Privacy Policy — BunkerDoc

 Effective date: 2026-06-05
 Last updated: 2026-06-05

 Who we are

 BunkerDoc (also marketed as Digital Declutter) is an Android app developed by Henry Salazar. The app is a private, on-device document vault:
 documents are scanned, OCR'd, and stored locally on your phone, encrypted at rest, and protected by biometric authentication.

 Our core principle: data minimization

 We do not operate servers. We do not collect, store, transmit, sell, or share any of your personal data or document content. Everything BunkerDoc
 does happens on your device.

 What is stored on your device (and nowhere else)

 - Document images and metadata (titles, tags, expiration dates) — encrypted with AES-256 (SQLCipher database + AES-GCM file encryption tied to the
  Android Keystore).
 - OCR text extracted from your documents — encrypted in the same database.
 - App preferences and your Pro entitlement state.

 These never leave your device unless you explicitly export an encrypted backup or share a file via Android's Share Sheet.

 What we do NOT collect

 - No analytics, crash reports, telemetry, or device identifiers.
 - No advertising or ad-tracking SDKs.
 - No location data.
 - No access to contacts, photo library, or any data beyond what you choose to scan.

 Third-party services

 BunkerDoc integrates three third-party components, each running with the minimum scope needed. Each is governed by its own privacy notice.

 1. Google ML Kit Document Scanner & Text Recognition — used to capture pages and extract text. Both libraries run fully on-device; no document
 content leaves your phone. ML Kit terms: https://developers.google.com/ml-kit/terms
 2. Google Play Billing — used to process the one-time upgrade to BunkerDoc Pro. Purchase processing is handled by Google. Google's privacy policy:
  https://policies.google.com/privacy
 3. RevenueCat — manages your Pro entitlement (purchase state). RevenueCat receives anonymous purchase events tied to a randomly generated app user
  ID; no personal identifiers are sent. RevenueCat's privacy policy: https://www.revenuecat.com/privacy

 Permissions BunkerDoc requests, and why

 - Camera (via ML Kit Document Scanner) — to capture document pages. Frames are processed on-device; nothing is uploaded.
 - Storage access (SAF picker) — only when you explicitly choose to import a PDF or save a backup. BunkerDoc never scans your storage in the
 background.
 - Notifications (Android 13+) — to send reminder notifications for document expiration dates you set yourself. Notifications are intentionally
 generic ("You have a document expiring soon") and never include document names — protecting privacy on your lock screen.

 Backups

 BunkerDoc offers an optional encrypted backup. You choose a passphrase and Android's Storage Access Framework picker decides where the .bunker
 file is saved (local storage, Drive, SD card — your choice). BunkerDoc does not integrate with any cloud service. We never know your passphrase;
 only you can restore the backup.

 Security

 - Database: AES-256 via SQLCipher, with the key wrapped by a hardware-backed Android Keystore key that requires your biometric to unlock.
 - Files (document images): AES-GCM with a key derived from the Android Keystore.
 - FLAG_SECURE is always on — Android prevents screenshots, screen recording, and the recent-apps preview from exposing any content.
 - The app disables Android's auto-backup so the OS never copies your document data off-device.

 Deleting your data and uninstalling BunkerDoc

 Because BunkerDoc stores everything locally and we do not have any servers, you are always in full control of your data. There is no account to
 delete and no server-side data to request removal of.

 To delete individual documents: open BunkerDoc → tap the document → use the delete action inside the app. This wipes both the encrypted image
 files and the metadata/OCR text from the database.

 To delete all data without uninstalling: Android Settings → Apps → BunkerDoc → Storage → "Clear data". This removes the encrypted database, the
 encrypted document files, and the app preferences from your device.

 To uninstall BunkerDoc entirely (which also deletes all data):

 1. Long-press the BunkerDoc icon on your home screen or app drawer, then tap Uninstall; or
 2. Open Android Settings → Apps → BunkerDoc → Uninstall; or
 3. Open the Google Play Store, search for BunkerDoc, and tap Uninstall.

 When you uninstall, Android removes the encrypted database, the encrypted document files, and the Android Keystore key that BunkerDoc used to
 unwrap them. The data becomes cryptographically unrecoverable, even by us.

 If you previously purchased BunkerDoc Pro and later reinstall the app on the same Google account, you can recover your Pro entitlement by tapping
 Restore purchase in the paywall screen — no charges are made. Document content from before the uninstall is not recoverable unless you had
 exported an encrypted .bunker backup beforehand and still have the passphrase.

 Children's privacy

 BunkerDoc is not directed at children under 13. We do not knowingly collect personal information from anyone, and the app stores nothing on our
 servers. As with any app, parental supervision during installation is encouraged.

 Changes to this policy

 If we update this policy, the new version will be posted at the same URL with an updated "Last updated" date. Significant changes will also be
 communicated inside the app.

 Contact

 Questions, requests, or concerns about your privacy?
 ✉ hjsmipucf@gmail.com