DocCipher · mobile application
Privacy policy
DocCipher keeps your documents in an encrypted vault on your device. There is no DocCipher account and no BB16 Studio document server.
Data controller
The data controller is BB16 Studio, publisher of DocCipher. For any question or request concerning your data, write to bb16studio@gmail.com. This policy covers the Android version of DocCipher announced for Google Play. The application is not yet available there.
Documents and local encryption
Imported documents, their previews, text recognised by OCR, folders, tags and vault data remain in the application's private space. The vault is encrypted on the device. BB16 Studio receives neither your documents, their content, your password nor your recovery material.
Optical character recognition (OCR) runs on the device, using models embedded in the application: no image or text is sent to a server for this purpose.
Local reminders and data outside the vault
If you enable reminders, DocCipher keeps a limited schedule of days, counters, the chosen time and generic text in the application's private space, outside the encrypted vault. This schedule allows local reminders even when the vault is locked. It contains no document title, name, number or category. The notification uses a generic title on the lock screen. This data is not sent through a push-notification service.
No document server or synchronisation
BB16 Studio operates no server that hosts, analyses, synchronises or backs up your documents. WebDAV or Nextcloud synchronisation is not available in this version, nor is any other online storage. Your documents leave the device only through an export that you initiate yourself.
Exports and backups you choose
A document or .dcvault backup leaves the application only when you explicitly initiate an export and choose its destination with the system picker or share sheet. A .dcvault backup remains encrypted; a document exported in clear text is no longer encrypted and is then subject to the security of the chosen destination.
The recovery kit (your recovery phrase and its QR code) leaves the application only if you print it, save it as a PDF in the location of your choice, or copy the phrase. It is then subject to the printer, destination or clipboard you chose.
Android automatic backup and automatic transfer to a new device are disabled.
The Android purchasing SDK may ask Google Block Store to back up the pseudonymous identifier associated with purchases, to make restoring them easier. This channel is separate from the application file backup disabled above; it does not carry your documents.
Biometric unlock
If you enable it, biometric unlocking uses the Android system prompt. DocCipher receives only its response, whether identity was confirmed or not: it accesses no fingerprint, facial image or biometric template, which remain in the device's secure area. Biometrics do not replace your PIN, which remains required.
Panic code and decoy vault planned for launch
These two optional features are planned as part of the lifetime Premium entitlement, at no extra cost. Their local implementation is being validated; their public availability remains conditional on the required security reviews and on-device tests.
The panic code is enabled voluntarily after authentication with the master password, using a separate PIN entered twice, two consent steps and confirmation of the irreversible action. You choose selected vaults or all vaults. Only exact entry of the armed panic PIN then triggers, without a new dialogue, logical deletion of the files, local keys, caches and thumbnails of the selected vaults. It does not guarantee physical erasure of the storage. Exported backups, cloud copies and other external backups are not deleted.
The decoy vault is a separate local vault, with its own PIN, keys and content. When it is open, only its content is displayed. This protection against casual observation is documented publicly; it guarantees neither that an observer is unaware of its existence nor that device analysis cannot distinguish it.
Optional purchases
DocCipher's exchanges with RevenueCat are used to display offers, make purchases, restore a purchase and verify Premium access associated with these optional actions. You can use DocCipher without buying anything. Payment is processed by Google Play. Purchase and Premium-access verification is entrusted to RevenueCat, a provider acting on behalf of and under the instructions of BB16 Studio (a processor within the meaning of the GDPR). Once the SDK has been configured, the application may ask it for the state of your Premium access again when it returns to the foreground. No document, vault, PIN, password or key travels through this channel.
Opening the offers, making a purchase, restoring one, or having a known Premium entitlement also leaves a local marker of Premium interest. On subsequent startups, this marker may trigger SDK configuration and a new access check, even without opening the offers. An unreadable marker is treated as present to allow the entitlement to be recovered. This initialisation may begin at the process's first unlock; it guarantees neither a request at every launch nor a network response.
In each of these exchanges, RevenueCat receives:
- a random user identifier, created by the RevenueCat SDK the first time the application contacts it;
- technical information attached to each request: the platform and Android version, the device model and brand, the device language or languages, the country of your Google Play account, the application identifier, and the versions of the application and SDK;
- the IP address of your connection, which every contacted server receives and from which an approximate country can be inferred.
During a purchase or restoration, RevenueCat also receives the Google Play purchase token (receipt), the product purchased, its price and currency, and the transaction dates. It uses them to determine the status of your Premium access (active or expired).
This identifier contains neither your name nor your email address, but it is not anonymous: it is associated with your Google Play purchases, which are themselves linked to your Google account, and restoring a purchase may link it to the identifiers of your other installations. It is pseudonymous data. No account is created, automatic collection of device identifiers (advertising identifier, Android identifier) is disabled, and SDK diagnostics are disabled.
As with any purchase on the Play Store, Google Play receives your Google account, the product and your payment information. Google processes this data as a separate controller, under its own privacy policy. In its console, Google Play provides BB16 Studio with the order information needed to manage sales, including the order number, product, price and country of purchase. BB16 Studio never sees your bank details.
Purpose and legal basis
Exchanges with RevenueCat are used to manage your purchases and Premium entitlements:
- verifying your Premium access whenever the application contacts RevenueCat, including if you have bought nothing: this processing is necessary for the performance of the contract governing use of the application (Article 6(1)(b) GDPR);
- processing a purchase or restoration: this processing is necessary for the performance of the purchase contract (Article 6(1)(b) GDPR).
Purchase data is also used for sales and subscription statistics in RevenueCat. It is not used for advertising, advertising profiling or advertising tracking. If you write to us, your message and email address are used to reply to you, based on our legitimate interest in doing so, or on our legal obligations when you exercise your rights.
Transfer outside the European Union
RevenueCat, Inc. is established in the United States, where the purchase data described above is processed. This transfer is governed by the European Commission's Standard Contractual Clauses, incorporated into RevenueCat's data processing agreement. You can request a copy from bb16studio@gmail.com.
Retention period
Purchase data is retained by RevenueCat for as long as it is used to manage and restore your purchase, and deleted if you request this (see ‘Deletion and your rights’). If you have never made a purchase but the application has contacted RevenueCat, RevenueCat retains on behalf of BB16 Studio a pseudonymous record limited to the identifier and technical information described above for as long as it is used for this contact, and deletes it on request (see ‘Deletion and your rights’). Google Play retains its own order data under its policy. Your documents remain on your device until they are deleted in the application. Erasure by panic code logically deletes the selected vaults and their local data; external backups remain at their destination until you delete them there.
What DocCipher does not do
- No DocCipher user account and no email address requested.
- No advertising, advertising identifier or sale of data.
- RevenueCat processes the purchase data described above, including for sales statistics. No SDK for tracking document usage or reporting crashes is added; diagnostic components from the ML Kit libraries are removed.
- No tracking from one application to another or from one website to another.
Android crash reports
If you have agreed in your device settings to share usage and diagnostic data with Google, Android may send crash and performance reports to Google. Google Play makes them available to BB16 Studio in its console (Android Vitals), as aggregated statistics and technical reports: device model, Android version and error trace. This mechanism belongs to the system, not DocCipher. These reports contain neither your documents, your name nor your email address, and you can disable them in the device settings.
Reviews in Google Play
DocCipher may call the official Google Play In-App Review API after a document has been successfully protected or a backup has succeeded. The request is never made at startup, during processing, after a failure, or from the panic-code or decoy-vault screens. A local delay of at least 90 days separates two requests. Google Play decides whether the interface is displayed; DocCipher receives neither the rating, the comment nor the score, and does not know whether the card was displayed. No document, vault, PIN or entered text travels through this channel.
Android permissions
The manifest of the Android build prepared for Google Play declares exactly seven entries:
android.permission.INTERNET— purchases, and nothing else;com.android.vending.BILLING— Google Play billing;android.permission.USE_BIOMETRIC— display the system biometric prompt; it grants access to no biometric data;android.permission.USE_FINGERPRINT, limited to Android 9 and earlier versions — the same role on those versions;android.permission.RECEIVE_BOOT_COMPLETED— reschedule local reminders after a restart;android.permission.POST_NOTIFICATIONS— display local reminders, with system permission when required;- an internal signature permission for the application, which grants no device capability.
No camera, location, contacts, microphone or broad storage permission is requested: files use the system pickers.
Deletion and your rights
You can delete your documents in the application. If you voluntarily armed the Premium panic option, its separate PIN can logically erase the local vaults you selected, or all local vaults. This action is irreversible in the application, but it does not guarantee physical erasure and deletes no external backup. You can also erase all DocCipher local data in the Android settings or uninstall the application. An exported copy remains in the chosen location until you delete it there. BB16 Studio cannot remotely extract, decrypt or restore your vault.
For data that RevenueCat processes on behalf of BB16 Studio, you may request access, rectification, erasure, restriction or portability, and object to processing when it is based on our legitimate interest. Write to bb16studio@gmail.com. If you made a purchase, provide your Google Play order number: it begins with ‘GPA.’ and appears in the receipt email sent by Google Play. If you never made a purchase but the application contacted RevenueCat, provide the approximate date and your device model: since the application asks for no identity, these details and RevenueCat's own identifier are sufficient to find your record, without an order number. Never attach a document, password, key or recovery phrase. The GDPR gives us one month to answer you.
Deleting this data does not cancel your purchase: Google Play retains it, and a later restoration finds it again by sending the data described above to RevenueCat once more. A subscription is managed and cancelled in Google Play.
If you believe your rights have not been respected, you may lodge a complaint with a data protection authority, in France the CNIL.
Changes
This page will be updated if the application's data flows, third-party services or permissions change.