Privacy Policy for SoloBook

SoloBook is published by RaadCraft Solutions, a software engineering studio based in Chattogram, Bangladesh. In this policy, "we," "us," and "our" refer to RaadCraft Solutions, and "the app" refers to the SoloBook mobile app for Android.

This policy applies exclusively to the SoloBook app. It does not govern other products we publish or the third-party services mentioned herein, which operate under their respective privacy policies. You may contact us regarding this policy at support@raadcraft.com.

SoloBook offers an optional lock: a 4 to 6 digit PIN, with biometric unlock if you enable it. The lock controls access to the app's interface and works separately from the database encryption described above.

PIN and Recovery Answer

Stored only as hashes in the device's secure storage. They are never included in backups and never transmitted.

Biometric Unlock

Handled by Android's system prompt. SoloBook never receives or stores your fingerprint, face, or other biometric data; it only learns whether the system confirmed a match.

Lockout

Five wrong PINs start a lockout that doubles with each further failure, up to five minutes. Attempts to recover a forgotten PIN follow the same schedule.

Privacy Cover

SoloBook hides journal content whenever the app becomes inactive, to keep it out of the recent-apps preview.

SoloBook allows you to create an encrypted backup of your journal. This feature is entirely optional, available to all users at no cost, and only runs when you request it or switch on daily backup.

A backup contains your entries, factors, the photos attached to your entries, and portable appearance and reminder preferences. SoloBook encrypts it on your device with AES-256-GCM, under a key derived from your passphrase with scrypt and a separate key derived for each file. Your journal content and the number of records it holds are encrypted; the readable header contains only non-sensitive metadata (format, app and schema versions, creation time, algorithm settings, salts, and nonce material). File names, creation times, and file sizes remain visible to whoever stores the file.

A complete backup file is limited to 1 GiB, and the records inside it to 32 MiB.

Your Passphrase

Only your passphrase can unlock your backup. We never store or transmit it. So that daily backup can run without asking again, the app keeps a key derived from it, with its salt, in the device's protected secure storage.

Passphrase Recovery

Because SoloBook never stores your passphrase and cannot reset it, losing it means permanently losing access to your backup. The file cannot be decrypted without it.

Passphrase Length

While passphrases of four to six characters are permitted, doing so triggers a security warning: short passphrases are significantly more vulnerable to offline guessing by anyone who obtains the file.

Updating Passphrases

Changing your passphrase applies only to future backups. Previously created files are not retroactively re-encrypted and will still require the original passphrase used at the time of creation.

For security reasons, backups strictly exclude the following:

• The encryption key protecting your local journal database
• The key derived from your backup passphrase
• Your PIN and recovery answer
• Premium entitlement or purchase status
• Google Drive connection details and authorization state
• Backup configuration, onboarding status, and app metadata
• Operating-system notification identifiers

Because a backup never contains the device's database key, it can be restored with its own passphrase even if that key is lost.

You may direct backups to a folder on your device or to Google Drive. For device backups, you select a folder on internal storage, an SD card, or attached USB storage using Android's system folder picker; cloud document providers are not accepted for this option. SoloBook keeps access to that one folder so later backups do not need the picker again, never requests broad device storage permissions, and sends nothing over a network for this destination.

After each successful backup, SoloBook keeps only the newest file in that folder that matches its exact backup naming convention, and removes older matching files along with any incomplete copies it left behind. This includes SoloBook backups made on another device, so move a copy to a different folder if you want to keep it. Files that do not match are left untouched, but because a matching name is not proof that SoloBook created the file, do not rename unrelated files to resemble SoloBook backups. Clearing the saved folder in the app releases its access and turns off daily backup for that destination; it does not delete backups already saved there.

Daily backup is an optional, separate setting for the selected destination. It is not a scheduled background task: the app checks when you launch it or return to it, once 24 hours have passed, and waits at least an hour before retrying a failed attempt. It skips an unchanged journal only when the previous backup at that destination still exists. Daily backups to Google Drive use any available network, including mobile data, and backups with many photos can use substantial data, storage, and time. Changing your backup destination turns daily backup off until you switch it on again.

Restoring from a backup replaces the entire journal in the app. The process authenticates the file, validates every record and relationship, and prepares the photos before showing you a preview. Because the replacement cannot be undone, it requires two confirmations and a ten-second final delay. A restore turns the app lock and biometric unlock off, so set your lock up again afterwards; reminders may need notification permission on a new device.

If you opt to use Google Drive for backups, the app requests a single restricted scope. It allows SoloBook to view and manage only the files it creates, or that you explicitly select for it; it cannot access the rest of your Drive.

Requested scope

https://www.googleapis.com/auth/drive.file

Backups are uploaded to a visible "SoloBook Backups" folder. Each file is fully encrypted prior to upload, meaning neither Google nor SoloBook can read its contents. Data is transmitted directly between your device and Google over HTTPS, and passes through no server of ours - we operate none.

The app locally stores the connected Google email address to display connection status, alongside a folder ID hint. It does not request offline access or a server authorization code, and does not store access or refresh tokens. The Google sign-in library manages the session.

Upon successful upload, the app keeps only the newest SoloBook backup in that folder - including backups made on another device - and removes older ones. You may disconnect Google Drive at any time from the backup screen, which ends the app's access and turns off daily Drive backup but leaves existing backups in your Drive untouched.

The free version of SoloBook shows ads from Google AdMob. To select, deliver, and measure these ads, the Google Mobile Ads SDK may process the following data:

• Your device's advertising identifier and app set ID
• Approximate location derived from your IP address
• Device and app metadata (e.g., model, OS version, app version)
• Diagnostic metrics (e.g., app launch time, hang rate, energy usage)
• Ad interaction data (e.g., impressions, clicks, load failures)

Google utilizes this data for advertising personalization, analytics, and fraud prevention in accordance with its published disclosures. Your journal is strictly isolated: entries, moods, factors, photos, and keywords are never sent to AdMob, used for targeting, or included in ad requests. SoloBook caps all ad content at a Teen (T) rating.

Advertisements are fulfilled by Google and select third-party ad technology providers. These providers act as independent data controllers under their own respective privacy policies:

• Google Privacy Policy
• How Google uses information from sites or apps that use its services
• Ad technology providers in AdMob

In jurisdictions where required by law (including the EEA, UK, and Switzerland), SoloBook uses Google's User Messaging Platform to request your consent before any ad is requested. You may choose to allow or decline personalized advertising.

SoloBook requests an ad only when Google's consent tools allow it. Depending on your choices and where you live, you may see personalized ads, ads selected from contextual signals rather than a profile built about you, or no ads at all. Either way, no app feature or functionality is restricted.

Wherever that consent message applies to you, the app's Settings keep an "Ad Privacy Choices" entry that reopens it, so you may withdraw or modify your consent at any time. It remains available after a premium upgrade, even though you no longer see ads. You may also reset or delete your device's advertising identifier through your Android system settings (Settings › Google › All services › Ads).

SoloBook offers monthly and yearly subscriptions and a one-time lifetime purchase. Each one removes ads and nothing else: every feature of the app is free on every plan. All financial transactions are processed securely by Google Play Billing.

We do not collect, process, or store your payment details, billing address, or Google account credentials. The app receives only the entitlement status it needs in order to switch ads off, verifies it on your device - we operate no purchase server - and stores that status on your device.

For premium users the ads SDK is never started, although Google's consent-status check may still run so that your ad privacy choices remain available. Premium does not stop the app from contacting Google Play to confirm your purchase, or from using the network for an optional Google Drive backup.

Subscriptions are managed entirely through the Google Play Store, and refunds are governed by Google Play's refund policies:

• Manage Google Play Subscriptions
• Google Play Refund Policy

Notifications

Required for your daily journaling reminder and an occasional backup reminder, all scheduled on the device. SoloBook does not use remote push tokens or notification servers, and does not request exact-alarm or battery-optimization exemptions, so a reminder may arrive a few minutes after its scheduled time.

Biometrics (Optional)

Used only if you turn on biometric unlock. Android performs the check and tells SoloBook whether it succeeded; no biometric data reaches the app.

Photos (Optional)

Photos are chosen through Android's photo picker, which gives SoloBook only the images you select - never your whole gallery. Each selected photo is copied, resized, and encrypted; the original is left untouched.

Directory Access (Optional)

Required only if utilizing device-folder backups. Android restricts SoloBook's access solely to the single user-designated backup folder.

Network Access

Utilized exclusively to request advertisements, verify premium purchases, and upload or download Google Drive backups. It is never used to transmit your journal to our servers.

Camera and Microphone

Not requested. SoloBook blocks both permissions, so it cannot use your camera or record audio.

Permissions may be revoked at any time via your Android device settings. Revoking a permission never locks you out of your journal, although reminders stop if notifications are turned off.

We do not sell personal information. Because we do not collect your journal, we cannot and do not share it. Data is only processed directly from the app by the following three services:

Google may share advertising data with select third-party ad technology providers to facilitate the bidding and delivery of ads. No other advertising, analytics, or crash-reporting SDKs are integrated into SoloBook.

We may disclose information we possess if legally compelled by law enforcement or regulatory authorities. However, because we operate no backend and therefore collect and store no user data or journal content, there is functionally no personal data available for us to disclose.

Because your journal is stored only on your device, data retention is entirely under your control. You may delete your data via the following methods:

• Deleting individual entries directly within the app; their attached photos are deleted with them.
• Using the "Reset All Data" function in Settings, which permanently erases the journal on the device, photos included.
• Uninstalling SoloBook, after which Android removes the app's local storage.
• Manually deleting backup files from the folder you chose or from Google Drive.

Resetting app data clears the journal, the device backup key, and the backup configuration, which consequently disables daily backup. A reset does not affect previously exported backup files; those files remain under your control and require your original passphrase to decrypt.

Data processed by Google for advertising and purchases is retained according to Google's data retention policies. You may reset your device advertising identifier at any time via Android settings.

Depending on your jurisdiction (such as under the GDPR, UK GDPR, CCPA, or Swiss data protection laws), you may possess specific rights regarding your personal data. SoloBook is designed to allow you to exercise these rights directly on your device:

• Access, correct, or erase your entries directly within the app interface.
• Export an encrypted copy of your journal at any time without requiring our intervention.
• Withdraw or modify your advertising consent via Ad Privacy Choices in the app's Settings.
• Reset or delete your advertising identifier globally via Android device settings.
• Submit data subject requests directly to Google regarding advertising and purchase data.
• Object to or restrict processing, or request portability, by writing to us.
• Lodge a complaint with your local data protection supervisory authority.

Because we do not collect, transmit, or store your journal, we cannot fulfill requests to produce copies of data we do not possess. Our legal basis for processing limited data (such as identifiers for AdMob) relies on your consent where required, and our legitimate interest in maintaining and funding the application.

Google operates globally, so the advertising and purchase data it receives may be processed outside your country, including in the United States, under the transfer safeguards described in Google's own privacy policy. We transfer nothing ourselves, because we receive nothing.

Notice for California Residents: Displaying personalized ads via AdMob may constitute the "sharing" of personal information for cross-context behavioral advertising under the CCPA, despite no direct financial exchange or journal content being involved. You may opt out of personalized advertising by resetting or deleting your advertising identifier in your device settings.

SoloBook is intended for people aged 13 and older. The application is not directed at children under 13, who should not use it.

Standard privacy policies usually state they do not knowingly collect personal information from children. We go further: we do not collect personal information from anyone, at any age. Because the app has no accounts, no sign-up process, and no backend servers, nothing you write ever reaches us. There is no store of children's data for us to hold, disclose, or delete, because there is no store of anyone's data.

SoloBook does not ask for your age, so it sends no age or child-directed signal to the Google Mobile Ads SDK, and it caps all ad content at a Teen (T) rating. If you are below the age at which you can consent to personalized advertising where you live, ask a parent or guardian before accepting it in the consent message.

If you believe we have inadvertently received personal information about a child under 13 (for example, through direct email correspondence rather than the app), please contact support@raadcraft.com, and we will promptly delete it.

SoloBook mitigates security risks primarily through data minimization: because we do not collect your journal, there are no remote accounts to compromise or backend databases to breach. The journal and its photos are encrypted at rest.

Encrypted Storage

Entries, moods, factors, photo references, and the search index are stored within a SQLCipher database protected by AES-256 encryption. An installed build stops rather than fall back to an unencrypted database.

Encrypted Photos

Attached photos are stored as separate files sealed with AES-256-GCM, each under its own key derived from the database key, and are decrypted only in memory while displayed.

Keystore-Backed Encryption Key

The 256-bit encryption key is generated on your device and held in platform-protected secure storage, backed by the Android Keystore. This key never leaves the device and is never transmitted.

System Backup Exclusion

SoloBook explicitly opts out of Android's Auto Backup service, so the operating system does not copy your journal into your Google account. The only copy that leaves the device is a backup you create yourself.

Manual Backup Security

User-initiated backups utilize a separate cryptographic lineage. Files are sealed using AES-256-GCM under a scrypt-derived key, with a fresh key for each file, ensuring that tampered or truncated files fail authentication before anything is restored.

If the local encryption key is lost (e.g., due to a factory reset), the existing journal cannot be decrypted by anyone, including our team. The app can then reset its storage and start fresh; recovering your entries is only possible using an exported backup file and your original passphrase.

While we employ robust encryption, no method of electronic storage or local device operation is completely immune to compromise. We cannot guarantee absolute security against malware or unauthorized physical access to an unlocked device.

We reserve the right to update or modify this Privacy Policy to reflect changes in functionality or legal requirements. The "Last updated" date at the top of this document indicates the effective date of the current revision.

Material changes to our data practices will be communicated within the application or via the Google Play Store listing prior to implementation. If a change requires explicit user consent, we will request it natively within the app.

If you have questions, privacy requests, or concerns regarding this Privacy Policy, including inquiries from regulators or application store reviewers - please contact us using the details below:

Email

support@raadcraft.com

Publisher

RaadCraft Solutions

D-U-N-S® Number

73-223-6807

We strive to respond to all inquiries within one business day.