This policy covers the FileYard website, the FileYard server, and the FileYard client apps (including the Android app and the Windows, macOS and Linux desktop clients). It is a draft and should be reviewed against the released software before publication.
The short version
- The FileYard project does not run a hosted service for your files and does not receive them.
- The apps talk only to the FileYard server address you enter.
- The apps contain no advertising and no third-party analytics or tracking SDKs.
- Whoever operates your server controls the data on it.
Who is responsible for your data
FileYard is software you install yourself. The operator of your server (you, or another person or organization that gave you an account) is the data controller for the files, accounts, logs and backups on that server. Their privacy practices, not this policy, govern that data. Ask them if you need to know how long data is kept or who can see it.
The website
This website is static. It does not use cookies, advertising, analytics scripts or third-party trackers. The only thing stored in your browser is your light/dark theme choice (localStorage, key fileyard-theme), which never leaves your device.
Our hosting provider may keep standard server logs (such as IP address, requested page and timestamp) for security and operations.
The Android app
What it stores on your device
- The server URL you enter.
- Authentication tokens issued by your server, so you stay signed in. Revoke them from your server at any time.
- Cached file listings, thumbnails or downloaded files, so the app works faster or offline.
- App settings, such as upload preferences.
What it sends, and where
The app sends your credentials, file metadata, file contents and device details needed for requests (such as an app or device name for the token) only to the server you configured. It does not send this data to the FileYard project or to any third party.
Permissions
The app asks only for access it needs for features you use. Typical permissions are:
- Network access — to reach your server.
- Photos, media and storage — to choose files to upload, save downloads, or upload camera photos if you enable that feature.
- Camera — only if you use the app to take a photo or scan a code for upload or sign-in, where offered.
- Notifications and background work — to show transfer progress and run uploads you started or scheduled.
You can revoke any permission in Android settings; features that need it will stop working.
What the app does not do
It does not collect contacts, SMS, call logs or precise location, show ads, sell data, or build advertising profiles.
Desktop clients
The Windows (alpha), macOS and Linux sync clients follow the same model: they store your server URL, tokens and sync state locally and communicate only with your server. Alpha software may write additional diagnostic logs locally; these stay on your device unless you choose to share them.
The server
The server stores what the operator configures it to: files and folders, version history, user accounts, hashed passwords (Argon2id), two-factor settings, scoped tokens, share links, and audit and access logs that may include usernames, IP addresses, user agents and actions taken. Optional features can involve other parties the operator chooses, such as an SMTP provider for email or an OIDC identity provider for sign-in. The FileYard project receives none of this.
Sharing, retention and deletion
We do not sell or share your data, because we do not have it. Data on a server is kept until the operator or you delete it, and may persist in the operator’s backups. To delete your data, remove it in the app or web interface, sign out and revoke the device token, or ask your server operator to delete your account. Uninstalling the app removes locally stored app data from the device.
Security
See Security for how authentication, permissions and file handling work. FileYard is early software and has not had an independent security audit; use HTTPS for any server reachable beyond a trusted network.
Children
FileYard is not directed at children. Because accounts are created by server operators, any use by a minor is the operator’s responsibility.
Your rights
Depending on where you live (for example under the GDPR), you may have rights to access, correct, delete or export your personal data. Because the server operator holds the data, send those requests to them. For questions about this policy or the website, a project contact address will be published with the source repository.
Changes
If the apps’ data handling changes, for example by adding crash reporting or optional telemetry, this policy will be updated first and the change will be described in release notes. The date at the top shows the latest revision.