Prodact Privacy Policy

Last updated: 2 October 2026

Prodact is a PDF redaction app for Android. This policy describes what it does with your information. It is short because the app does very little with it.

Prodact collects nothing

Prodact does not collect, store, transmit, sell or share any personal information. There are no accounts, no sign-in, no analytics, no advertising and no crash reporting.

Prodact cannot send anything anywhere

Prodact does not request the INTERNET permission. Android does not grant network access to an app that has not asked for it, so the app is unable to open a network connection at all. This is enforced by the operating system rather than promised by the app’s code.

The three permissions Prodact does request are:

• FOREGROUND_SERVICE and FOREGROUND_SERVICE_DATA_SYNC, so that exporting a long document keeps running when you switch to another app. These are granted when the app is installed and Android does not ask you about them.
• POST_NOTIFICATIONS, so that an export’s progress can be shown in a notification while you are in another app. Prodact asks for this the first time you tap Export, never before. The notification says only “Redacting a document”, which page it has reached, and offers a Stop button. It never shows the document’s name or anything from it, and on the lock screen it is hidden entirely. If you decline, the export works exactly the same and its progress is shown inside Prodact only.

None of the three grants access to any data: not the network, your files or storage, your location, your contacts, or anything else. POST_NOTIFICATIONS is the only one Android asks you about, because it lets the app put something on your screen. It does not let the app read anything.

Your documents stay on your device

You choose a PDF through Android’s own document picker. Prodact reads the file you picked, and only that file. Everything it then does, including rendering pages, recognising text, blacking out regions and building the redacted copy, happens on your device, in Prodact’s own memory and its private cache.

The redacted copy is written to the location you choose, through the same system picker. Prodact does not upload it, copy it elsewhere, index it, or keep a record of it.

Text recognition runs entirely on your device. The recognition model is included inside the app. It is not downloaded, and nothing is sent to a server to be recognised.

What Prodact keeps, and for how long

• The document you have open is held in memory while you work on it, and released when you leave it.
• A temporary working file is created in Prodact’s private cache while an export is running, and deleted when the export finishes, fails, or is stopped. A working file left behind by an interrupted export is deleted the next time the app starts.
• The recognised text of your pages, used to make search work, is held in memory only. It is never written to disk, and it is overwritten rather than simply discarded when the document closes.
• The last few documents you opened are remembered so you can reopen them: the document’s name, the system reference Android gave it, and when you last opened it. Nothing derived from the contents is kept, so no page count, no thumbnail, and no record of what you redacted. This list is stored in the app’s own private storage on your device and is not sent anywhere. Clearing the app’s data removes it.
• Whether Prodact has asked about notifications, as a single yes or no, so that it asks only once. Nothing else is stored with it.

Android’s backup system is switched off for Prodact (allowBackup="false"), so none of the above reaches a cloud backup or transfers to a new device.

Children

Prodact is not directed at children and is intended for adults.

Changes to this policy

If this policy changes, the updated version will be published at this address and the date at the top will change.

Contact

Questions about this policy, or about the app: hello@spicycorp.com

For the technically inclined

The claims above are enforced by checks that run on every build, not by intention:

• The app’s build fails if the merged manifest requests any permission beyond the three named above plus one signature-level permission Android generates for its own use, or if any of the three is missing. The check asserts the whole set rather than the absence of particular names, because the way a network permission actually arrives is a dependency adding it silently. That happened once, and it is why the check exists.
• The build also fails if the release manifest declares any component belonging to Google’s datatransport telemetry stack, if Android backup is enabled, or if the app is marked debuggable.
• Each of those checks writes a receipt recording what it read and what it asserted, and the build refuses to package an artifact if a receipt is missing, is from an earlier run, or does not match the thing being packaged. After packaging, the permissions are read back out of the finished artifacts and compared again. A check that cannot prove it ran is not treated as having run.
• An automated test runs a real export of a test document on a phone running Android 15 or later, and reads the notification the system has posted, over and over, until the export finishes. It fails if no notification was posted; if one carries any field outside a fixed list, or a custom layout; or if any text it carries contains the test document’s file name or any word of the test document’s text.
• An automated test asserts that the installed app does not hold the INTERNET permission, and another asserts that text recognition still works with the device offline, which is to say that the model really is local.
• The window showing document pages is marked FLAG_SECURE, which keeps page content out of screenshots and out of the thumbnail Android stores when the app goes into the background.

The reasoning behind the redaction itself is documented in the project’s security notes, which also state plainly what redaction does not protect against.