This policy covers the Vaze mobile app (package dev.darseen.vaze), the Vaze server software and this website. Vaze is made by darseen, an independent developer, referred to here as "we".
Who controls your data
Vaze is self-hosted. Your files and accounts live on a Vaze server run by you, or by whoever gave you an account on theirs. That person decides how the server is run and how long data is kept on it. We have no access to any Vaze server or to anything stored on one.
What the app keeps on your device
- The servers you add: each server's address, the name you gave it, and the name and email of the account last signed in there, so the server list can show them.
- Your sign-in sessions: a session token for each server, kept in the device's encrypted secure storage. Your password is never saved on the device.
- Preferences: your theme, how files are sorted, and whether folders show as a grid or a list.
- Temporary files: thumbnails of files you have viewed, and short-lived copies of files while they upload, download or are shared. These sit in the app's cache, which the app and Android both clear.
None of this leaves your device except as described below. Removing a server in the app signs you out of it and deletes its saved session. Uninstalling the app deletes everything it stored.
What the app sends, and where
The app sends data only to the server whose address you entered, and only to do what you ask:
- Your email and password when you sign in, or when you create the first admin account on a new server.
- Your session token with each request.
- The files you upload, with their names, and the changes you make to files, folders, users, API keys and settings.
- When you sign in, a short device description such as
Vaze/1.0.0 (Android 15), so the server's list of signed-in devices can show which session is the app.
Like any server, a Vaze server also sees the network address your requests come from, and keeps it with your session so you can review and sign out devices.
The app allows plain http:// addresses so that servers on your home network work. When you connect over the internet, use an https:// address so your password and files are encrypted on the way.
What we don't collect
We don't collect, receive, share or sell personal data through the app. It has no analytics, no advertising identifiers, no third-party crash reporting and no tracking of any kind. It doesn't access your location, contacts, camera or microphone.
Permissions and device features
- Network access to reach the servers you add.
- Photo and file pickers: uploads use the system's photo picker and document picker, so the app only receives the items you choose. It has no general access to your photo library or storage.
- Saving to Downloads: on Android 10 and later, files you download are saved to your Downloads folder without a storage permission. On older versions the app opens the share sheet instead.
- Audio settings to play audio and video files you open.
- Vibration for haptic feedback.
- Clipboard: the app writes to the clipboard only when you tap to copy a link or a new API key. It never reads the clipboard.
The Vaze server
When you run the Vaze server, its database, files, logs and statistics stay on the machine you run it on. The server doesn't send usage data or telemetry to us or to anyone else. The configuration docs explain how long activity and request history are kept and how to change it.
This website
This website doesn't use cookies, analytics or advertising. If you pick a light or dark theme, that choice is saved in your browser's local storage. The company hosting the site may keep standard server logs, such as IP addresses and the pages requested, to keep the site running and secure.
Children
Vaze isn't directed at children under 13, and we don't knowingly collect personal data from anyone, including children.
Deleting your data
We don't hold any of your data, so there is nothing for us to delete. To remove what the app stores, remove the server in the app or uninstall it. To delete your account or files on a server, ask the server's admin. Admins can delete accounts from the Users page and files from the Files page.
Changes to this policy
If this policy changes, we will update this page and the effective date at the top. Significant changes will also be mentioned in the release notes on GitHub.
Contact
Questions about privacy can go to [email protected] or to the issue tracker on GitHub.