Privacy policy
DOCKET never uploads your documents, edits or signatures unless you explicitly enable the optional encrypted sync vault. Without sync, they stay in the app's private storage or the browser's local storage unless you choose to share or export them.
Who we are
DOCKET is operated by Off Rails. This policy applies to the DOCKET Android app distributed through Google Play, the optional direct-download build, DOCKET Desktop and DOCKET Web. The privacy contact is admin@off-rails.com.
What we collect
We do not collect, transmit or sell your documents, their contents, your accounts or your personal data. DOCKET does not have a traditional user account, advertising SDK, analytics SDK, crash-reporting SDK or tracking identifiers. The optional sync vault uses a vault ID and passphrase chosen by you; it is not an email account.
The Google Play build does not request the Android INTERNET permission, so
DOCKET's own code cannot make a network request. The optional direct-download build requests
INTERNET only to fetch a signed update manifest, as described below. Enabling
encrypted sync in DOCKET Web or DOCKET Desktop is a separate, explicit action. Android
system backup and Google Play payments are handled as described on this page.
Data stored on your device
DOCKET stores the following only in its private app storage:
- Documents you import or create, and the private copies DOCKET makes for editing
- Projects, folders, tags, pins and trash state
- Annotations, bookmarks, reading position, form values and signing plans
- Scanned images and generated PDFs
- Your saved signature, app preferences and local entitlement state
These files remain under Android's app sandbox. DOCKET is configured not to create Android cloud backups or device-to-device transfers, so it does not copy this private storage to Google Drive or another phone. Removing a document moves it to Trash first; emptying Trash or deleting a document permanently removes DOCKET's private copy. Uninstalling the app removes its private copy from the device.
Device access and permissions
- Camera — used only while you are in the scanner. Frames are processed on-device for page-edge detection. A captured image is saved only when you choose to keep the page; discarded frames are not retained.
- Files you choose — DOCKET imports through Android's system file picker. It keeps a private copy so edits do not modify your originals.
- Clipboard — accessed only when you tap Copy on selected text.
- Print/share — when you choose to share or export, Android's system chooser passes the file to the app you select. We do not receive a copy.
DOCKET does not request access to your contacts, location, microphone, SMS, call history or photo library beyond files you explicitly select. The Play build has no network permission.
On-device processing
Rendering, scanning, page-edge detection, OCR, form filling, signing and PDF editing run locally using pdfium, PDFBox and Google ML Kit's bundled on-device text recognition. DOCKET disables ML Kit's diagnostic upload components, so no document, scan, image, recognized text or ML Kit usage metrics are sent by DOCKET.
Network access and the direct build
The direct-download build checks
https://docket.cx/updates/android.json at most once every 24 hours
to see whether a newer version exists. This request contains no document data, account
information or analytics. The Play build does not make this request.
Like any HTTPS request, the update host may receive standard technical details such as an IP address, timestamp and user-agent string in its server logs. We use those logs only to serve and secure the update manifest, not to identify or profile users.
DOCKET Web and optional sync
DOCKET Web stores documents in your browser's local storage. If you explicitly create or join a sync vault, document files and their metadata are encrypted on your device before they are sent. The sync server receives ciphertext, wrapped keys, byte sizes, timestamps and technical request metadata; it does not receive readable document contents or filenames.
You choose the sync server URL. DOCKET does not operate a sync service for you; a self-hosted server is controlled by whoever runs it. The vault passphrase and recovery key are never sent to the server in plaintext. Losing both makes the vault unrecoverable. You can disconnect a device or remove its local data at any time; removing server data is done by the server owner.
Purchases and license keys
DOCKET Pro is a one-time unlock. There is no subscription.
- If you purchase through Google Play, Google processes the payment and provides the app with a purchase result. DOCKET stores the entitlement locally.
- An offline license key contains the email address used when it was issued. That email is stored only on your device to show which key is active and is not transmitted by DOCKET.
- We do not operate an account server or maintain a purchase history on our side beyond what Google Play provides to you.
Analytics, advertising and tracking
None. DOCKET contains no advertising SDKs, no analytics SDKs, no crash-reporting SDKs and no tracking identifiers. We do not build profiles, sell data or share documents with third parties.
Children
DOCKET is a general productivity tool intended for users aged 13 and over. It is not directed at children and does not knowingly collect data from anyone, including children.
Security
DOCKET stores documents in Android app-private storage, which is sandboxed from other apps and included in the operating system's normal device encryption. The direct build's update request uses HTTPS. DOCKET does not transmit document contents or personal data to Off Rails.
Data retention and deletion
Documents, annotations, projects, tags, signatures and settings live in the app's private storage. Deleting a document from Trash permanently removes DOCKET's copy. Uninstalling the app removes its private copy from the device. DOCKET 1.2.4 and later do not create new Android cloud backups. If an earlier installation created a backup under your Google account, that copy is controlled by Google and can be removed in your Android backup settings. Because there is no account and no server holding your documents, there is nothing for us to delete on your behalf.
Files you explicitly export, print or share leave the app and are controlled by you and the destination app or service. The static DOCKET website does not require an account and does not use advertising or analytics cookies. The hosting provider may keep standard web-server logs for security and delivery.
Changes
If this policy changes, the effective date above will be updated and material changes will be noted in the app's release notes.
Contact
Questions about privacy or this policy: admin@off-rails.com