Privacy Policy

1. Scope and developer

This Privacy Policy applies to the Notification Vault Archive Android application, package app.nva.archive, and to this public policy webpage. The application is provided by Ivan Baranov (the “developer”, “we” or “us”).

The application is local-first. It does not require an account, developer-operated backend or cloud service. Because the developer does not receive your local archive, we cannot view, retrieve or remotely delete it for you.

2. Data processed on your device

Depending on your choices and the data Android delivers, the app can process:

• notification source and application identity, package name, channel, category, timestamps, sender and conversation labels, notification flags and technical identifiers;
• notification title, text, expanded text, summary, subtext and message text when the selected source privacy mode permits content storage;
• archive actions and state, including read and pinned state, tags, notes, local searches, categories, groups, corrections and local organization rules;
• privacy, retention, theme, language, accessibility, lock and backup preferences;
• locally derived search-index entries, bounded classifier results, maintenance state, backup history and redacted diagnostic counters.

The app uses Android’s biometric or device-credential prompt only as an optional foreground UI lock. The application does not receive or store your biometric template.

3. Why the data is processed

The app processes local data only to provide the functions you request:

• capture and display a notification archive;
• search, filter, organize, tag, annotate and categorize archived records;
• apply your per-source privacy choices and global retention policy;
• maintain the encrypted database and recover safely after ordinary lifecycle events;
• create, verify and restore an encrypted backup after explicit user actions;
• show local status and create an explicitly requested redacted diagnostic report.

The data is not used for advertising, tracking, profiling for third parties or cloud AI.

4. Source privacy modes

You control how newly captured data from each source is retained:

• Full content: permitted notification content is stored, indexed and displayed.
• Hidden preview: permitted content remains available in encrypted storage and search, while previews are concealed on list surfaces.
• Metadata only: the app does not store or index notification titles, bodies, expanded text, summaries, subtext or message text. It may retain source and package identity, channel and category, timestamps, sender and conversation labels, tags, notes and technical flags in encrypted local storage.

Confirming a change to Metadata only removes disallowed historical content through a durable local purge. During that process, the app excludes the prohibited content from UI, search and backup rather than treating an incomplete purge as successful.

5. Android access and permissions

• Notification access is optional Android special access. If you grant it, the system can deliver new notifications from other applications to the local listener, including while the NVA interface is not open. Denying or revoking access leaves the existing archive available but stops new capture.
• Receive boot completed is used only to resume bounded local lifecycle and maintenance work after a device restart.
• Document access uses Android’s document picker, or the approved local Downloads flow, only when you explicitly create or restore an encrypted backup. The app requests no broad storage permission.

The app requests no Android INTERNET permission and contains no application network client. Android and the device vendor control which notifications are delivered and when the listener can run; the app cannot recover notifications that the operating system never delivered.

6. Storage and security

App-owned archive data and the full-text search index share an encrypted SQLCipher storage domain. The database key is protected with Android Keystore material. Android Auto Backup and device-to- device transfer are disabled for app-owned data. The app does not create a plaintext copy of the full archive, database, search index or portable backup.

These controls reduce ordinary local exposure and help protect a copied database, but no mobile application can promise absolute security. Root access, a compromised operating system or firmware, malicious code with equivalent privileges, physical access to an already unlocked device and forensic recovery outside the app’s control are outside the protection offered by the app. Foreground UI lock does not stop the Android notification-listener process from operating in the background.

7. Collection, sharing and third parties

The developer does not collect your notification content, local searches, tags, notes, archive state, classifier inputs, backup secrets or diagnostic data. The developer does not share that data with third parties. The application has no account, advertising SDK, analytics SDK, tracker, telemetry or remote crash-reporting SDK.

Android, source applications, keyboards, accessibility services and other software on your device operate under their own policies. A value you explicitly copy enters the Android clipboard, which is a system surface outside NVA’s exclusive control.

8. Encrypted backup and document providers

A full portable backup is created only after your explicit action and is always an authenticated, encrypted .nva file. On supported newer Android versions the default destination is a local Downloads location; on other supported flows, Android lets you choose a document provider. The app does not silently select or contact a provider and does not create a plaintext backup.

A provider you select may store or synchronize the encrypted file according to that provider’s own terms and privacy policy. The file remains encrypted, but the provider can observe file-level metadata and controls its own infrastructure. Delete an external backup through the destination or provider that holds it; deleting app data does not automatically delete copies outside app-owned storage.

9. Retention and deletion

The default global retention period is one year. You can choose 30 days, 90 days, one year or Forever. Pinned records are not removed automatically by retention. “Forever” means until you delete the data, uninstall the app or device/storage conditions remove it.

In-app controls let you delete an individual record, all data for a source or all app-owned data. Delete all removes app-owned archive data and keys through the local flow. Android ordinarily removes app-owned storage when the app is uninstalled. Encrypted .nva files saved outside app-owned storage remain under your control and must be deleted separately.

Deletion removes the data from the app’s active ownership and access paths. It does not promise physical overwriting of flash cells, operating-system snapshots, provider copies or forensic remnants on a compromised device.

10. Diagnostics and support

Diagnostics remain local unless you explicitly export and share a redacted report. The report is allowlisted to exclude notification content, senders, notes, searches, keys, passphrases, nonces and full file paths. Never send the developer your raw database, notification archive, backup passphrase, recovery key or unrestricted device dump.

If you choose to contact us by email, your email service sends the address, message and any attachment you select to the developer’s email provider. We use that voluntary communication only to answer the request, investigate a reported security/support issue and meet applicable legal obligations. It is retained only as reasonably necessary for those purposes and is not sold or used for advertising. You may ask us to delete a support conversation, subject to security-record and legal-retention requirements. This email is sent by your mail service, not by NVA or this static webpage.

11. This policy website

This static page is hosted on Cloudflare Pages. The published package includes no JavaScript, form, application cookie, analytics beacon, third-party font, remote image or local browser storage. Cloudflare processes ordinary request and security metadata, such as IP address, connection and user-agent information, to deliver and protect the webpage under Cloudflare’s Privacy Policy. Website request metadata is separate from your NVA notification archive, which the app does not transmit to this site.

12. Children

Notification Vault Archive is a general-audience productivity application and is not designed or directed to children. Notification access can expose sensitive communications, so a parent or guardian should control whether a minor is permitted to use the app where applicable.

13. Changes to this policy

We may update this policy when the application, legal obligations or developer identity changes. A revised page will show a new effective date. Material changes to app data practices will also be reflected in the application and Google Play disclosures before the affected release is published.

14. Contact

For deletion of data stored by the app, use the in-app item, source or Delete all controls. The developer cannot remotely access or delete data that remains only on your device or in a document provider you selected.