Privacy Policy
File Manager Ultra for Android · package com.navobytes.filemanager
Effective date: October 11, 2026 · Last updated: October 11, 2026
The one-line version: your files stay on your phone. The app has no server of its own.
Three things do leave your device, and this page names all of them: an advertising identifier (for ads), usage analytics (only if you accept the consent prompt), and crash reports. If you connect a cloud drive, that provider's account details come back to the app so it can show you your own files.
1. Who we are
NavoBytes ("we", "us", "our") develops and publishes the Android application File Manager Ultra (the "app"). We are the data controller for the limited processing described in this policy.
| Developer | NavoBytes |
|---|---|
| App | File Manager Ultra (com.navobytes.filemanager) |
| Contact | filemanager@navobytes.com |
| Website | navobytes.com |
2. What this policy covers
This policy applies to the Android app File Manager Ultra, obtained from Google Play, and to this website. It explains what the app does with information, why, how long it keeps it, and what you can do about it.
It does not cover third-party services you may reach from the app — Google Play, Google AdMob, Google Analytics for Firebase, Firebase Crashlytics, Google Drive, Dropbox or OneDrive. Each of those has its own privacy policy, and we link to them in section 10.
3. Summary of data practices
This table is a summary. The sections that follow give the detail.
| Data | Collected? | Shared? | Purpose | Optional? | Retention |
|---|---|---|---|---|---|
| Your files, file names, folder names, file contents | No | No | — | — | Not collected |
| Location | No | No | — | — | Not collected |
| Contacts, messages, call logs, health data | No | No | — | — | Not collected |
| Advertising ID (device identifier) | Yes | Yes — Google AdMob | Advertising, ad measurement | No | Per Google's retention settings |
| App activity / usage events | Yes | No | Analytics, product improvement | Yes — off until you consent | Up to 14 months (Google Analytics) |
| Crash logs and diagnostics | Yes | No | Fixing crashes and defects | No | Up to 90 days (Crashlytics default) |
| Name and email address | Only if you connect a cloud drive | No | Showing and transferring files in your own cloud account | Yes | On your device, until you disconnect |
| Purchase / subscription status | Yes, from Google Play | No | Unlocking the features you paid for | No (if you subscribe) | Per Google Play; entitlement kept while needed |
| App PIN / vault PIN | Stored only on your device as a salted hash (PBKDF2) | No | Locking the app and the vault | Yes | Until you remove it or uninstall |
4. Data we never collect
- Your files and their contents. Browsing, cleaning, duplicate detection, storage analysis, compression, text editing and search all run entirely on your device. No file, file name, folder name, file path, thumbnail, or directory listing is transmitted to us or to any third party.
- Your location. The app requests location permissions because Wi-Fi Direct device discovery requires them on Android 12 and below (see section 9). The app never calls a location API, never reads your Wi-Fi network name (SSID), and never derives or transmits location.
- Contacts, SMS and call logs. The app does not request access to them.
- Health, fitness or medical data. The app neither requests nor handles it.
- Photos, videos and audio. The app lists, previews, moves and deletes these files on your device. Their contents are never uploaded to us.
- Your PIN, passwords and passcodes. PINs are stored locally as a salted PBKDF2 hash. We never receive them, and they cannot be read back out of the app.
- Any file stored on a NavoBytes server. There is no such server. The app has no account system, no login screen and no backend that stores user documents.
Note on what "collect" means: Android's broad storage permissions let the app read files on your device so it can do its job. In data-protection terms, processing that stays on your device and is never transmitted to us or anyone else is not collection by us. That is the case here.
5. Data we do collect
5.1 Advertising identifier
The app displays advertising through Google AdMob. To select, cap and measure ads, Google and its advertising partners may access your device's advertising ID — a resettable identifier that is not tied to your name. Related technical signals (such as IP address, device type, operating system version and approximate region derived from IP) may also be processed for ad delivery, measurement and fraud prevention.
- Purpose: advertising and marketing, ad measurement, fraud prevention.
- Shared with: Google and its advertising partners, as described in Google's policies.
- Optional? No — advertising funds the free version. You can, however, reset or delete your advertising ID, and limit ad personalisation, in Android's privacy settings.
- Where required by law, personalised advertising and consent for it are handled through the consent prompt shown in the app (Google's User Messaging Platform). If you decline, ads are served on a non-personalised basis.
5.2 Usage analytics (app activity)
The app can record which features are used — for example that the storage analyzer was opened or a cleanup completed — through Google Analytics for Firebase. This helps us see which features are used and which are dead weight.
- Off by default. Collection is disabled in the app until you accept the consent prompt. If you decline, no analytics events are collected from your device.
- What is not included: file names, file paths, folder names, file contents, and any identifier that reveals what is inside your files.
- Shared with: Google (as our analytics processor). Not sold, not shared with advertisers for their own purposes.
- Optional? Yes, and you can withdraw consent at any time in the app's settings.
5.3 Crash logs and diagnostics
If the app crashes or hits an unhandled error, a technical report is sent through Firebase Crashlytics: the stack trace, app version, and device characteristics such as model, Android version and available memory. These reports are how defects get found and fixed.
- What is not included: your files, their names, their contents, or your PIN.
- Purpose: app functionality, stability and security.
- Optional? No. Crash reporting is part of keeping the app working; it is not used for advertising or profiling.
5.4 Account information, only if you connect a cloud drive
The app can connect to Google Drive, Dropbox and OneDrive. This is optional and starts only when you choose it. When you connect a service, you authenticate with that provider (not with us), and the provider returns the information the app needs to work: your name, email address, account identifier and an OAuth access/refresh token.
- Purpose: app functionality — listing, downloading, uploading, renaming, moving and deleting files in your own cloud account at your instruction.
- Where it is stored: OAuth tokens are stored on your device. We do not operate a server that stores your cloud credentials or your cloud content.
- Shared with: nobody. We do not send this to third parties, and we do not use it for advertising.
- Optional? Yes. You can disconnect at any time in the app, and revoke access from the provider's own account page.
5.5 Purchases and subscriptions
Subscriptions are sold and processed by Google Play Billing. We receive only what Play provides to the app to validate your entitlement — typically the product identifier, purchase state, and a purchase token. We never receive your card number or full payment details.
5.6 Data stored only on your device
The following never leaves your device and is not accessible to us: app settings and preferences, favourites and bookmarks, Safe Vault contents and records, recycle-bin contents, cleaning history, scheduled-task definitions, and your PIN hashes.
6. Your files are not uploaded to us
File Manager Ultra is a local tool. There is no NavoBytes cloud, no sync service, and no server that receives your documents. When the app "moves" a file into the Safe Vault, that file is relocated into the app's private storage on the same device. When it cleans caches or finds duplicates, that analysis and the deletion happen on the device.
7. Local network, FTP and cloud transfer
Three features move files between your device and other places you choose. All three are started by you and are inactive until you start them:
- Wi-Fi Direct transfer. Sends files directly to another device nearby over a peer-to-peer Wi-Fi link. No router, mobile data or account is involved. Only the files you select are sent.
- Browser access over your local network. Runs a small web server on your phone so a computer on the same network can browse and download the folders you expose. The address is reachable by devices on that network while the server is running.
- FTP server. The same idea for FTP clients, protected by the credentials you set.
- Cloud upload. Files you upload go from your device to your own cloud account at your instruction. They do not pass through us.
Your responsibility: while a local server is running, anything you expose may be reachable by other devices on that network. Use these features on networks you trust, and turn them off when you are done.
8. Google Drive and Google API data
The app's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
| What we access | If you sign in with Google, the app requests access to your Google Drive files so it can list folders, download, upload, rename, move and delete the files you act on inside the app. We request only the scopes needed for those actions. |
|---|---|
| How we use it | Solely to provide the file-management features you asked for. We do not use Google user data for advertising, we do not sell it, and we do not use it to train or improve generalised machine-learning models. |
| Who else sees it | Nobody. We do not transfer Google user data to third parties, except where necessary to provide the feature you requested, to comply with applicable law, or as part of a merger or acquisition with notice to you. |
| How it is stored | OAuth tokens are stored locally on your device so you do not have to sign in repeatedly. We do not operate a server that stores your Google Drive content or your Google credentials. |
| How to remove access | Disconnect Google Drive inside the app, and/or revoke the app's access at myaccount.google.com/permissions. |
9. Permissions and why we ask for them
Android shows you permission prompts. Here is what each one is for, and what it is not for.
| Permission | Why the app asks |
|---|---|
Files and media (storage / MANAGE_EXTERNAL_STORAGE) | Core function: to browse, organise, clean, compress and analyse files on your device. All processing stays on the device. |
Location (ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION) | Only for Wi-Fi Direct device discovery, which Android 12 and below gates behind location permission. The app does not call any location API and does not read your Wi-Fi network name, so no location data is produced. On Android 13+ the app uses NEARBY_WIFI_DEVICES instead. |
| Photos, videos and audio (scoped) | To show and manage your media files inside the app. Not uploaded to us. |
| Notifications | To show transfer and cleanup progress, and the status of the local file server. |
| Foreground service | To keep a transfer, FTP/HTTP server or cleanup running while you are doing something else, with a visible notification. |
Installing packages (REQUEST_INSTALL_PACKAGES) | To install APK files that you choose. The app never installs anything on its own. |
| Accessibility service (optional, off by default) | Used only by the optional automation features, and only after you enable it yourself in Android settings. |
Accounts (GET_ACCOUNTS) | Used only when you connect a cloud drive, to read which account you signed in with. |
AD_ID | Advertising as described in section 5.1. |
You can deny any permission in Android settings; features that depend on it will stop working, but the rest of the app keeps functioning.
10. Third-party services
We use a small number of SDKs. Each processes data under its own policy, which we link to so you can read the source rather than take our word for it.
| Service | Purpose | Data involved | Their policy |
|---|---|---|---|
| Google AdMob | Advertising and ad measurement | Advertising ID, IP address, device and app signals, ad interaction | policies.google.com/technologies/ads |
| Google Analytics for Firebase | Usage analytics (consent-gated) | App events, device and app identifiers | firebase.google.com/support/privacy |
| Firebase Crashlytics | Crash and error reporting | Stack traces, device model, OS version, app version | firebase.google.com/support/privacy |
| Google Play Billing | Subscription purchase and validation | Product ID, purchase state, purchase token | policies.google.com/privacy |
| Google Drive | Only if you connect it | Account name/email, OAuth token, files you act on | policies.google.com/privacy |
| Dropbox | Only if you connect it | Account name/email, OAuth token, files you act on | dropbox.com/privacy |
| Microsoft OneDrive | Only if you connect it | Account name/email, OAuth token, files you act on | privacy.microsoft.com |
We do not sell your personal information, and we do not share it for cross-context behavioural advertising other than through the ad serving described in section 5.1.
11. Legal bases for processing
Where the GDPR or a similar law applies, we rely on these legal bases:
- Consent — for usage analytics (you may withdraw it at any time), and for personalised advertising where consent is required.
- Performance of a contract — to provide the app's features and the subscription you purchased.
- Legitimate interests — to keep the app secure and working: crash reporting, fraud and abuse prevention, and ad delivery that funds the free version. We balance these against your rights, and you can object as described in section 15.
- Legal obligation — where we must keep or disclose something to comply with the law.
12. Your choices and controls
- Analytics: off until you consent. Withdraw at any time in the app's settings.
- Advertising ID: reset or delete it in Android's privacy settings; on Android 13 and above you can remove it entirely. You can also limit ad personalisation there.
- Cloud connections: connect or disconnect Google Drive, Dropbox or OneDrive at any time in the app, and revoke access from the provider's account page.
- Permissions: grant or revoke each Android permission in system settings.
- Local storage: clear the app's data or uninstall it to remove everything it keeps on your device.
- Subscriptions: manage or cancel in Google Play under Payments & subscriptions → Subscriptions.
13. Data retention
| Data | How long |
|---|---|
| Data on your device (settings, vault and recycle-bin records, history, PIN hash) | Until you delete it in the app, clear the app's data, or uninstall the app. |
| Usage analytics | Retained in Google Analytics for the retention period configured for our property (currently up to 14 months), after which it is deleted automatically. |
| Crash reports | Retained in Crashlytics for up to 90 days by default, then deleted. |
| Advertising data | Retained by Google and its partners under their own retention settings. |
| Purchase records | Retained by Google Play under its policies. We keep only the minimum needed to keep your entitlement working. |
14. How to request deletion
There are two paths, depending on what you want removed.
Data on your device — you can delete it yourself, immediately:
- Remove files from the Safe Vault and the recycle bin inside the app before uninstalling, if you want them gone for good.
- Clear stored data via Android Settings → Apps → File Manager Ultra → Storage → Clear data.
- Uninstall the app. This removes everything it keeps locally.
- Reset your advertising ID in Android settings.
Data held by our service providers — ask us and we will action it:
Email filemanager@navobytes.com with the subject "Data deletion request". We will delete or anonymise the analytics and crash data associated with your device that we can identify, and confirm when it is done. We aim to respond within 30 days and will not charge you for it.
Please note: because we do not run a user database, we often cannot connect any analytics record to a named person — identifiers are pseudonymous device identifiers. If we cannot identify data as yours, we will tell you so honestly rather than pretend otherwise.
15. Your privacy rights
Depending on where you live, you may have some or all of the following rights:
- Access — to know whether we process personal data about you and to receive a copy.
- Correction — to have inaccurate data corrected.
- Deletion — to have data erased, as described in section 14.
- Restriction and objection — to limit or object to processing based on legitimate interests, including profiling for direct marketing.
- Portability — to receive certain data in a structured, machine-readable format.
- Withdraw consent — at any time, without affecting processing already carried out.
- Complain — to your local data protection authority. In Türkiye this is the KVKK (Kişisel Verileri Koruma Kurumu); in the EU/EEA it is your national supervisory authority; in the UK, the ICO.
California residents: we do not sell personal information and we do not share it for cross-context behavioural advertising beyond the ad serving described in section 5.1, which you can limit using the controls in section 12. We do not use or disclose sensitive personal information for purposes that would require a right to limit under the CPRA.
To exercise any right, email filemanager@navobytes.com. We may need to verify your request; because we hold so little, we will usually ask for the app version and device model shown in the app's settings.
16. International data transfers
The app is available worldwide, and Google's infrastructure (AdMob, Analytics, Crashlytics, Play) processes data in countries other than yours, including the United States. Those transfers are governed by Google's own safeguards, such as standard contractual clauses. Data that stays on your device is not transferred by us at all.
17. How we protect data
- Traffic to Google's services from the app uses encrypted connections (TLS).
- App PINs are stored as salted PBKDF2 hashes, not as plain text.
- Cloud credentials are held on your device by the platform's secure storage mechanisms, not on our servers.
- We limit what we collect in the first place — the strongest protection is data that was never collected.
No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Note also that the Safe Vault is access control, not encryption: it hides files in private app storage behind your PIN, but it does not encrypt them. Root access, custom ROMs or forensic tooling may still reach that storage.
18. Children
The app is not directed to children and is not intended for use by children under 13 (or the minimum age in your country, whichever is higher). We do not knowingly collect personal information from children. If you believe a child has used the app in a way that provided us personal data, contact us and we will delete it promptly.
19. Changes to this policy
If this policy changes, the "last updated" date at the top will change and the new version will be published at this same address: navobytes.com/file-manager/privacy-policy. We will not apply a materially different practice to data already collected without giving you notice in the app or in the store listing, and where required we will ask for your consent again. Continuing to use the app after an update means you accept the revised policy.
20. Contact us
For any question about this policy, or to exercise a privacy right:
| Developer | NavoBytes |
|---|---|
| App | File Manager Ultra (com.navobytes.filemanager) |
| Privacy contact | filemanager@navobytes.com |
| Response time | Within 30 days for privacy requests; a few business days for general questions |
| Website | navobytes.com |
See also: Terms of Service · File Manager Ultra overview.