Redact Privacy Policy

Redact is an open-source Android app, sold as a one-time purchase on Google Play, that strips hidden metadata, things like GPS location, device details, timestamps, and camera settings, out of your photos and videos. You can also peek at what's hidden inside a file before you share it, and convert between formats, all without anything ever leaving your phone.

This page explains, in plain language, exactly what Redact does (and doesn't do) with your information. Here's the short version: we built this app because we don't want your data, so we made sure it never collects any. Everything below walks through why that's true, including every permission the app asks for, every piece of outside code it uses, and the rights you have under privacy law, wherever you happen to be.

Privacy isn't a feature we bolted on, it's the reason Redact exists. We believe what's on your phone is yours, and that an app has no business watching what you do with it. That's why Redact has no analytics, no ads, no tracking, and no account, and why its code is public for anyone to check. A privacy tool that tracked its own users would defeat its whole purpose, and we'd never build one.

Redact is built and maintained by DoubleAngels, an independent developer based in the United States, not a data company, not an ad company, and not anyone running a server full of your photos. Wherever privacy law uses terms like "data controller", "business", or "personal information handler", that's DoubleAngels, for the opt-in diagnostics in Section 6, the order details Google Play shares when you buy the app, and any email you choose to send us. DoubleAngels also acts as Redact's privacy officer, the person to contact about anything in this policy.

We haven't appointed a representative in the EU or UK. Our only processing is occasional, limited to anonymous technical diagnostics you choose to send, and unlikely to put anyone at risk, which is the situation GDPR Article 27(2) exempts. You can always reach us directly at the address in Section 18.

You're welcome to reach out any time using the contact details in Section 18, read every line of the app's source code on GitHub, or even look back through this very policy's edit history, since it's published straight from that same public repository.

Here's the plain truth: Redact doesn't collect any of your personal information. There's no account, no sign-in, no sign-up form, and no server anywhere waiting to receive your photos, videos, or identity. You don't have to take our word for it either, the INTERNET permission is the only thing that lets the app talk to the network at all, and it's used for just two optional things: the crash reports in Section 6, and the update check described below, which runs only when you tap Check for Updates. The only other ways information about you reaches us are the limited order details Google Play shares when you buy Redact, explained below, and anything you choose to send us by email or on GitHub, covered in Section 18.

To be really specific, here's what Redact will never do.

• Upload your photos, videos, or any other file to a server, for any reason.
• Read, log, or send off the hidden metadata it scans or removes.
• Ask for your name, email address, phone number, or any kind of account ID.
• Use advertising identifiers, behavior tracking, or any ad software.
• Follow you across other apps or websites, or build a profile about you.

The only things Redact itself can ever send from your device are the optional, anonymous diagnostic data covered in Section 6, which only happens if you turn it on yourself, and the update check described below, which only happens when you tap its button.

When You Buy Redact

Redact is sold through Google Play, and Google handles the whole purchase: your payment method, billing address, receipts, taxes, and refunds, all under Google's Privacy Policy. We never see your card or payment details. Like every Play developer, we receive limited order details from Google, such as an order number, the date, the price, and the country or region of purchase, in our Google Play account. We use them only for accounting, taxes, and helping with refunds or purchase problems, never for marketing, and we don't combine them with anything else. Redact itself doesn't check your purchase or contact Google about it.

Checking for Updates

Settings has a Check for Updates button. Redact never checks on its own: only when you tap it does Redact send one request to GitHub, where its source code lives, asking for the version number of its newest release, and then tells you whether a newer one is out. The request carries nothing about you, your settings, or your files, only a fixed label naming the app, the same for everyone. Like any connection on the internet, GitHub sees the IP address the request comes from, and it handles that under the GitHub General Privacy Statement. We never receive it. The update itself always comes from Google Play.

Every Server Redact Connects To

There are only two, and Redact contacts neither unless you turn on or tap the feature that needs it.

Some buttons open a page in another app instead, which then makes its own connection under its own policy, and Redact itself sends nothing: Rate Redact on Google Play and Update open Google Play; View Source on GitHub, Report an Issue, and Project Page in Open-Source Licenses open GitHub or the Android developer site; Privacy Policy and Terms of Use open this site; Donate opens Stripe (Section 12); and Open in Maps in Scan, after you agree, hands a location to your maps app.

Categories of Data We Never Collect

Just to be thorough, here's a checklist of common data types and whether Redact collects them. The answer is the same for every one.

Android makes every app list its permissions up front, but just because a permission is listed doesn't mean it's used to collect anything about you. Here's exactly what each one does, and whether you actually need to grant it.

By default, Redact never asks for broad, standing access to your whole media library. On Android 13 and up, it mainly uses Android's own built-in file picker, which only hands over the exact files you choose. Everything else in your gallery stays out of sight, as far as the app is concerned.

You're always in control here. Head to Apps > Redact > Permissions in your phone's Settings any time to see what's been granted and take any of it back. Turning off an optional permission just disables the one feature that needed it. Everything else in Redact keeps working normally.

Redact can pop up a friendly notification when a job's progress updates or finishes, controlled by the Notifications setting, which starts off. These are made right there on your phone by the app itself. Nothing is being pushed in from some server out in the world.

There's no Firebase Cloud Messaging or any other push service involved here, we don't even have a server that could send you a push message, and Redact never registers a device token, push token, or advertising identifier for this or anything else. You can also mute or tweak Redact's notification channels any time from your phone's own Settings, separately from the toggle in the app.

Sentry is in Redact for one reason only: to find bugs and errors so we can fix them and make the app better for everyone. It isn't used for analytics, marketing, or tracking, and it never will be. We don't use it to learn who you are, what you do in the app, or what's in your files, only where the app broke or ran slowly.

If you ever want to help us catch bugs, Redact has an optional crash-reporting feature powered by a service called Sentry. It lives behind a single setting, Send Crash Reports, and it starts off. Until you switch it on yourself, nothing is sent anywhere, Sentry's SDK isn't even initialized.

If you do turn it on, here's everything we do to protect your privacy before anything leaves your phone.

• No personal info by default: we've explicitly turned off the SDK's default personal-data collection (sendDefaultPii = false), along with broad device-context collection and automatic breadcrumbs (the running trail of taps and screen changes most apps send with a crash).
• No user or install ID: Sentry's SDK normally tags every report with a random per-install ID. Redact removes it, so reports from the same phone can't be linked together, or back to you.
• No screenshots, ever: screenshot and screen-layout capture are disabled, so a crash can never grab an image of whatever was on your screen.
• Automatic scrubbing: before anything gets sent, our own filter strips out content:// and file:// paths, GPS coordinates, and file names from every message and error trace, even ones generated deep inside Android's own system code.
• Only pre-approved labels: diagnostic tags are limited to a short, reviewed list (things like operation_type or video_width), never open-ended text that could accidentally contain something personal.
• Your media stays untouched: Sentry never has access to the photos or videos you're working with, their contents, or the metadata inside them.

Exactly What Can Be Sent

With Send Crash Reports on, Redact can send these kinds of anonymous technical data, and nothing else.

• Crash and error reports: a scrubbed error trace, the app version, your device model, and Android version.
• App-not-responding reports: the same details, when the app freezes.
• Performance data: for about one in four app sessions, how long screens took to open, slow or frozen frame counts, and timing samples of the app's own code. This shows us where Redact is slow, not what you were doing.
• Diagnostic logs and counters: short, scrubbed messages and numbers the app records about its own operations, like how long a conversion took or which video formats it couldn't decode. Never how often you use Redact or what you choose in it.
• A note you choose to write: after an error, Redact may offer an Add Details button. If you type a note and tap Send, that text is attached to the report. File paths and GPS coordinates are removed from it, and it never asks for your name or email. Please don't include personal information in it.

Like any connection on the internet, Sentry's servers can see the IP address a report comes from while receiving it. Redact doesn't put your IP address in the report, and we don't use it to identify anyone.

Who Handles It and Where

Sentry (Functional Software, Inc.) receives and stores this data on our behalf as a service provider (a "processor" under GDPR), on servers in the United States, under its own Data Processing Addendum. Sentry keeps it for its standard retention period for our plan, currently 90 days for crash and error reports and 30 days for performance data and logs, and then deletes it automatically. See Sentry's data retention periods for details.

Because the data is anonymous, we can't find, show, or delete any one person's reports. Nothing in them tells us which reports came from you. If you want no more data sent, turn the setting off, it takes effect immediately, and the reports already sent expire on Sentry's schedule.

You're free to turn crash reporting back off whenever you like, and it stops instantly. Sentry's own handling is also covered by Sentry's Privacy Policy.

Like most apps, Redact is built using a handful of open-source libraries. Almost all of them simply run on your device and have no way to send anything anywhere. We've listed every one here anyway, in the spirit of full transparency, along with a link to each publisher's privacy policy where one exists.

To be crystal clear: no Firebase, no Google Analytics, no Google Play Services, no AdMob, no advertising or analytics library of any kind. If that ever changes in a future update, we'll update this table to match, and you can always double-check the current list yourself in the app's public build configuration.

Redact shows zero ads and contains zero advertising code, so there's genuinely nothing here to opt out of. We don't use the Android Advertising ID, we don't build profiles about your interests or behavior, and we don't share or sell anything to ad networks or data brokers, mostly because we never collect the data that would make any of that possible in the first place.

There are no cookies either, Redact is a real Android app, not a website, and it doesn't track you across other apps or sites. Nothing here makes automated decisions about you or profiles you in any meaningful way. Every single action, cleaning, scanning, converting, happens because you tapped a button, and nothing about how you use the app shapes any decision made about you.

By default, cleaned and converted files land in Pictures/Redact or Movies/Redact, right in your phone's regular photo library. They're ordinary files you can back up, move, or delete exactly like any other photo or video, and Redact never moves them anywhere else.

If you'd rather keep them somewhere else, Output Folders in Settings opens Android's own file browser so you can pick or create a folder for images and another for videos, on your phone's storage or an SD card. Android then lets Redact create files in that one folder, and only that folder: Redact uses this access to save your cleaned and converted copies there and nothing else, and it doesn't browse, change, or upload anything else in it. Reset to Default hands that access back to Android, and so does choosing a different folder. If the folder you picked is deleted or stops being available, Redact saves to the default folder instead and tells you so. Files already saved stay where they are either way.

When you share a file into Redact from another app, it quietly makes a cleaned temporary copy, hands it off to wherever you're sharing to, and then deletes it shortly after. Temporary copies are also overwritten once with random data before they're deleted, though modern phone storage limits how much that really adds. Clear Cache on Startup automatically clears out anything older than 24 hours, and you can always clear it by hand from Settings too.

Your Privacy Stats at the top of Settings, and the Statistics screen it opens, are counted right there on your phone: how many files Redact has cleaned, shared, and converted, how many metadata fields and locations it removed, which kinds of personal details those files carried, and how many files you cleaned on each of the last 30 days. They're plain numbers, never your files, their names, or what the metadata said. They live in Redact's private storage, are left out of backups and device transfers, and never go into crash reports. Clear Statistics sets every count back to zero, and uninstalling Redact removes them.

When You Uninstall Redact

Android keeps every app's private data in its own sandbox, so uninstalling Redact wipes all of it instantly, your settings, your statistics, including whether crash reporting was on, and anything left in the temporary cache. None of it gets backed up to the cloud first, since we've turned that off. The exception is your actual photos and videos: anything already saved to Pictures/Redact, Movies/Redact, or a folder you chose in Settings is yours, just like photos from your camera, and uninstalling the app won't touch them. Android also withdraws Redact's access to any folder you chose.

If you'd turned crash reporting on at some point, reports already sent stay in Sentry until they expire, as described in Section 6. Since they're anonymous, uninstalling can't remove them early, and neither can we.

Because everything happens locally and there's no account system or database anywhere, there's simply no central server holding your photos, videos, or personal information for anyone to break into. The only network connections Redact ever makes are the opt-in diagnostics from Section 6 and the update check you start from Settings (Section 3), and both are encrypted over HTTPS.

Redact also blocks all unencrypted network traffic outright (usesCleartextTraffic="false") and turns off Android's automatic app backup (allowBackup="false"), so nothing can be pulled out through a device backup. There's no password, PIN, or credential stored anywhere, since there's no account to begin with. And because the full source code is public, you don't have to take our word for any of this, anyone can go check for themselves.

No system is perfectly secure, and we can't guarantee that one never will be. If we learn of a security incident affecting information we're responsible for, we'll take reasonable steps to contain it and notify affected people and authorities where the law requires us to. Found a security problem in Redact? Please report it as described in our security policy.

This page, along with Redact's GitHub repository and its Google Play listing, links out to a few outside sites now and then, GitHub, Sentry, Google's own policies, that sort of thing. We don't control what happens on those sites, so we'd encourage you to take a look at their own privacy policies too.

The optional Donate link in Settings › About opens Stripe's website in your browser. Redact itself never sees or handles any payment details. If you choose to donate, Stripe processes the payment under Stripe's Privacy Policy, and we receive only what Stripe shares with recipients, such as the amount and the details you enter there, which we use only to keep records of donations.

Redact doesn't knowingly collect personal information from anyone, no matter their age. There's no account to make and no chat or social feature. The app isn't aimed at children, and its Google Play listing doesn't target kids. This is how we meet laws like the U.S. Children's Online Privacy Protection Act (COPPA), the GDPR's rules on children's consent, and the UK Age Appropriate Design Code: every feature starts with the most private setting, and nothing builds a profile of anyone.

The only ways a child could send us anything are by typing it into the optional crash-report note, or by emailing us. If you're a parent or guardian and believe your child under 13 (or under the age of digital consent where you live, up to 16 in parts of the EU) has sent us personal information, contact us using the details in Section 18 and we'll delete any of it we can find. Anonymous crash notes can't be traced to a person, so please tell us roughly what was written and when.

Some web browsers send a "Do Not Track" signal to websites. Since Redact is a phone app rather than a website, it has no way to even receive that signal, and there's no tracking going on for it to switch off anyway. If you've turned on optional crash reporting, switching it back off in Settings does the same job, it stops any further data in its tracks right away.

Legal Basis for Processing (GDPR)

Wherever the GDPR or a similar law applies, sending optional diagnostic data to Sentry is based entirely on your consent (GDPR Article 6(1)(a)), given the moment you switch on Send Crash Reports. You can withdraw that consent at any time by switching it off again, which stops any further processing immediately. It doesn't retroactively affect the lawfulness of anything already sent before you withdrew it.

If you email us, we use what you send only to read and answer your message and keep a record of the conversation. That's based on our legitimate interest in running and supporting the app (Article 6(1)(f)), or on taking steps you asked for.

We keep the order details Google Play shares with us because tax and accounting laws require it (Article 6(1)(c)), and to handle refunds and purchase problems (Article 6(1)(b)).

European Economic Area, UK, and Switzerland (GDPR)

If you're in the EEA, UK, or Switzerland, data protection law gives you the right to access, correct, delete, restrict, or move your personal data, and to object to how it's used. Since Redact doesn't collect or process your personal data in the first place, most of these rights simply won't have anything to act on, there's nothing sitting around to request. If you think some data about you has reached us anyway, say, through an email you sent, just get in touch and we'll sort it out quickly.

Crash diagnostics are a special case. They contain nothing that identifies you, so we have no way to tell which reports, if any, are yours. Under GDPR Article 11, we aren't required to collect extra information just to identify you, which means requests to access or delete specific crash reports can't be fulfilled. You can still stop all future reports by turning the setting off.

Right to Complain

If you think we've mishandled your data, please tell us first so we can try to fix it. You also have the right to complain to a data protection authority, for example the authority in your EU country of residence, the UK Information Commissioner's Office (ICO), the Swiss Federal Data Protection and Information Commissioner (FDPIC), or your local equivalent listed below. In the United States, you can contact your state attorney general or the Federal Trade Commission.

International Data Transfers

If you turn on crash reporting, that limited diagnostic data from Section 6 might be processed by Sentry (Functional Software, Inc.) on servers outside your own country, including in the United States. This only ever happens if you've opted in, and it only ever covers that same scrubbed technical data, never your photos, videos, or identity. Sentry protects transfers like this under its Data Processing Addendum, which includes the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents. If you tap Check for Updates, your request goes to GitHub in the United States, carrying nothing but the fixed request itself and, as with any connection, your IP address (Section 3). If you email us, your message is handled by our email providers, which may also store it in the United States. Turning on crash reporting is your explicit consent to this transfer, including where a law like China's PIPL requires separate consent for sending data abroad.

California (CCPA/CPRA)

Redact doesn't sell or share personal information, and in the normal course of running the app, it doesn't collect personal information as California law defines it either. So there's simply no sale or sharing for you to opt out of. DoubleAngels is an independent developer and doesn't meet the size thresholds that make the CCPA apply, but we're giving you the same disclosures and honoring the same rights voluntarily. Here's the formal category-by-category breakdown California law describes.

Other U.S. State Privacy Laws

States like Virginia, Colorado, Connecticut, and Utah have their own privacy laws giving residents similar rights, to access, delete, correct, or move their data, and to opt out of having it sold, used for targeted ads, or profiled. Since Redact doesn't do any of those things, these rights won't have much to act on while you're just using the app normally. If you're in one of these states and still have questions, reach out using the details below, we're happy to help.

Other Countries

Many other countries give you similar rights, to know what data is held about you, get a copy, correct it, delete it, withdraw consent, and complain to a regulator. These include Brazil (LGPD, regulator ANPD), Canada (PIPEDA and Quebec's Law 25, regulator the Office of the Privacy Commissioner), Australia (Privacy Act, OAIC), New Zealand (Privacy Act 2020), Japan (APPI, Personal Information Protection Commission), South Korea (PIPA, Personal Information Protection Commission), China (PIPL), Taiwan (PDPA), India (DPDP Act, Data Protection Board), Singapore (PDPA), South Africa (POPIA, Information Regulator), Türkiye (KVKK), and the UAE, Saudi Arabia, and others. Everything in this policy applies to you wherever you live, and you can use any of these rights by emailing us. The same limit applies everywhere: anonymous crash diagnostics can't be traced back to you.

For Japan, Korea, and other countries that ask about data sent abroad: the only data that leaves your phone is the opt-in diagnostics, sent to Sentry in the United States as described in Section 6, and the update check you start yourself, sent to GitHub in the United States as described in Section 3. The United States has no single national privacy law equivalent to yours, which is why we keep that data anonymous and protected by Sentry's contractual safeguards.

How We Handle Requests

We'll answer genuine privacy requests within the time the law that applies to you allows, usually 30 days (45 days under U.S. state laws), and tell you if we need more time where the law permits an extension. Requests are free. We may decline requests that are manifestly unfounded, excessive, or that we can't verify, and we'll tell you why when we do.

Right to Appeal

If we deny a privacy request you've made, most state privacy laws also give you the right to appeal that decision. Email us and ask for a second look, we'll have someone review it fresh.

Non-Discrimination

Exercising any right described in this section never results in different treatment, a locked account, or reduced functionality. Redact works the same for everyone, rights requests included.

Global Privacy Control

Redact doesn't have a website with a cookie banner or ad-tech opt-out panel. If you ever reach a Redact-related webpage from a browser broadcasting the Global Privacy Control (GPC) signal, we'll honor it as a request to opt out of the sale or sharing of personal information, though since we don't sell or share personal information to begin with, there's nothing for that signal to actually change.

California "Shine the Light"

California's Shine the Light law (Cal. Civ. Code §1798.83) lets residents ask what personal information a company has shared with third parties for those third parties' own direct marketing in the past year. Redact has nothing to disclose here either, we don't share your information with anyone for their marketing purposes.

Verifying a Request

Redact doesn't have user accounts, so we can't verify you against a login. Instead, we'll ask enough questions over email to reasonably confirm we're responding to the right person, and to confirm an authorized agent is actually acting on your behalf if one contacts us for you.

We'll update this policy now and then, say, when a dependency changes or a new optional feature shows up. Whenever that happens, you'll see a fresh "Last updated" date at the top of this page. It's worth a glance every so often, especially before turning on optional features like crash reporting.

If a change would let Redact collect new kinds of data, or use data in a new way, we'll mention it in the app's release notes, and we'll never start sending any new data without asking for your consent first. Every earlier version of this policy is kept in its public edit history.

This policy was last updated on November 14, 2026.

This policy is written in English. If we or anyone else provide a translation, it's for convenience only, and the English version is the one that applies if they differ, unless the law where you live says otherwise.

Your use of Redact is also covered by our Terms of Use, which explain how the app is provided and the limits of our responsibility.

Got a question, some feedback, or a privacy request? Send it to jzgm2llm@addy.io, or open an issue on GitHub. These are the only two channels we monitor.

Our email address is a forwarding alias run by addy.io, which passes messages on to our inbox. GitHub issues are public, so never post personal information, private photos, or anything you wouldn't want the world to see there. Use email for anything private.

Redact is made and maintained by one independent developer. We'll always handle privacy requests as the law requires. Help with anything else, like bug reports, questions, and feature requests, is offered in good faith and at our discretion. We can't promise a reply to messages that are vague, empty, abusive, or sent through any other channel.