Privacy Policy
Last updated 8 September 2026
Easy PGP is free software published by Níckolas Goline. This describes what the app does with your data. It is a factual account of how the app behaves, and can be checked against the source code.
Easy PGP collects nothing, sends nothing, and has no servers. The app does not request the
INTERNET permission, so it cannot transmit your data anywhere even if it tried.
What the app stores, and where
All of this lives in the app's private storage, readable only by Easy PGP:
- Your key rings. Public and private PGP keys you generate or import. Private key rings are encrypted with a passphrase you choose, and additionally sealed with a key held in the Android Keystore that requires your fingerprint or device PIN.
- Your settings. Privacy mode, how long a passphrase is remembered, whether to clear fields after an operation, whether to obfuscate PGP markers.
Your passphrase is never written to disk. It is held in memory for the duration you choose — until the screen turns off, one hour, or one day — then overwritten, and it is gone when the app process ends. It cannot be recovered: if you forget it, messages encrypted to that key cannot be decrypted by anyone, including us.
Notification access
If you enable it, Easy PGP uses Android's notification listener to spot encrypted messages in notifications from other apps, so it can offer to decrypt them. This is the app's most sensitive permission, so to be precise about it:
- Notification text is read on your device only, to check whether it begins with a PGP message marker.
- Notifications that are not encrypted messages are ignored, and nothing about them is stored.
- When an encrypted message is found, its text is passed to the app's own decrypt screen. It is not written to disk, logged, or transmitted.
- The feature is optional. Android requires you to grant it explicitly in system settings, and you can revoke it at any time. The rest of the app works without it.
What the app does not do
- No analytics, telemetry, crash reporting, or advertising.
- No accounts, sign-in, or user identifiers.
- No network requests of any kind. The app holds no
INTERNETpermission. - Your keys are never uploaded, backed up to a server, or shared.
Hardware keys
If you use a YubiKey, the app talks to it directly over USB or NFC. That communication stays between your phone and the key.
Permissions, and why each exists
| Permission | Why |
|---|---|
POST_NOTIFICATIONS | To tell you an encrypted message was detected |
RECEIVE_BOOT_COMPLETED | To restart the detection service after a reboot |
HIDE_OVERLAY_WINDOWS | Privacy mode: stop other apps drawing over the app |
NFC | Talking to a YubiKey over NFC |
USE_BIOMETRIC | Unlocking your private keys with fingerprint or device PIN |
Google Play
Distribution through Google Play means Google collects its own data about installs and, if you have opted in on your device, crash reports. That collection is Google's, governed by the Google Privacy Policy, and is outside this app's control. Easy PGP itself sends nothing to Google.
Children
Easy PGP is not directed at children and collects no data from anyone.
Changes
Changes to this policy are published here, and its history is public in the repository.
Contact
Questions about this policy, or about how the app handles data, can be raised as an issue. Please report security vulnerabilities privately instead — see CONTRIBUTING.
A note on trust
Easy PGP is alpha software and has not been security audited. This policy describes what the app is designed to do, and the source is public so the claims can be checked rather than taken on trust. It is not a warranty that the software is free of defects. Do not rely on it to protect information whose disclosure would put you at risk.