Cloud2Local - Privacy Policy

Privacy Policy — Cloud2Local

Effective Date: August 14, 2026 | Last Updated: August 14, 2026

1. Overview & Product Model

Cloud2Local ("we", "our", or "the app") is an Android application developed under NgDinhNha that performs scheduled and manual synchronization of files from user-authorized cloud storage providers directly to user-selected folders on the local Android device (via Android Storage Access Framework — SAF).

Strict Local-Only & Direct-Transfer Architecture: Cloud2Local is designed with a privacy-first model. The developer does not operate any middleman servers, intermediate proxy services, cloud databases, or developer-hosted user accounts. All communication, authentication handshakes, and file transfers occur directly and securely between the user's Android device and the third-party cloud storage service selected by the user.

2. Information Accessed, Processed, and Stored

Cloud2Local accesses and processes only the minimum data necessary to perform authentication, cloud folder browsing, and file synchronization:

• Cloud Account Profile Information: When you connect a cloud account (Google Drive, Microsoft OneDrive, Dropbox, or Box), the app receives your account email address, display name, account provider identifier, and profile picture URL from the provider's OAuth profile service. This information is stored locally on your device in the app's private Room database solely to identify connected accounts and display them in the user interface.
• Authentication Credentials (OAuth Tokens): OAuth access tokens and refresh tokens received during authorization are stored exclusively on your device using AndroidX Security (EncryptedSharedPreferences using AES-256 SIV for keys and AES-256 GCM for values, backed by a master key generated in Android Keystore). These tokens are used solely by your device to authenticate API requests directly to the selected cloud service. They are never sent to the developer or any unauthorized party.
• Cloud File and Folder Metadata: To display folder trees and identify files requiring synchronization, the app queries the cloud provider's API for folder names, folder IDs, file names, file sizes, modification timestamps, and MIME types. Transient file listings during synchronization are processed ephemerally on-device, while the specific cloud folder identifier and folder name selected by the user for an active sync task are stored locally as task configuration in the app's private Room database.
• File Contents: Files are downloaded directly from the cloud provider over HTTPS to the local destination folder chosen by the user via Android's Storage Access Framework (SAF). File contents are written directly to your device storage and are never intercepted, copied, or transmitted to any developer server or third-party service.
• Sync Task Configurations: Task parameters created by the user (task name, provider, cloud folder identifier, local storage URI, sync frequency, Wi-Fi / charging constraints, preferred execution time, and optional delete-after-download preference) are stored locally on-device in the app's private Room database.
• Sync History & Error Logs: Records of past synchronization attempts (file names, completion timestamps, success/warning/error status, and diagnostic error messages) are stored locally in the app's private Room database to provide the in-app history log.

3. Supported Cloud Providers & Third-Party Services

Cloud2Local supports direct integration with user-selected cloud storage services. The app initiates network requests only to the official APIs of the providers you explicitly connect:

• Google Drive / Google APIs: Used for Google account authentication and file metadata/downloads. Subject to Google Privacy Policy.
• Microsoft OneDrive / Microsoft Graph: Used for Microsoft OAuth authentication and file metadata/downloads. Subject to Microsoft Privacy Statement.
• Dropbox: Used for Dropbox OAuth authorization and file operations. Subject to Dropbox Privacy Policy.
• Box: Used for Box OAuth authentication and API operations. Subject to Box Privacy Policy.

These providers are independent third-party services and are not operated or controlled by Cloud2Local / NgDinhNha.

4. Advertising & Third-Party SDK Data Handling

Cloud2Local integrates the Google Mobile Ads SDK to display banner advertisements (using Google's official sample test configuration during development and closed testing). The Google Mobile Ads SDK automatically collects and shares certain data with Google for advertising, analytics, and fraud prevention purposes in accordance with the Google Privacy Policy and Google Mobile Ads Android Play Data Disclosure. This data includes:

• IP Address & Approximate Location: IP address (which may be used to estimate general coarse location of the device).
• User Product Interactions: User interactions with ads.
• Diagnostic Information: Diagnostic and performance data relating to the advertising SDK.
• Device and Account Identifiers: Device and other identifiers (such as the Google Play Advertising ID / app set ID).

Zero Sale or Cloud File Sharing: We do not sell, rent, or monetize your personal information. Your personal files, documents, local storage directory paths, and cloud OAuth credentials remain strictly on your device or in direct transit with your authorized cloud storage providers, and are never shared with or accessible to Google Mobile Ads or third-party advertisers.

5. Data Security Measures

We protect your information through multiple layers of technical safeguards:

• Encrypted Credential Storage: Sensitive OAuth tokens are stored on-device using AndroidX Security (EncryptedSharedPreferences with AES-256 SIV for keys and AES-256 GCM for values, utilizing Android Keystore).
• Operating System Sandboxing: App databases and settings are stored strictly in Android's protected, application-private internal storage sandbox, inaccessible to other applications.
• Encrypted Transport (HTTPS/TLS): All network communications with cloud providers use industry-standard HTTPS/TLS transport security.
• Production Network Logging Disabled: Production release builds completely disable HTTP request and response logging to prevent accidental exposure of tokens, headers, or payloads.
• Strict Backup Exclusions: App-private databases and shared preferences are explicitly excluded from Android cloud backups (Auto Backup) and device-to-device migration transfers.

6. Data Retention, Deletion, and User Control

Because Cloud2Local operates entirely on your device with no developer backend, you maintain full control over your data:

• No Developer-Hosted Accounts: Cloud2Local does not create a Cloud2Local user account; there are no remote server accounts to manage or delete.
• Removing a Cloud Account: When you remove a connected cloud account in the app (Accounts → Remove), the local account record is deleted immediately from the database and all associated encrypted OAuth tokens are permanently erased from device storage.
• Deleting Tasks & History: You can delete any sync task or clear your sync history at any time using the in-app controls.
• Uninstalling the App: Uninstalling Cloud2Local completely purges all app-private databases, settings, and encrypted tokens from your device. Due to our strict backup exclusion configuration, this private state will not be restored from cloud backups.
• Downloaded Files: Files downloaded to your local storage remain in your selected storage location and can be managed or deleted by you at any time using any file manager.
• Revoking Cloud Provider Permissions: You can revoke Cloud2Local's access to your cloud account at any time through your cloud provider's security and permissions portal (e.g., Google Account Security settings, Microsoft Account App permissions, Dropbox Connected Apps, or Box Account Security).

7. Android System Permissions

Cloud2Local requests only the following standard Android permissions to deliver core functionality:

• android.permission.INTERNET: Required to communicate directly with user-authorized cloud storage provider APIs over HTTPS.
• android.permission.ACCESS_NETWORK_STATE: Required to evaluate network status and respect user-configured constraints (such as "Require Wi-Fi").
• android.permission.FOREGROUND_SERVICE & FOREGROUND_SERVICE_DATA_SYNC: Required to execute scheduled file synchronization in the background without being terminated by the system.
• android.permission.POST_NOTIFICATIONS: Required on Android 13+ to display foreground service sync progress and task completion notifications.
• com.google.android.gms.permission.AD_ID: Required by the Google Mobile Ads SDK on Android 13+ to access the Advertising ID for ad serving and fraud prevention.

8. Children's Privacy

Cloud2Local is a general utility intended for users who manage cloud file synchronization. It is not directed to children under 13 years of age (or under the applicable age threshold in your jurisdiction), and we do not knowingly collect personal information from children.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect product enhancements, architectural updates, or regulatory requirements. Any updates will be reflected with a revised "Last Updated" date at the top of this document and made available within the application and at our official published policy URL.

10. Contact Us

If you have questions, suggestions, or concerns regarding this Privacy Policy or Cloud2Local's data handling practices, please contact us via our official contact page:

Contact