sends usage statistics to Google Analytics for Firebase. These include: screens opened; events such as "document added", "document renewed", "scan completed", "backup succeeded", "paywall viewed", "purchase started" or "reminder sent", with non-identifying details (for example the document type such as "passport", the owner type, counts, and success or failure); device and app information; approximate location at country/region level derived by Google from the IP address; and a random app-instance identifier.

Usage statistics never include document numbers, names, dates, notes, images, backup contents or your Google account details.

The advertising features of Google Analytics are disabled: Analytics does not collect the Android Advertising ID, ad storage, ad user data and ad personalisation consent are set to "denied", and usage statistics are not used for advertising. Ads in the Free plan are described in section 9.

Usage statistics are on by default and you can turn them off at any time in Settings › Privacy › Share usage statistics. Turning them off stops collection and resets the analytics data stored for your installation.

9. Ads (Google AdMob, Free plan only)

The Free plan shows ads provided by Google AdMob: an ad card on the Home and Documents screens and, from time to time, a full-screen ad after you save or renew a document. Premium has no ads; ads disappear as soon as Premium is active.

• What the ad service receives: to show, measure and limit ads and to prevent fraud, the Google Mobile Ads SDK collects device and app information (such as device model, Android version, app version and language), approximate location derived from the IP address, ad interactions (views and taps), diagnostic data and the Android Advertising ID. The ad service never receives your documents, owners, numbers, dates, notes, images or backups; the app does not add any of your content to ad requests.
• Your choice: in the European Economic Area, the UK, Switzerland and other places where the law requires it, the app shows Google's consent form before any ad is requested, and you choose whether ads may be personalised. If you decline, Google may show non-personalised ads, which still use the device data above for frequency capping, measurement and fraud prevention. You can change your choice at any time in Settings › Privacy › Ad privacy choices.
• Advertising ID: you can reset or delete it, or opt out of personalised ads, in your Android settings (for example Settings › Google › Ads, or Settings › Privacy › Ads, depending on the device).
• Google processes this data as an independent controller under the Google Privacy Policy; see also How Google uses information from apps that use its services.

10. Purchases (Google Play)

Premium is sold through Google Play Billing. Google processes your payment under its own terms and privacy policy. The app receives only what is necessary to provide Premium: the product purchased, purchase status, purchase time and a purchase token. We never receive your name, card number or billing address from Google Play.

11. Permissions

The app does not request access to your contacts, location (GPS), microphone, call logs, SMS or files outside the app.

12. Legal bases (EEA, UK and similar laws)

Where data-protection laws such as the GDPR apply, we rely on: contract (to provide Premium and requested features such as backup); legitimate interests (to keep the app secure and stable through crash reports, to improve the app through anonymous usage statistics, which you can switch off at any time, and to fund the free version with non-personalised ads); and consent (for optional news notifications, Android permissions you grant and, where the law requires it, ads, collected through Google's consent form).

13. Information about other people

If you store information about other people (for example family members or employees), you are responsible for having the right to do so and for keeping it accurate. Because this information stays on your device and in your own Google Drive, we have no access to it.

14. Sharing and disclosure

We do not sell, rent or trade personal information. In the Free plan, Google AdMob may use device identifiers such as the Advertising ID to personalise ads where you allow it (section 9); under some US state laws this can count as "sharing" for targeted advertising, and you can opt out through Ad privacy choices, your Android ad settings, or by using Premium. Information leaves your device only:

• to Google, as our service provider (Firebase), as our ad provider in the Free plan (AdMob) or as the provider of services you use (Google Play, Google Drive), for the purposes in this policy;
• if required by law, court order or a valid request by public authorities, or to protect the rights, property or safety of the developer, our users or others;
• in connection with a sale, merger or transfer of the app, in which case this policy continues to apply to the information transferred, and you will be informed.

15. Retention and deletion

DocTrack has no user accounts, so there is no account to delete. You can stop and reset analytics collection yourself in Settings › Privacy, and uninstalling the app removes all data stored on your device. You may also email us (section 20) with the subject "Data deletion"; because crash and analytics data is not linked to your name or email, we may not be able to identify which records belong to you, but we will delete any data we can reasonably associate with your request.

16. Security

We protect information using Android's application sandbox, encrypted connections (HTTPS/TLS) for all network communication, optional PIN/biometric App lock (which also hides the app in the recent-apps screen), and optional AES-256 encryption of backups with keys protected by the Android Keystore. No method of storage or transmission is completely secure; you are responsible for protecting your device, its screen lock and your Google account. If we become aware of a security issue affecting information we process, we will take reasonable steps and notify you where required by law.

17. Children

DocTrack is intended for adults and is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided information through the app, contact us and we will delete what we can access.

18. International transfers

Google may process crash reports, usage statistics, push messages, ads, purchases and backups on servers in other countries, including the United States, under safeguards such as Standard Contractual Clauses. By using these features you understand that this processing takes place outside your country.

19. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or US state privacy laws such as the CCPA/CPRA), you may have the right to access, correct, delete, restrict or object to processing of your personal information, to data portability, to withdraw consent, to opt out of targeted advertising, and to complain to your local data-protection authority. Most of your data is under your direct control in the app. For other requests, contact us; we will respond within the time required by applicable law and will not discriminate against you for exercising your rights.

20. Contact

Md Tayobur Rahman
Email: [email protected]
Phone: +880 1717-932348
Website: www.mdtayoburrahman.com

21. Changes to this policy

We may update this policy to reflect changes in the app, the law or Google's policies. The updated version will be available in the app and on our website with a new effective date. If a change materially affects how your information is handled, we will notify you in the app before it takes effect and, where required by law, ask for your consent.