Privacy policy of the “RudelSafe” app

Last updated: 24 October 2026 · applies to the Android app RudelSafe (de.christiankempf.rudelsafe). The website is covered by the general privacy policy. In case of doubt the German version prevails.

In short: RudelSafe encrypts your documents on the phone and stores them encrypted in your own cloud storage – OneDrive or Nextcloud. Without your master password or your emergency kit nobody can open them – not even me. There is no account with me, no server and no advertising.

Draft note: RudelSafe is in development. Check this policy against the finished app before publishing (storage targets, scanner and text recognition, print service, any purchase) and declare the Google ML Kit details the same way in the Play Console data safety form. Remove this box afterwards.

1. Controller

2. Documents on your device

Each document, its details (title, category, date, deadlines) and the text recognised in it are encrypted on the phone (XChaCha20-Poly1305), each document with its own key. RudelSafe derives the account key from your master password (Argon2id); the master password is not stored and never leaves the device. The recovery key from the emergency kit is only shown during setup and is not transmitted. For full-text search the app keeps a search index in its protected storage on the device. Opened documents are decrypted in memory only. If you open a document with another app (“Open with …”), that app receives a short-lived decrypted copy.

3. Scanning and text recognition

For scanning RudelSafe uses the Google ML Kit document scanner provided on the device by Google Play services. The scanner operates the camera itself; RudelSafe only receives the finished result. Text in scans and images is recognised by ML Kit text recognition, which is included in the app; RudelSafe reads text from PDFs and Office files itself. Images and text are processed on the device and not transmitted to Google. From the recognised text RudelSafe suggests title, category, date and deadlines – by fixed rules on the device, without any AI service. Google states that ML Kit may send technical information such as device model, app name and performance data to Google to operate and improve the service. If you want to avoid this, import documents as files instead.

4. Storage in your OneDrive or Nextcloud

RudelSafe stores the encrypted documents and their encrypted index in a folder “RudelSafe” in the storage you choose:

• OneDrive: you sign in with your Microsoft account (login.microsoftonline.com); the files run via the Microsoft Graph interface (graph.microsoft.com). The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; Microsoft’s privacy statement applies.
• Nextcloud or WebDAV: RudelSafe connects directly to the server whose address you enter. With Nextcloud you sign in in the browser and RudelSafe receives an app password. The server’s operator – you or your provider – is responsible for it.

The provider sees no documents, titles or texts, only encrypted files and the technical details that come with any storage (account, file size, time, IP address). Sign-in tokens and app passwords are stored encrypted in the Android Keystore. If you also use RudelKey, both apps share the encrypted Rudel account in your storage. The legal basis is Art. 6(1)(b) GDPR.

5. Shared safes and emergency folder

A shared safe has its own key and its own folder in your storage, which RudelSafe shares with the members. The invitation (RUDELSAFE1-…) contains the sharing link and the key; you send it yourself by message – whoever has it can read the safe’s documents. RudelSafe stores your memberships encrypted in your personal safe. A safe’s emergency folder is encrypted like the documents; a PDF to print is only created when you trigger it, and then goes wherever you share it.

6. Import, sharing and printing

Files you pick via Android’s file picker or send from another app with “Share → RudelSafe” are read in and encrypted by RudelSafe; shared text becomes a text document. The originals stay unchanged where they were. With the “RudelSafe” print service you can file from any app: the printout is encrypted immediately with a key from the Android Keystore and waits until you unlock the app. The print service is only active if you switch it on in Android’s print settings.

7. Reminders

RudelSafe schedules reminders for deadlines as notifications on the device. The notification shows the document’s title; nothing goes to the internet for this.

8. Permissions

RudelSafe does not request camera or storage permission: the Google Play services scanner and Android’s file picker only give the app what you explicitly select.

9. No advertising, no analytics

RudelSafe contains no advertising, no analytics tools, no trackers and no crash reporting.

10. Retention and deletion

The data remains until you delete it in the app or uninstall the app; you delete the folder in OneDrive or Nextcloud there yourself. Android may include app data in your personal device backup if you have enabled this in the system settings; it stays encrypted there.

11. Your rights

As I receive no data from the app and cannot decrypt your documents, I cannot provide information about them or delete them; you are in control – on your device and in your storage. For questions, contact me at the address above. You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for me: the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.