Privacy Policy
1. Who we are
This Privacy Policy explains how ZapBox ("we", "us") handles information in the Android app AI Phone Cleaner - ZapBox (the "App"). We are the data controller for the limited data described here.
Contact: zapboxinternational@gmail.com
2. Data processed only on your device
To provide its core features, the App asks for access to data on your phone. This data is read and processed locally on your device. It is not transmitted to us or to any third party, and we cannot see it.
| Data / permission | Why the App needs it |
|---|---|
| Photos and videos (media / storage permission) |
Find similar and duplicate photos, screenshots, blurry photos, memes saved by chat apps, screen recordings, short clips and large videos; delete the items you select or move them to your phone's trash; move the items you choose into Secret Space. To do this the App measures each photo on your device (how sharp it is, and a short code used to compare it with other photos) and reads the text on images from chat apps and downloads. These measurements never leave your phone. |
| Contacts | Find duplicate and incomplete contacts, merge or delete the ones you select, and create a contacts backup file that stays on your device. |
| Calendar and reminders | Find old events and reminders and delete the ones you select. |
| Biometrics (Face / Fingerprint) | Unlock Secret Space. Biometric checks are performed by Android. The App only receives a yes/no result and never has access to your biometric data. |
| Notifications (only if you allow them) |
Tell you when a scan has finished, if you ask for that or have left the App while it runs; show one "time to clean" reminder a week if you turn it on; and, if you turn that on too, tell you when many new screenshots or photos have appeared (the App then counts new items in the background about once a day). All of these are created on your phone; no push service is involved. |
Secret Space: your PIN is stored in Android's encrypted secure storage on your device. Photos and videos you hide are moved into the App's private storage on your device, which other apps and your gallery cannot read, and are removed from your gallery. They are not uploaded and are not included in device backups. We cannot recover a forgotten PIN, and uninstalling the App deletes the items still inside Secret Space.
Kept on your device only: contact backups, your cleaning history, your "Keep forever" list and the App's settings. The App is excluded from Android's cloud backup, so none of this is copied to your Google account. "Erase app data" in the App deletes all of it at once.
You can grant or revoke any permission at any time in Android Settings. Features that depend on a permission will stop working without it; the rest of the App keeps working.
3. Data shared with service providers
3.1 Advertising – Google AdMob (not in the current version)
The current version shows no ads and does not read your advertising ID. If a later version adds ads, this policy and the App's store listing will be updated first, and this is how they will work: the free version would show banner and full-screen ads through Google AdMob. Google may collect and process: the device's advertising ID, IP address, device and app information (model, OS version, language), approximate location derived from IP, and ad interaction data (views and clicks). This is used to deliver and measure ads, prevent fraud and, where you have consented, personalise ads.
- In the EEA, UK and Switzerland, and in U.S. states that require it, we ask for your consent through Google's User Messaging Platform before ads are personalised. You can change your choice later from the App.
- You can reset or delete your advertising ID, or opt out of personalised ads, in Android Settings → Privacy → Ads.
- PRO users see no ads.
- Google's policy: How Google uses information from sites or apps that use its services.
3.2 Purchases – Google Play Billing and RevenueCat (not in the current version)
The current version has no purchases and does not contact RevenueCat. If paid plans are added: subscriptions and one-time purchases are processed by Google Play. We never receive your payment card details. To check whether you have PRO access, the App uses RevenueCat, which receives an anonymous app user ID generated by the App, your purchase history for this App (products, dates, prices, transaction IDs), and basic device and app information. RevenueCat does not receive your name or email from us. RevenueCat Privacy Policy · Google Privacy Policy.
3.3 Email Breach Checker (only when you run a check)
This feature is not available yet; until it is, nothing is sent. Once it launches: when you enter an email address and start a check, that address is sent over an encrypted connection to Have I Been Pwned (haveibeenpwned.com) to look it up in databases of publicly known data breaches. The result is shown in the App. We do not store the email address or the result on our servers, and we do not use it for any other purpose.
3.4 Email Cleaner (not in the current version)
This feature is not available yet; until it is, the App has no access to any email account. Once it launches: if you connect a Google account, you sign in directly with Google (OAuth); we never see your password. With your permission, the App accesses your mailbox from your device to list senders, newsletters and junk messages, unsubscribe from senders you choose and delete or move to trash the messages you select. Email content and metadata are processed on your device and are not stored on or sent to our servers. You can disconnect at any time in the App or at myaccount.google.com/permissions.
AI Phone Cleaner - ZapBox's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, do not sell it, do not transfer it to third parties except as needed to provide the feature or to comply with law, and do not allow humans to read it unless you give explicit consent for a specific message (for example, to investigate a support request), it is necessary for security purposes, or it is required by law.
3.5 Invite friends program (not in the current version)
This program is switched off in the current version and nothing is sent. If it is switched on: when you open the invite screen, or install the App through a friend's invite link, the App sends our referral server (hosted on Cloudflare) your anonymous RevenueCat app user ID, your invite code or the code you were invited with, and your device's Android ID. We store the Android ID only as a salted one-way hash, used solely to prevent the same device from claiming rewards more than once. We use this data only to run the program and grant rewards through RevenueCat. We keep it while the program runs and delete it within 12 months after it ends, or sooner on request. Google Play tells the App which invite link an install came from (Install Referrer); no personal information about your friends is collected.
3.6 Support emails
If you email us, we receive your email address and whatever you include in the message (and the app version and device type that the App pre-fills in the subject line). We use this only to answer you and keep it for up to 24 months.
3.7 Anonymous usage statistics and crash reports – Aptabase
The App sends anonymous usage events to Aptabase (aptabase.com), hosted in the European Union: that the App was opened, which of its screens are opened (for example "Smart Clean"; never what is shown on them or anything about your files), the app version and build, the device's operating system version, locale and model type, whether an update notice was shown or accepted, and technical details of crashes. Aptabase does not use cookies, advertising IDs or any other persistent identifier, and we cannot link these events to you or your device. We use them only to count active installs per version, see how many users take an update and fix crashes. Events are kept in aggregate for up to 24 months. You can switch this off at any time in the App under About & Help → Preferences → Anonymous usage statistics; nothing is sent while it is off.
3.7a Crash reports and anonymous screen recordings – Firebase Crashlytics and Microsoft Clarity
If anonymous usage statistics are on (see 3.7), the App also uses two services to find and fix problems. Firebase Crashlytics (Google) receives a crash report when the App crashes: the technical stack trace, the device model, Android version, app build and an installation identifier generated by Firebase. Microsoft Clarity records how the App's own screens are used (taps, scrolling, which screens are opened) so we can see which parts are confusing. Clarity records only screens with no personal content (the home screen, Smart Clean, settings, help, history, invitations and the upgrade screen). It is paused on every screen that shows your photos, videos, contacts, e-mail addresses or Secret Space, so those never appear in a recording. Clarity assigns a pseudonymous identifier to the installation. Neither service receives your files, and we do not use the data to identify you. You can switch both off at any time under About & Help → Preferences → Anonymous usage statistics; nothing is collected while it is off.
3.9 Google Play services used by the App
The version installed from Google Play uses Google Play's own components to check whether a newer version is available, to show Google Play's rating sheet, and to download the on-device text-recognition model used to find memes. These requests go from your phone to Google Play as they do for any app installed from Google Play; we do not receive any data from them. Your photos are never sent: text recognition runs on your device.
If you use a share button in the App, the App hands a short text or a picture it draws itself (for example "I freed 4.2 GB", never one of your photos) to the app you pick. Nothing is shared unless you choose to. The home-screen widget shows only how much storage is free.
3.8 Update checks (versions installed outside Google Play only)
Versions of the App downloaded directly from our website (not from Google Play) check a public file on GitHub (github.com) for new versions when opened and every few hours. GitHub receives your IP address as part of the request, as with any download. The version installed from Google Play does not do this; Google Play handles its updates.
4. What we do not do
- We do not sell your personal information or share it for cross-context behavioural advertising. The current version contains no advertising at all.
- We do not upload your photos, videos, contacts, calendar, reminders or emails to our servers.
- We do not require you to create an account.
- We do not track you: the anonymous statistics in section 3.7 contain no identifiers and are never used for advertising.
5. Legal bases (EEA / UK users)
- Performance of our contract with you: on-device cleaning features.
- Consent: device permissions and the weekly reminder. You can withdraw consent at any time.
- Legitimate interests: answering support requests, and anonymous usage statistics and crash reports (section 3.7) to keep the App working. You can object by switching the statistics off in the App.
6. Data retention and deletion
- Data processed on your device stays under your control. Uninstalling the App, or using "Erase app data" in the App, removes the App's local data, including the Secret Space PIN and anything still inside Secret Space. Items you delete for good cannot be recovered by us; items you move to the trash can be restored from your gallery's trash for 30 days.
- Because the App has no accounts, we hold no profile about you. To ask for deletion of any data linked to you (for example support emails), email zapboxinternational@gmail.com. We will respond within 30 days.
7. Security
All network connections the App makes use encryption in transit (HTTPS/TLS). The Secret Space PIN is kept in Android's hardware-backed encrypted storage where available. No method of storage or transmission is 100% secure, but we design the App so that your personal content does not leave your device in the first place.
8. Your rights
Depending on where you live (for example under the EU/UK GDPR or U.S. state privacy laws such as the CCPA/CPRA), you may have the right to access, correct, delete or port your personal data; to object to or restrict processing; to withdraw consent; and to opt out of the sale or sharing of personal data or of targeted advertising. To exercise any right, email zapboxinternational@gmail.com. We will not discriminate against you for exercising your rights. You can also complain to your local data protection authority.
9. Children
The App is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. International transfers
Anonymous usage statistics are processed by Aptabase in the European Union. Crash reports (Google Firebase Crashlytics) and screen recordings (Microsoft Clarity) may be processed in the United States and other countries. Google Play services, and the providers named in sections 3.1 to 3.5 if those features are added, may process data in the United States and other countries. Where required, these transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
11. Changes to this policy
We may update this Privacy Policy. We will post the new version on this page with a new effective date and, for material changes, notify you in the App.