Last updated:
Summary
- BrainySync keeps your phone's contacts and calendars in step with a CalDAV and CardDAV server you choose, and can back up your data and chosen folders to a WebDAV server you choose. It connects only to the servers you add, and only over https.
- We do not run a sync server and we do not receive your contacts, calendars, files, passwords or usage counts. The app has no analytics or crash reporting that sends anything to us or to anyone else.
- Your server passwords and sign-in tokens are encrypted on the phone with a key protected by the Android Keystore. The app's local copy of your contacts and events is not encrypted by the app.
What the app collects
The app keeps the following, on your phone only:
- Your accounts. For each server: its address, your user name, and which calendars and address books you chose to sync.
- Passwords and sign-in tokens. Stored encrypted (see below). Android's account list holds the account names but not the passwords.
- Contacts and calendar events from the accounts you sync. They are written into your phone's Contacts and Calendar under a BrainySync account. The app also keeps its own copy of each item to track changes.
- Backups, if you make them: zip files of your contacts and events, kept in the app's private storage (the newest few are kept).
- WebDAV folders you add, so they can appear in your Files app: the address, user name and the free space the server reported.
- Certificates you chose to trust for a server that uses its own certificate.
- Usage counts. The app counts how often each feature runs, such as a sync or a backup, with a time and a random session number. You can see them under Usage counts.
- Logs and a diagnostics report. The app writes logs that mask sensitive values. Detailed logging turns itself off after a few hours. A diagnostics report is created only when you ask for one.
Encryption on the phone.
- Passwords for your accounts, your backup server and your WebDAV folders, and sign-in tokens, are encrypted with AES-256-GCM (Advanced Encryption Standard, Galois/Counter Mode). The key stays inside the Android Keystore and cannot be exported.
- The app's database (accounts without passwords, its copy of contacts and events, usage counts), backup zip files, logs and settings are not encrypted by the app.
- Contacts and events written into the phone's Contacts and Calendar are stored by Android, not by BrainySync.
Where it goes
On your phone
- Your contacts and events, in Android's Contacts and Calendar, under BrainySync's accounts.
Your own server
- Sync. BrainySync sends and receives contacts (vCard) and events (iCalendar) with the CalDAV/CardDAV server you add. Changes go both ways. If an item changed in both places, the server's version wins.
- Sign-in. Your user name and password, or a sign-in token, go only to the server you added. You can also sign in through your server's web page in your browser, or with your server's own sign-in service, if it offers one.
- Finding your server. When you type an email address or a domain, the app looks up public DNS (Domain Name System) records for that domain to find its calendar and contact service, using your phone's normal DNS settings. It asks you to confirm if the answer points to a different server.
- Backups. If you set a WebDAV backup destination, the app uploads backup zips of your contacts and events there. If you pick folders to back up, such as your camera folder, it copies those files to the same destination. Photos keep the place they were taken, because the app asks Android for the original files. Removing a file from the phone does not remove it from the backup.
- WebDAV folders. Folders you add can be browsed from your Files app. In this version they are read-only.
- Server push. If you turn on push and your server supports it, the app registers with your server so it can be told about changes right away. The server delivers those notices through the push app you chose on your phone. Notices are encrypted for this phone.
- Contact photos. If a contact on your server points to a photo at another web address, the app may download that photo over https. It does not send your user name or password to that address.
A third-party service you choose
- The server-check screen offers ready-made addresses for a few calendar and contact providers. Choosing one only fills in the address. Data goes to that provider only if you add an account with it.
Things that leave only when you send them. Backup files, logs, the run log and the diagnostics report leave the phone only through Android's share sheet, to an app you pick. The diagnostics report lists your account names and server addresses, your phone model and Android version, and usage counts. It does not include passwords, contacts or events.
The app does not check for updates and does not connect to any server of ours.
Permissions and why
- Internet, view network connections
- Why the app asks: Talk to the servers you add
- When: Installed with the app
- Contacts (read and write)
- Why the app asks: Put the address books you sync into your phone's Contacts, and read your changes to send back
- When: When you set up contact sync
- Calendar (read and write)
- Why the app asks: Put the calendars you sync into your phone's Calendar, and read your changes to send back
- When: When you set up calendar sync
- Sync settings (read and write)
- Why the app asks: Show BrainySync's accounts in Android's account and sync settings, and respond to "Sync now"
- When: Installed with the app
- Photo location
- Why the app asks: Back up photos with the place they were taken; without it, Android removes that information
- When: When you set up folder backup
- Notifications
- Why the app asks: Sync and backup progress and problems
- When: Asked by Android on newer versions
- Foreground service (data sync)
- Why the app asks: Lets a large first folder backup finish with a visible notification
- When: Only while it runs
- Ignore battery optimizations
- Why the app asks: Lets you exempt the app from battery limits in one step, so scheduled syncs run
- When: Only if you choose to
Two more are added by the Android libraries the app uses: "run at startup" and "keep awake". They let Android schedule syncs.
The app does not ask for your location, camera, microphone, phone, SMS (text messages) or storage. Folders for backup are ones you pick in Android's folder picker.
Analytics
- The app sends no analytics, usage data or crash reports to us or to anyone else. It contains no third-party analytics or crash-reporting code.
- The usage counts stay on the phone. You can view them and clear them under Usage counts. They are included in a diagnostics report only if you create and share one.
Sharing with other Curtilage apps
BrainySync does not exchange data directly with other Curtilage apps. Contacts and events it syncs are in your phone's Contacts and Calendar, where any app you have allowed to read them can see them.
Another app can open BrainySync's sign-in screen with a server address, user name and password filled in. You still confirm the sign-in in BrainySync.
Your choices
- Export. Make a backup zip of your contacts and events, and save or share it.
- Restore. Restore contacts and events from a backup.
- Delete. Removing an account deletes the app's local copies of that account's contacts and calendars and its saved password. Nothing changes on your server. You can also clear the usage counts and remove trusted certificates.
- Turn off. Turn off sync for any calendar or address book, turn off push, or remove a backup destination or WebDAV folder.
- Uninstall. Uninstalling removes the app's private storage and its accounts, and with them the synced copies in your phone's Contacts and Calendar. Android backup and device transfer are turned off for this app. Your data on your server, and any backup or file you exported, is not removed.
Children
BrainySync has no age-specific features and does not ask for anyone's age.
Changes to this policy
We will post any changes on this page and update the date at the top.