Smart Drop Privacy Policy

Effective Date: July 27, 2026 · Last Updated: October 27, 2026

OUR PRIVACY CORE PRINCIPLE: ZERO-DATA ACCESS & NARROW DRIVE.FILE SCOPE Smart Drop is built on a local-first and user-owned cloud philosophy. We do not operate third-party file servers to store or inspect your personal documents. All files, notes, tags, and images you organize in Smart Drop stay inside your device's private storage and, when you choose to sync or use the web app (https://smartdrop-web.pages.dev), inside your own personal Google Drive account under the narrow https://www.googleapis.com/auth/drive.file permission. We cannot see, read, or access any other files in your Google Drive.

1. Introduction

Welcome to Smart Drop ("we," "our," "us"). This Privacy Policy explains how Smart Drop handles information when you use our Android mobile application (com.smartdrop.app) and our companion web application at https://smartdrop-web.pages.dev/ (collectively, the "Application" or "Service"). Smart Drop is a tag-based file organizer and cross-device file transfer tool that operates using on-device sandboxing alongside user-directed synchronization to your personal Google Drive.

2. Information We Access, Collect, and Process

Because Smart Drop functions as a private file vault and user-owned Google Drive organizer, we minimize the information we collect:

Google Account Identity (Sign-In): When you sign in with Google on the mobile app or web app, we access your basic Google profile information (name, email address, and profile identifier via openid, email, and profile) to authenticate your session and associate your Smart Drop workspace with your account. On the mobile app, we also record country (from device locale), first sign-in timestamp, and account tier status (such as Premium status) in Google Firebase to support account management. We never sell or share your personal information with third parties for advertising.
Google Drive Access Scope (drive.file Only): When you connect Google Drive on the mobile app or sign in on https://smartdrop-web.pages.dev/, Smart Drop requests ONLY the non-sensitive, per-file scope: https://www.googleapis.com/auth/drive.file (with include_granted_scopes: false). This permission is strictly limited to folders and files created by Smart Drop or explicitly opened/uploaded by you inside Smart Drop — specifically the Smart Drop root folder, its tag subfolders (Smart Drop/<TagName>/), the catalog index file (meta.json), and temporary transfer files in Smart Drop Share Temp. Smart Drop cannot view, list, modify, or delete any pre-existing personal or work files in your Google Drive that were not created or opened through Smart Drop.
User Files, Tags, Thumbnails, and Metadata: On Android, files imported into Smart Drop, along with generated .thumb.png thumbnails and tag metadata, are stored inside your device's private application sandbox (/users/your_email/). On the web app (https://smartdrop-web.pages.dev/), your files and tag metadata are read from and uploaded directly between your browser and your own Google Drive using Google's official Drive API.
QR Pairing & Ephemeral Device Transfer Sessions: When you pair your phone with a computer or use Send/Receive via QR code on https://smartdrop-web.pages.dev/, an ephemeral session document is created in Google Cloud Firestore containing short-lived session status and file transfer metadata so the two devices can coordinate the transfer. Temporary shared files are uploaded to your own Google Drive (Smart Drop Share Temp) or transferred directly and cleaned up after the session completes.
Firebase Analytics: Smart Drop uses Google Firebase Analytics to collect anonymous aggregate usage metrics (such as app version, device model, OS version, country/region, and feature events like onboarding completion, file import, search, or backup completion) to improve reliability. Smart Drop never sends your file contents, file names, tag names, search queries, or email address to Firebase Analytics.
Biometric Lock (Mobile App): To unlock "Private" tags on your phone, Smart Drop invokes your operating system's native LocalAuthentication API. We never access, collect, or transmit biometric face maps, fingerprints, or device passcodes.

3. How We Use Your Information

Smart Drop uses the information described above solely to provide and improve the Service's user-facing features:

To organize, tag, search, filter, preview, and download your files across your phone and browser.
To synchronize your tagged files and meta.json catalog directly with the Smart Drop folder in your own Google Drive when you initiate a backup, upload, or web session.
To facilitate QR-code device pairing and direct Send/Receive file transfers between your phone and computer.
To verify account status and in-app purchase entitlements.

4. Compliance with Google API Services User Data Policy (Limited Use)

Smart Drop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements:

We only use Google Drive data to provide user-facing file tagging, organization, backup, and cross-device transfer features requested by you inside Smart Drop.
We do not transfer, sell, or disclose your Google user data or Google Drive files to third parties, advertisers, or data brokers.
We do not use your Google Drive data for serving advertisements or for training generalized artificial intelligence or machine learning models.
No human at Smart Drop reads your Google Drive files unless you explicitly provide a specific file to us for a support request with your affirmative consent.

5. Data Storage, Security, and Third-Party Services

Direct Browser/Device-to-Google Communication: All Google Drive file uploads, downloads, and metadata updates occur over encrypted HTTPS/TLS connections directly between your device/browser and Google's servers (googleapis.com).
Private Tag Screen Protection: On Android, viewing a "Private" tag enables platform-level screen capture protection (FLAG_SECURE) to prevent background app switchers from snapshotting sensitive files.
Third-Party Infrastructure: Smart Drop relies on Google Drive API (for user-owned cloud storage), Google Identity Services / Firebase Authentication (for secure sign-in), Google Cloud Firestore (for ephemeral QR pairing sessions), and Google Play Billing (for optional Android Premium upgrades). Each is governed by Google's Privacy Policy.

6. Data Retention and Deletion

On-Device Data Deletion: Deleting a file or tag in the Android app or clearing app storage permanently removes the file and its local metadata from your phone's sandbox.
Google Drive Data Deletion: Because your cloud files live in your own personal Google Drive inside the Smart Drop folder, you retain full ownership and control at all times. You can delete individual files or tags inside Smart Drop, or open your personal Google Drive and delete the Smart Drop folder directly.
Disconnecting & Revoking Google Access: Clicking Disconnect in the web app or logging out in the mobile app immediately clears your local OAuth access token and cached session state. You can also revoke Smart Drop's Google account access at any time from your Google Account permissions page at https://myaccount.google.com/connections.
Account Deletion Requests: To request deletion of your Smart Drop Firebase account record, email us at appdeveloping991@gmail.com.

7. Children's Privacy

Smart Drop is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect product improvements or regulatory requirements. The updated version will always be posted at https://smartdrop-web.pages.dev/privacy.html with the revised update date.

9. Contact Information

If you have any questions about this Privacy Policy, our Google Drive drive.file integration, or data deletion, please contact us at:
Email: appdeveloping991@gmail.com
Website: https://smartdrop-web.pages.dev/