# "Pachli" and "Pachli Current" Privacy Policy

## Data access

"Pachli" and "Pachli Current" (collectively "the application") process data from your Mastodon server ("server") locally on your device.

After using the application to sign in to an account on your server your data is fetched and stored securely on your device. As you use the application additional data will be fetched and stored securely on your device.

You may use the application to share new data with your server (e.g., a new post, an image), or edit existing data (e.g., your account's profile).

You can not create an account using the application.

## Data security

All local data is processed using secure Android APIs.

All network data is encrypted using `https`.

## Data deletion

All locally cached data for an account is deleted if you do any of the following:

- Log out of the account in the application
- Clear the application's local storage
- Uninstall the application

You can not delete your Mastodon account using the application. Deleting your account must be done through your server's web interface.

## Data backups

Pachli participates in Android's backup system.

### Data backup and restore with Google Drive

Android *may* store an encrypted backup of Pachli data in your Google Drive.

For this to happen all of the following conditions must be met:

1. Your device must be running Android 9 or higher ([instructions on how to check your Android version](https://support.google.com/android/answer/7680439?sjid=2548273967416916128-EU)).
2. You must be signed in to your device with a Google account.
3. You must have enabled Google's [Android backup and restore](https://support.google.com/android/answer/2819582?hl=en) feature on your device (**Settings** > **System** > **Backup**).
4. You must have enabled screen-unlock, with a pin, pattern, or password.

If all these conditions are met then a copy of your Pachli data, including your account information and preferences are **encrypted** and periodically uploaded to your Google Drive, approximately once per day when:

1. At least 24 hours have elapsed since the last backup.
2. The device is idle.
3. The device is connected to a Wi-Fi network (if you have not opted in to mobile-data backups).

Data is restored whenever Pachli is installed.

You can disable this functionality on your device at **Settings** > **System** > **Backup**.

Your device backups in Google Drive can be viewed at https://drive.google.com/drive/backups.

For more information on Android's backup and restore feature see [Backup or restore data on your Android device](https://support.google.com/android/answer/2819582?hl=en).

## Data sharing

### If you have installed Pachli from F-Droid or GitHub releases

**None of the data used by the application is shared with the application developers or unrelated third parties.** Your data is only ever sent to your server, and handled in accordance with your server's privacy policy.

### If you have installed Pachli from Google Play

Pachli uses Google's [ML Kit](https://developers.google.com/ml-kit) to provide features that:

- Warn you if the language you have selected when editing a post appears to be different from the language you used.
- Allow you to translate messages without requiring your server to support translation.

When Pachli does this all of the data you have provided (e.g., the content you are posting or translating) is processed on your device, and **ML Kit does not send that data to Google servers**.

The ML Kit APIs may contact Google servers from time to time in order to receive things like bug fixes, updated models and hardware accelerator compatibility information. The ML Kit APIs also send metrics about the performance and utilization of the APIs in your app to Google. Google uses this metrics data to measure performance, debug, maintain and improve the APIs, and detect misuse or abuse, as further described in Google's [Privacy Policy](https://policies.google.com/privacy).

The specific data collected by ML Kit is in Google's [data disclosure](https://developers.google.com/ml-kit/android-data-disclosure) description.

## Data types

The application processes the following types of data.

| Data                    | Purpose                                                                                                                                                                                       |
| ----------------------- |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Authentication token    | Generated by your server. Used to log in to your account and ensure the application can not access your username or password                                                                  |
| Account metadata        | Allow you to view and edit your account metadata, including description, relevant links, accounts you follow and follow you. Allows you to view the public account information of other users |
| Notifications           | View and manage your account's notifications, including displaying them, deleting them, and creating device notifications                                                                     |
| Timelines               | View, manage, and create posts on your Mastodon timelines (home, bookmarks, local, federated, lists, hashtags, etc)                                                                           |
| Scheduled posts         | View, manage, and create posts scheduled to send at some future time                                                                                                                          |
| Draft posts             | View, manage, and create posts you are drafting                                                                                                                                               |
| Account preferences     | Specific settings you may have configured on your account (filters, blocks, mutes, language, etc)                                                                                             |
| Application preferences | Specific settings you may have configured for the application (app theme, font, confirmations, etc)                                                                                           |

Again, **none of this data is shared with the application developers or unrelated third parties.**

## Permissions

The application requires the following permissions for the following reasons:

- `INTERNET`: Connect to your Mastodon server of choice, fetch and post content
- `ACCESS_NETWORK_STATE`: Defer work when the network is unavailable, and retry work when the network becomes available
- `POST_NOTIFICATIONS`: Show notifications from your server
- `READ_MEDIA_IMAGES` / `VIDEO` / `AUDIO`, and `READ_EXTERNAL_STORAGE`: Select media on your device if you attach it to a post
- `WRITE_EXTERNAL_STORAGE`: Save media to your device if you download it from a post
- `FOREGROUND_SERVICE`: Improve reliability when sending posts

## Contact

If you have any questions about this privacy policy please contact [team@pachli.app](mailto:team@pachli.app).
