Pocket Drive — Privacy Policy
Last updated: 26 September 2026
Pocket Drive is a private, self-hosted drive. There is no company behind it and no shared service: the app talks only to one person's own server, and only people that owner invites have an account. Your files are not stored on anyone else's cloud.
What the app collects, and why
| Data | Why |
|---|---|
| Your name, email address and profile picture | From Google sign-in, to identify your account and show who shared what |
| Files you upload, and their names, sizes and dates | They are the point of the app. Thumbnails and preview versions are generated from them |
| Photos and videos from your device | Only if you turn camera backup on. Only media added after you enable it is uploaded |
| A notification token for your device | To deliver push notifications about sharing and new files |
| An activity log: what was uploaded, shared or deleted, when, and the IP address it came from | So the drive owner can see what happened on their own drive. kept for 180 days, then deleted automatically |
What it is never used for
- No advertising, and no advertising identifiers.
- No analytics or tracking SDKs.
- Your data is never sold, rented, or shared for anyone else's marketing.
- Nobody builds a profile of you. Your files are not scanned, indexed or read for any purpose other than serving them back to you and the people the owner shared them with.
Who else is involved
The app uses three outside services, and nothing else:
- Google Sign-In — verifies who you are. Google tells the drive your email, name and profile picture. Google's privacy policy.
- Firebase Cloud Messaging — carries push notifications to your device. Notification text may pass through Google's servers on the way.
- Cloudflare — traffic between your device and the drive travels through Cloudflare's network, which sees connection metadata such as IP addresses. Cloudflare's privacy policy.
What stays on your phone
- App lock. If you enable the fingerprint, face or PIN lock, that check happens entirely on your device. No biometric data is read by the app or sent anywhere — Android only tells the app whether the check passed.
- Your sign-in token, stored in Android's encrypted keystore.
- Files waiting to upload, until they finish.
Permissions, and what each is for
| Permission | Used for |
|---|---|
| Photos and videos | Choosing files to upload, and camera backup if you enable it |
| Notifications | Telling you when something is shared with you or added to a folder |
| Run at startup | Resuming interrupted uploads after your phone restarts |
| Foreground service / background jobs | Finishing large uploads while the app is closed |
| Network access | Talking to the drive, and waiting for Wi-Fi if you chose Wi-Fi-only uploads |
Security
All traffic uses HTTPS. Sign-in tokens are stored only as hashes on the server, so a copy of the database does not reveal them. The drive is reachable only through an outbound tunnel, so the server has no open ports exposed to the internet.
Keeping and deleting your data
- You can delete your account at any time from Settings → Delete account in the app. This removes your profile, your access to shared folders, your sessions and your notification devices immediately. See the deletion page for details.
- Files you uploaded stay on the owner's drive, because they belong to the drive, not to your account. Ask the owner first if you want specific files removed too.
- The activity log is kept for 180 days, then deleted automatically.
Children
Pocket Drive is not aimed at children and is not offered to them. Accounts exist only by the owner's personal invitation.
Changes
If this policy changes, the date at the top changes with it.
Questions about your data? Email the drive owner at [email protected].