Shelfsprig Privacy Policy

Shelfsprig Privacy and Data Handling

Implementation disclosure updated: 2026-10-20 App: Shelfsprig (com.servenzo.shelfsprig) Publisher/developer: Servenzo Privacy contact: [email protected] Public policy address: https://servenzo.com/apps/shelfsprig/privacy-policy

This disclosure describes the local Shelfsprig R1 source and the separate optional previous-demo platform controls. Native security, media, backup and resource behavior still require installed-device qualification; these prepared policy sources have not been published by this phase. Cloud availability depends on the publisher’s configured deployment. A build without a backend URL works locally. No sign-in or upload is performed automatically.

Local information and use

New shelf copies use authenticated encryption with independent random item keys. Titles, notes, sanitized filenames and declared/detected type metadata are encrypted. The local public index still exposes opaque identity, revision, creation/cutoff times, custody, byte counts and lifecycle state. Native ciphertext uses app-private files and transactional manifests; browser ciphertext uses bounded IndexedDB chunks. Intake counts actual streamed bytes in 64 KiB chunks rather than trusting a reported file size. The current limits are 16 MiB per item, 256 KiB note text, 1,000 items and a 64 MiB encrypted-content budget; provider envelopes, indexes, journals and filesystem overhead are additional.

Android wrapping keys use Android Keystore. Hardware protection is described only from the device capability response; no hardware-backed or biometric-bound guarantee is inferred from this implementation. Optional device credential lock is an application access gate. Other supported platforms use a passphrase-protected random master-key envelope. The passphrase is entered locally and is not sent to Servenzo. Lost devices, passphrases or invalidated keys may make local-only content unrecoverable. No automatic replacement key or empty-shelf reset repairs missing keys.

Content is masked and access leases end on focus loss. The selected background interval controls retention of an unlocked key session; it does not keep previews visible. Controlled transient previews are invalidated on lock, expiry and deletion. The app does not promise zeroization of every historical RAM allocation or protection from a compromised process. Editable unsaved drafts may remain in process memory while hidden, until discarded or the process closes.

The old temp_vault_app preference snapshot remains unencrypted until you review migration, all available bytes are encrypted and verified, and you separately confirm removal of the old snapshot. Expired and malformed entries are counted without revival. A local migration verification hash/marker can remain after snapshot removal and can reveal equality or permit guessing of the old snapshot. It is not uploaded or used as telemetry. Original files, provider copies and old storage journals/backups remain outside that removal claim.

Only selected document streams are requested. Android SAF intake does not make a plaintext app-cache file. Other document providers and libraries can manage independent source/cache copies. Arbitrary types remain opaque stored bytes; no executable or archive is run. Previews allow bounded PNG/JPEG, a strict simple-PDF subset and short PCM WAV. The native preview limits include 8 MiB encoded bytes, 8 megapixels, 1,024-pixel raster edge, simple PDFs up to 256 KiB/50 pages, and PCM16 WAV up to 30 seconds; unsupported previews remain exportable while access is valid. Platform decoders and device resources still require qualification.

Local search decrypts only authorized metadata and sends no filename or note query to a server. No plaintext OS-wide content index is enabled. Optional content-free local diagnostics are off by default, bounded to 128 events/seven days, and have no uploader. They exclude notes, filenames, source URIs, content hashes, share secrets and recipient addresses.

Optional account and snapshot sync

You may use the local demo without creating an account. If you choose sign-in, the configured identity provider processes authentication in your browser. The backend verifies a provider subject and app-specific access token, and stores a separate app account and workspace. Native session tokens use platform secure storage; the web session token is kept in memory. Connection drafts and revision metadata may be stored locally to preserve retries, without saving the access token in ordinary preferences.

Snapshot data eligible for your explicit upload: only the previous demo expirySeconds preset. R1 notes, titles, filenames, bytes, keys, manifests, settings, receipts and migration/recovery material never enter that compatibility snapshot. A file deliberately uploaded through separate generic cloud file controls is a separate server-readable object, not encrypted Shelfsprig custody.

You choose whether to upload the allowed local fields or replace them from cloud state. A conflict requires an explicit choice rather than silently overwriting newer work. Shared infrastructure does not give one app’s account access to another app’s private workspace. Operational requests necessarily reach the configured server/provider and can expose network information such as IP address and request timing to that infrastructure.

Other optional platform controls

Cloud file controls transfer only files you deliberately select, together with bounded filename/type/size, checksum and expiry metadata. These server-readable files are not end-to-end encrypted vault storage. Expiry and deletion block future authorized access before eventual physical cleanup; previously downloaded copies cannot be recalled.

Notification controls store the schedule, message and inbox record you submit. If push delivery is configured and you register a device, the service stores its app-scoped push token and sends the message through the configured push provider. Provider acceptance does not establish that the device displayed it. In-app inbox delivery and local phone reminder scheduling have different behavior.

Google Play billing controls, where configured, send the selected product and purchase token for server verification and store verification/entitlement status. Payment details are handled by Google Play rather than entered into this app. No paid entitlement is granted just because a device claims a purchase. Development adapters are identified as development features; they do not establish a paid purchase.

The app does not include advertising or product analytics in this implementation. Future ads, child profiles, additional SDK collection or other new processing need separate disclosure and review before being enabled.

Storage, retention and deletion

New R1 shelf content is encrypted as described above; the legacy demo snapshot and necessary public metadata have different boundaries. There is no R1 portable backup/restore or encrypted-cloud custody feature. Opaque recovery exports preserve source and ciphertext for support; they do not transfer device keys, provide a recovery promise, or create an independent revocation authority. Unknown/malformed recovery records may contain private data and must be kept private. Android automatic app backup is disabled to avoid restoring encrypted authentication tokens on another device; this also excludes other app-private data from that automatic backup mechanism. Device manufacturers or separately selected document providers can operate independent services.

Absolute UTC cutoff, key availability, lock, revision and recorded clock state govern every new preview/copy/search/export authorization. Duration and IANA exact-time choices show the resolved cutoff before confirmation; DST ambiguity requires a selected occurrence. Language or travel never extends a committed deadline. Observed clock rollback fails closed under a local high-water policy. This is not tamper-proof time across device control, reinstall or old backup restoration.

Access ends independently of cleanup scheduling, including when the app or phone was off. App-managed cleanup reports ended access, active key-reference removal and ciphertext-byte removal separately. Cleanup failure stays pending/failed without restoring access. Key-reference removal is not forensic erasure of append logs, historical envelopes, flash blocks or backups. The user confirms irreversible shelf-copy scope; originals, exported files, clipboard history and recipient copies remain independently controlled.

Copying a note is explicit. Android requests sensitive clipboard treatment where supported; OS/keyboard history can retain copies. An optional 30-second reminder asks the user to clear through system controls. The app does not implement custom automatic clipboard clearing because a read-then-clear task cannot atomically protect a newer unrelated clipboard. The reminder never overwrites clipboard content.

Exported plaintext files are independent copies and may outlive the shelf. Access is rechecked during delivery. Destination cancellation/failure does not delete the shelf or claim success; a failed provider can retain a partial outside copy. Web fallback exports have a smaller bounded-memory limit. Ordinary OS backup, older independent backups and document-provider retention must be evaluated separately; an older backup may miss later tombstones and retain decryptable copies. No cloud no-revival guarantee is made without independent revocation authority.

You can remove app-local data with Android Settings > Apps > Shelfsprig > Storage > Clear storage (labels vary). Clearing local data or uninstalling can also lose local keys and does not delete optional cloud accounts, cancel purchases, or erase exported/recipient copies.

Cloud account export/deletion are separate account controls and require recent sign-in. Account deletion applies to this app’s account and workspace, rather than silently deleting all Servenzo app accounts. It ends access and initiates scoped cleanup; a queued or partially completed cleanup is not a claim of immediate forensic erasure. Identity-provider accounts, Google Play purchase records, mandatory provider retention and independent external copies have separate controls. See the operator and hosting section of this policy for the current deployment and retention settings.

Device access

The app does not request camera, microphone, contacts or location access. INTERNET allows an explicitly configured HTTPS service connection. Native browser sign-in returns through this app’s unique callback scheme. Files are selected individually through the system document picker, rather than broad media-library access. Copy/export actions place copies in the clipboard or a destination you choose.

Children and audience

The publisher intends this app for users aged 13 and older. The app does not ask for a date of birth or build an account-based age profile.

Contact

Contact [email protected] for privacy questions. Do not include private files, child information, habit details or financial records in an initial support message. Sending support email uses your chosen email provider and is separate from this app’s feature data. No support message is sent automatically.

Operator, hosting and internal testing

Servenzo operates this app and its optional cloud service. Contact [email protected] for privacy questions or requests. The app service is hosted on a Servenzo-operated VPS in the United Kingdom at https://apps-api.servenzo.com. The shared sign-in service is operated there using Keycloak; app accounts and access tokens remain scoped to their own app. Quizlilt child cloud accounts remain disabled.

Cloudflare provides DNS and the traffic proxy for the public website and API. It processes network addresses, request timing and security information through its global infrastructure. Choosing an online service sends the selected information over the network; core local features do not upload your records automatically. Google Play separately handles app distribution, tester accounts and any authorized store purchases.

Account and synchronized information is retained while you keep the app cloud account, subject to the app's export and deletion controls. Requesting account deletion blocks app access and queues scoped cleanup. The shared identity-provider profile has separate controls; contact [email protected] to request its removal, with identity verification where needed. Files expire at the time you select; expiry blocks access before background cleanup removes stored versions. Independent exports and copies are outside that cleanup.

API access logs contain network address, request path without query parameters, status and timing. They rotate daily with fourteen retained rotations; service diagnostic logs rotate by size. The internal-testing service has no automated off-server backup or guaranteed recovery. Keep independent copies of information you need. Optional cloud files use private encrypted storage that the server operator can read. This test deployment uses a locally held encryption key and is not end-to-end encrypted; a maintained key-management service is required before public cloud use.

Current local R2 increment — 20 October 2026

The local custody increment adds encrypted retention preferences and purpose/checklist state, prospective per-item retention revisions/dry runs, finite-deadline inbox/review choices, capped task pins and confirmed event-shortening records. Existing item cutoffs remain authoritative; preset changes never silently extend old copies, expired content is not revived, and an ignored event/review cannot extend a fixed maximum. Explicit multi-source intake stages encrypted selected copies and commits the reviewed valid set atomically; unreadable sources can be skipped only after review. Original provider files remain independent. Native share intake is bounded and an advisory generic expiry reminder asks notification permission only from Enable. Its content contains no filename, note, source URI or secret; notification denial/delay never changes access enforcement. Physical-device, decoder, key and share/notification qualification remain open.

The new feature state remains app-scoped and local. Explicit JSON/file/clipboard exports are independent private copies; recovery can contain active or captured unacknowledged inputs. Deleting local feature data does not erase exports, OS/provider originals, separate app accounts or another product. Provider, installed-device, signed-release and store/public-policy qualification are not inferred from local tests.