This List describes, by use case, information that SoloBox 1.0.1 may process. Information marked as local is generally not uploaded to SoloBox servers, but may be affected by operating-system backup mechanisms.
This English version is provided for convenience. If it differs from the Chinese original, the Chinese version will prevail to the extent permitted by applicable law.
1. Server-Side Business Information
| Use case | Specific information | Purpose | Necessity/source | Retention |
|---|---|---|---|---|
| Create or restore a vault | Recovery phrase (temporarily processed in transit), recovery-phrase verification digest, random salt, key-derivation parameters, vault identifier, and access token. | Create a unique vault, verify restoration requests, and authenticate API calls. | Necessary for core functionality; generated by the app and submitted by you. | The original recovery phrase is not stored in plaintext in the business database. The digest and parameters are retained until service termination or lawful deletion. |
| File upload and management | File content, file name, folder path, size, MIME type, thumbnails, content digest/fileId, CID, upload ID, chunk status, synchronization status, and creation time. | Upload, resumable transfer, directory display, preview, download, rename, move, trash, and deletion. | Necessary for file features; selected by you or generated by your operation. | Until permanent deletion or service termination. Temporary upload chunks are deleted after task completion or the cleanup period. |
| Secure notes | Note title, body, and attachments, together with creation and modification times. | Store, synchronize, and display secure notes. | Necessary for note features; entered by you. | Until you delete the note or terminate the service. |
| Sentinel Protocol / Inheritance Guard | Protocol name, linked file IDs, beneficiary email addresses, telephone numbers with country codes, and personal notes, escalation days, inactivity-trigger days, manual-intervention selection, check-in time, and extended settings. | Save the protocol, calculate countdowns, record check-ins, and notify or process according to configured rules. | Necessary for the feature; entered by you or generated by your operation. | Until you delete the protocol, terminate the service, or the statutory period expires. |
| Time Capsule | Capsule name, linked file IDs, beneficiary email addresses, telephone numbers with country codes, and personal notes, delivery time, time zone, claim period, and backup selection. | Save the schedule, calculate time, and perform delivery according to your settings. | Necessary for the feature; entered by you. | Until deletion, completion of delivery plus the necessary retention period, or service termination. |
| Network and security logs | IP address, request time, API path, response status, network type, app version, device model, operating-system version, error details, and crash stack. | Connect to services, manage risk, prevent attacks, troubleshoot, and audit. | Necessary for secure and stable operation; generated automatically. | For the shortest period necessary for troubleshooting, security, and legal obligations. |
| Push notifications — Getui Message Push SDK | Device platform, manufacturer, brand and model, system and app versions, Wi-Fi connection information (including SSID, the Wi-Fi network name, and BSSID, the Wi-Fi access point's MAC address), carrier, DHCP, OAID, AndroidID, IP address, push-client identifier, and delivery status. | Generate and recognize CID/GID identifiers, establish and maintain push connections, deliver service notifications accurately, and diagnose delivery failures. | For push features; after privacy consent, during SDK initialization and push-channel operation, the SDK automatically invokes system interfaces and processes information needed for push registration and delivery through its service interfaces. | Processed for the period required for push service and under the third party's policy. |
| Customer support and rights requests | Email address, message content, attachments, identity-verification materials, and communication records. | Respond to inquiries, complaints, security incidents, and personal-information rights requests. | Necessary to handle the request; provided by you. | For the period necessary to handle the request and comply with legal obligations. |
Android device and Wi-Fi information queried by this app
Android device and Wi-Fi information read by this app: After you agree to this Privacy Policy, when the app runs and queries device or network status, its embedded runtime components automatically invoke Android system interfaces to read the device MAC address, Wi-Fi network name (SSID), and Wi-Fi connection state. The MAC address supports device identification and runtime compatibility checks. The SSID and Wi-Fi connection state identify the current network connection, check network availability, and help troubleshoot upload, download, and connection failures. A MAC address identifies a network interface; an SSID is the name of the current Wi-Fi network. Access is limited by the operating-system version and system restrictions; fields that the system does not permit are not obtained. This describes the app invoking system interfaces and does not mean these fields are submitted as DCloud engine analytics data.
2. Information Primarily Processed Locally
| Information | Local purpose | Explanation |
|---|---|---|
| Private key | Signing, unlocking, or local key sessions. | Stored where possible using iOS Keychain, Android Keystore, or platform secure storage. We do not actively upload private keys. |
| Recovery phrase, PIN, pattern password, and master password | Restoration and local unlocking. | Stored according to platform capabilities in Keychain, Keystore-wrapped storage, or app-private storage. Hardware-backed encryption is not guaranteed on every platform. |
| Fingerprint or facial-verification result | Determine whether unlocking is allowed. | The app receives only success, failure, or error status from the operating system and does not obtain biometric templates. |
| Thumbnails, video cache, and downloaded files | List display, preview, and offline access. | Stored in app cache or a system directory that you select and may be cleared in the app or system settings. |
| Upload queue, chunk progress, and local file paths | Background tasks, pause, resume, and resumable transfer. | Removed when a task completes, the queue is deleted, or app data is cleared. |
| Theme, layout, app icon, and automatic check-in preferences | Save personalization and automatic-execution choices. | Usually stored locally. When automatic check-in is enabled, the app sends a check-in request to the server. |
| Recovery phrase written to the clipboard | Written only when you tap Copy. | The app attempts to clear it after a delay but cannot control the clipboard behavior of third-party keyboards, the operating system, or other apps. |
3. Device Permission List
| Permission | Purpose | When invoked |
|---|---|---|
| Photo library, media, and file access | Select images, videos, audio, or other files for upload and generate thumbnails and previews. | When you tap to select or upload a file. |
| Write to photo library | Save downloaded images or videos. | When you tap Save. |
| Camera and flashlight | Take photos and scan QR codes. | When you enter a photo or QR-scanning feature. |
| Fingerprint or Face ID | Local identity verification and unlocking. | When you enable or trigger biometric unlocking. |
| Network and Wi-Fi state | Connect, upload, download, determine network state, and retry. | When using online features or when network state changes. |
| Notifications, vibration, and wake lock | Service notices, task-status alerts, and maintaining necessary tasks. | When notifications are enabled or a relevant task is running. |
| Device state | Runtime and push-component compatibility and channel identification. | As configured by the component and authorized by the system. Call content is not read. |
4. Information Not Currently Collected for Business Purposes
The current version does not integrate advertising SDKs, map location, third-party social login, or payments. It does not read device contacts, SMS messages, call content, microphone recordings, or precise geolocation. Beneficiary email addresses and telephone numbers are entered manually by you. If a corresponding feature is added in the future, we will first update this List and obtain authorization as required by law.
5. Questions and Feedback
If you believe this List is inconsistent with actual behavior, email the app version, device and operating system, time of occurrence, and relevant screenshots to support@solobox.com.cn.