Copycat privacy policy

Effective 30 October 2026 · wwweeeiii, Singapore

Copycat: Phone Backup & Sync, by wwweeeiii (Singapore). Contact: wwweeeiiidev@gmail.com

The short version

Copycat copies files from your phone to places you choose: your NAS, your server, your cloud storage or your other phone. Your files, photos, file names and passwords never come to us. There's no Copycat account, and no ads, analytics or tracking.

To wake your other phone, Copycat sends a small wake-up through Google's push service. It never carries your files, file names or phone names.

The only information that ever reaches us is what's needed to confirm a Copycat Pro purchase (only if you buy or restore Pro) and to send wake-ups between your own phones (only if you pair two phones). We keep none of it.

What we collect

Nothing we keep. Two things pass through our server without being stored: the Copycat Pro purchase check, only if you buy or restore Pro, and wake-ups between your own phones (below).

When you buy or restore Pro, the app sends our licence server:

• Purchase information: Google Play's purchase token for the Pro product, the product id and the purchase state. We use it to check with Google Play that the purchase is real and hasn't been refunded.
• A random install id: a random number Copycat creates on your phone. It isn't linked to your name, your Google account, your phone's hardware ids or your advertising id. It ties your Pro licence to this installation.
• A Google Play Integrity token: Google's statement that the request comes from the genuine Copycat app on a genuine device.

Wake-ups between your phones. So a paired phone doesn't have to stay awake to receive, Copycat uses Google's push service (Firebase Cloud Messaging). With wake-ups on and a phone paired, your phone gets a push address from Google. It gives that address only to the phones you've paired, over their encrypted link. When one of them starts sending, it asks our server to send a wake-up to that address through Google. With the request, it includes its install id and a wake pass: a note signed by our server that says the request comes from the genuine Copycat app on that install. To get a wake pass, about once a month, Copycat sends our server its install id and Google Play's integrity check (see above). It doesn't need Copycat Pro. The wake-up holds no files, file names, phone names or place details. It holds only a short code that changes every minute and that only your paired phones can work out. Our server passes the request on and keeps nothing: no push addresses, no wake passes, and no record of which phone woke which. Its logs hold status codes only. Turn wake-ups off in Settings → Devices → Wake when a phone sends, and Copycat deletes the push address. Without Google Play services, wake-ups aren't used.

The purposes are app functionality (unlocking Pro, waking your other phone) and fraud prevention (refunds, copied apps). The data is sent encrypted (HTTPS). It's never sold, never shared for advertising, and never shared with anyone except Google Play, which we ask to verify the purchase, and Firebase Cloud Messaging, which we ask to deliver the wake message. Copycat uses no Firebase analytics.

What we keep: our server keeps no purchase tokens, push addresses, install ids, wake passes or licences. It keeps only one-way fingerprints (hashes) of refunded or cancelled purchases, for up to 60 days, so a refunded purchase can't renew Pro. Server logs hold request status codes only, never tokens or ids.

What we never collect

• your files, photos, videos or documents, or their names;
• the addresses, user names, passwords, keys or sign-ins of your places;
• your location, contacts or app activity;
• diagnostics or crash reports (Google Play's own Android vitals may show us anonymous crash counts).

Where your data goes

• To the places you set up. Copycat connects directly from your phone to your NAS, server, cloud storage (Google Drive, Dropbox, S3 and WebDAV services) or your other phone. Those services' own privacy policies apply to what you store with them.
• Google Drive and Dropbox sign-in. When you add one of these, you sign in with Google or Dropbox in your browser, and Copycat gets permission only for what it needs. For Google Drive, that's only the files and folders Copycat creates. The sign-in tokens are kept on your phone, encrypted with your phone's secure key store, and are never sent to us.
• Your passwords and keys stay on your phone, encrypted with the phone's secure key store.
• Config backups (Export, Auto-backup). These files go where you choose. With a passphrase, they're encrypted on your phone (Argon2id and AES-256-GCM), and we can't open them. Without a passphrase, they never contain passwords or sign-ins.
• Phone to phone. Paired phones talk directly over your Wi-Fi, encrypted end to end. A wake-up may pass through Google and our server first; the files never do.

Permissions

Copycat asks for each permission only where it's needed, and explains why first:

• photos, videos and audio, to back them up;
• photo location data, so copies keep where a photo was taken;
• media management (optional), to move files to the trash after you confirm;
• Wi-Fi multicast, to find your other phone on the same network;
• all files access (optional), to back up folders like Download;
• notifications, to show sync progress;
• network access, to reach your places;
• Google Play billing, to buy Pro;
• push messages from Google Play services, so your other phone can wake this one for a transfer.

Children

Copycat is meant for people aged 18 and over. It isn't directed at children.

Your choices

• You can use Copycat without buying Pro and without pairing phones. Then nothing reaches us at all.
• You can turn off Wake when a phone sends (Settings → Devices) on any phone. Copycat then deletes its push address, stops renewing its wake pass, and tells its paired phones at their next contact.
• To have the licence data connected to your purchase deleted, email wwweeeiiidev@gmail.com with your Google Play order number. We have no other data about you.
• Uninstalling Copycat deletes everything it stored on your phone.

Changes

If this policy changes, we'll update this page and its date. If the change is significant, we'll also say so in the app's release notes.