Privacy Policy

1. Who we are and what this covers

This policy covers Quick Share for Android, package com.quickshare.cloudlink.filetransfer, its related cloud-sharing service, and these privacy and deletion pages. The developer is the Quick Share Team. Contact us at ymwotow411846@gmail.com.

Local transfers can be used without a cloud account. Cloud storage and paid subscriptions may not be available in every build; the relevant sections below apply when those services are enabled and you use them. Quick Share is an independent app and does not use another app's accounts or storage.

2. Local file selection and transfers

You choose the files, photos, videos, text, folders, or app installation packages you want to share. Android file and media pickers, folder access, and system sharing provide access to the content you select. Only when you open the app picker, Quick Share reads the names, package identifiers, base-APK sizes, and icons of launchable third-party apps on your device. That inventory is not uploaded; only an APK you choose to send is transferred, without the selected app's private data.

When local discovery starts, including at app startup, LocalSend-compatible discovery uses unencrypted multicast to announce your device alias, protocol, operating-system/device information, port, and certificate fingerprint. Nearby network devices can also see the source IP address. A receiving device sees the offered file names and sizes, and transfers require approval by default. File contents move directly between devices over the local network; this local-transfer path does not upload them to our cloud service.

Local file transfer uses HTTPS by default and also supports HTTP for compatibility. Discovery announcements are not encrypted, and HTTP transfers are not encrypted. Do not assume that all local traffic is encrypted or end-to-end encrypted.

Received files, temporary selection copies, a history index of up to 200 transfers, and private preferences are stored on your device. Local identity information includes a random guest credential and device TLS identity/certificate-fingerprint information. Cloud sessions use the separate secure storage described below. You control exports to Downloads or other apps. Clearing transfer history does not delete received files. Uninstalling does not delete exported public Downloads copies. Files you send, or copies exported or saved by a recipient, remain under that recipient's control.

3. Google sign-in and your cloud account

If you sign in, Google provides a verified account identifier (sub), email address, display name, and profile-photo URL. Our backend stores this profile to identify your account, show account details, and associate your cloud files across devices. Email is used for display and support; the verified account identifier is the account key.

A Google ID token is sent to our backend for verification; it is not kept as a stored login credential. We issue a separate session valid for up to seven days. The app stores the session in Android-backed secure storage, and the backend stores a hash of the session token. Signing out clears the device session and requests server revocation; if the server cannot be reached, the server-side session can remain until its original expiry. Account records, cloud files, other devices' sessions, and provider-side records are not automatically deleted. The current avatar uses initials and does not fetch the stored photo URL. Google sign-in does not grant access to your Google Drive files, and cloud uploads are not placed in your Google Drive.

In a local development storage mode, a random guest credential may identify guest uploads. When you sign in, that device's guest files on the same service may be associated with your account.

4. Cloud uploads and share links

When you choose cloud sharing, we process the selected file contents, file name, byte size, ownership identifier, upload and expiry times, and storage identifiers. Production cloud files use private Cloudflare R2 storage; our backend manages access, quota, expiry, and deletion. An optional file password is sent for verification and stored as a salted password hash, not as a readable password.

Free file-retention choices are 3 or 7 days. Pro permits 3, 7, 14, 30, 60, or 90 days, subject to the plan offered in the app. Access requests are refused when a file expires or is deleted. Physical object cleanup normally runs on an approximately 60-second cycle and retries failures; this is not a guarantee of removal within 60 seconds.

Anyone who has an unprotected share link can access the file while it is available. A password protects the download contents, but a link holder can still see the file name, size, and expiry on the share page. Successful access can produce a short-lived download link. Treat links and passwords as private. Cloud sharing is not end-to-end encrypted: our service and its storage provider process the uploaded contents to deliver the service. Deleting a link cannot recall copies already downloaded or shared elsewhere.

5. Subscriptions and payment information

If subscriptions are enabled, Google Play handles purchases and payment details. Quick Share's backend does not receive your full payment-card number. RevenueCat and Google Play process purchase records and subscription status so we can provide, restore, and validate paid access.

RevenueCat receives an account identifier derived from your verified cloud-account identity, purchase/subscription records, and the SDK's technical context, such as app/SDK version and platform information, as needed to operate the subscription service. This derived identifier is pseudonymous, not anonymous. We do not set your name or email as RevenueCat customer attributes. Purchase history is also used for subscription analytics. We do not send your uploaded files to RevenueCat.

The app does not integrate advertising, cross-app tracking, or a separate behavioral-analytics SDK. This does not mean that no data is processed: subscription providers process data required for their operation and subscription analytics. See RevenueCat's Google Play data disclosures.

6. Operational data and support

Our backend records source IP address, HTTP method, and response status to operate and protect the service. The application's server logger omits request URLs and request bodies. Hosting, network, identity, storage, and purchase providers also receive the network and technical information needed to handle their services under their own policies.

If you email support, we receive your email address, message, and any attachments you choose to send. We use that information to answer your request, verify ownership where necessary, and resolve the issue. Please do not email passwords, verification codes, session tokens, or private files that are not needed for your request.

7. Who processes information

Information is provided to the services needed for the features you use, and to recipients you choose. We do not sell your personal information. Relevant providers and their policies include:

• Google / Google Play: authentication, app distribution, and purchases. Google Privacy Policy.
• Cloudflare: private R2 file storage and associated infrastructure when cloud sharing is used. Cloudflare Privacy Policy.
• RevenueCat: subscription records, entitlement validation, and subscription analytics when purchases are enabled. RevenueCat Privacy Policy.
• Email and website-hosting providers: delivery of support email and these public pages, including normal network/request processing.

We may disclose limited information when required by applicable law or necessary to address abuse and protect the service. Providers may process information where they operate; this policy does not promise a particular storage country.

8. Retention, security, and your choices

Cloud files follow the expiry you select or your deletion request. Account profile information is retained to support your account until deletion is completed. Sessions expire after up to seven days or are revoked earlier. Operational logs and support correspondence are retained as needed for service operation, security, resolving requests, and applicable obligations. Google Play and other providers may separately retain transaction or legally required records under their policies.

We use measures including HTTPS by default for local transfers, HTTPS for production cloud requests, private object storage, hashed sessions, and salted password hashes. Local discovery and compatible HTTP transfers are not encrypted, as explained above. No storage or transmission method can guarantee complete security. A local development cloud connection may also use HTTP; it is not intended for public production service.

You can avoid cloud-account processing by using local transfers, select only the content you want to share, decline transfers, and delete cloud files from the app. Exported Downloads copies can be deleted in Android's file manager. App-private received files and caches can be removed by clearing Quick Share's storage in Android app settings or uninstalling; this also removes local settings and history, but does not delete your cloud account or public Downloads copies. For access, correction, or deletion requests, contact us; we may need to verify account ownership. Available rights depend on applicable law.

9. Account and data deletion

To request deletion of your Quick Share account, cloud files, and associated profile, email ymwotow411846@gmail.com from the email address used for Google sign-in, with the subject Quick Share account deletion. We verify ownership and handle requests manually. This is not an instant automated deletion endpoint.

Read the full account and data deletion instructions →

Signing out or uninstalling is not account deletion. Account deletion does not automatically cancel a Google Play subscription; manage it separately in Google Play subscriptions. Local files and copies held by recipients are not remotely erased by deleting your cloud account.

10. This website and policy updates

Our static page source does not set analytics or advertising cookies or include analytics scripts, sign-in, or collection forms. The hosting infrastructure may use security cookies and inject security-check scripts to prevent abuse. It receives normal network information, including IP address and request information, to deliver and protect the pages. Email links open your email application; they do not submit a website form.

We may update this policy as the app or its services change. The effective date appears at the top. English and Simplified Chinese versions are available through the language switch at the top of the page. Questions can be sent to the Quick Share Team at ymwotow411846@gmail.com.