Privacy policy — Bergrum

Effective date: 26 October 2026 · Applies to: the Bergrum Android application (se.bergrum) and this website.

1. Who is responsible

Bergrum Solutions AB, org. no. 559604-2456, Bruksvägen 13, 566 91 Habo, Sweden, is the data controller for the limited processing described here. Contact: privacy@bergrumsolutions.com.

2. What the app collects

Nothing. There is no account, no sign-in, no profile, no identifier, no analytics, no advertising and no crash reporting.

Category	Collected?
Name, email, phone number	No
Device or advertising identifiers	No
Location	No
Usage or analytics data	No
Crash reports and diagnostics	No
Your files and their names	No — they never leave the device

3. Why that is verifiable, not just promised

The app declares no INTERNET permission. Android will not let an app without it open a network connection, whatever its code attempts. This is enforced by the operating system, not by us, and it is the reason this policy can be short.

The app requests three permissions, and none of them touch the network:

Permission	Why
`FOREGROUND_SERVICE`	Keeps a job you started — a large encryption or export — running until it finishes.
`FOREGROUND_SERVICE_DATA_SYNC`	The type declaration Android requires for that service.
`POST_NOTIFICATIONS`	Shows the progress of that job. Decline it and the app works exactly the same.

The finished build also lists one internal entry, se.bergrum.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION. Android's support library adds it to protect the app's own components. Only this app can hold it, and it gives access to nothing.

Cloud backup of the app's own data is disabled (allowBackup="false"), so the vault is never copied into a Google or Samsung account.

4. Your files

Your files are stored encrypted in the app's private storage on your device. The key that protects them is held in the phone's secure hardware and cannot leave it. If a phone has no such hardware, the app says so.

We have no access to your files, your code, your passphrases or your key files. We cannot read them, recover them or reset them — not as a matter of policy we could choose to change for you, but as a consequence of the cryptography. It applies to us exactly as it applies to a stranger.

The practical consequence is on you, so it is stated plainly: if you uninstall the app, clear its data or reset the device, the key is destroyed and the vault cannot be opened again by anyone. Export an archive and keep it somewhere else.

How the app reaches your files

Through Android's own file picker (the Storage Access Framework). You select what goes in or out, and the app receives access to exactly that and nothing else. It never requests broad storage access, which would be a downgrade: standing permission over everything instead of a narrow grant per selection.

5. The loading dock

To move files between a computer and the phone over USB, the app uses a folder you choose — the "loading dock". Files there are not encrypted; they are in transit, visible to the computer and to any app with storage access, until the app stores them or you clear them. The home screen shows when files are waiting in the inbox and marks unencrypted files in the outbox in red. This is a property of USB file transfer on Android, not a choice, and it is documented in FLOWS.md.

6. Purchases

The app is distributed through third-party app stores. Your purchase is handled by the store, not by us: the store processes the payment and holds whatever data that requires, under its own privacy policy. We receive no payment details, no card number and no address from the store — only aggregate sales figures that identify nobody.

7. This website

This site serves static pages. It sets no cookies, embeds no analytics and loads no third-party fonts, scripts or trackers. Our hosting provider may keep standard server logs, including IP addresses, for operation and security; those are the provider's and are not used by us to build profiles.

8. Your rights under the GDPR

You have the right of access, rectification, erasure, restriction, objection and data portability regarding personal data a controller holds about you. Since we hold no personal data about users of the app, there is in practice nothing for us to retrieve, correct or delete — and that is the honest answer rather than a procedure.

If you contact us by email we hold that correspondence for as long as it takes to answer you. You may ask us to delete it. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or with the authority in your own country.

9. Children

The app is not directed at children and collects nothing from anyone, regardless of age.

10. Changes

If this policy changes, the effective date above changes with it and the previous version is superseded. Because the app collects nothing, a change here would mean a change in the app — and that would be stated in the release notes, not slipped into a policy page.