Privacy Policy
Effective date: October 29, 2026
This policy describes how Mushroom Studio ("we", "us", or "our") handles information in App Lock for Android (package com.mushroomstudio.applock, the "App") and on this informational website.
1. Information processed on your device
- App protection: installed-app names, package identifiers and icons, your protected-app selection, foreground-window change events, lock schedules, pattern verification data, failed-attempt counters, and unlock results with timestamps.
- Local files: photos, videos, and audio you select or capture, with filenames, paths, types, sizes, timestamps, and preview metadata.
- Browser: URLs, search queries, page titles, browsing history, shortcuts, cookies, website storage, favicons, and files you choose to download.
- Preferences: app settings and your choice of unlock and browser-cleanup options.
These features do not require a Mushroom Studio account or provide a Mushroom Studio cloud-sync service. Local content is not deliberately attached to analytics or diagnostic reports by App Lock; technical reports may contain information present in exceptions and SDK-generated metadata.
2. Accessibility and other permissions
AccessibilityService is used for app-lock functionality. After you enable it, the service observes foreground-window changes to identify apps you selected for protection and show their lock screen. It is configured for window-state events, with window-content retrieval disabled; it does not use this service to read the contents of your messages or web pages. It may request the Home action when you leave the lock screen or the App cannot display its protection window. You can disable the service in Android Accessibility settings.
| Permission or access | Purpose |
|---|---|
| Display over other apps | Show the password window above a protected app. |
| Device biometrics / fingerprint | Ask Android or the device's biometric service to verify enrolled biometrics. The App receives an authentication result, not fingerprint images or face templates. |
| Camera and microphone | Capture photos, video, or audio when you use the corresponding feature. Runtime access is requested where Android requires it. |
| Selected files and media | Import files you choose through Android's picker. Older Android versions may request storage access when exporting media. |
| Internet and network state | Load websites, download requested content, and support the Firebase SDKs. |
Revoking a permission can disable its related feature. App protection also depends on the accessibility service running and device background restrictions.
3. Analytics and crash diagnostics
Google Analytics for Firebase is integrated to provide app usage statistics. Its default implementation can process app-instance identifiers, app and device information, session and interaction events, approximate location derived from network information, and advertising identifiers where available. The SDK's advertising-ID permission is present in the merged Android manifest. Identifier availability is affected by Android settings and applicable consent configuration. See Google's data-collection documentation.
Firebase Crashlytics helps diagnose crashes and non-fatal errors. Reports can include stack traces, exception information, app and OS versions, device characteristics, and installation identifiers. Our handled-error reporting removes the original exception message and cause before recording the error, but automatic crash collection and SDK metadata are separate. Google's published Crashlytics policy describes a 90-day retention period before removal begins. See Firebase privacy and security information.
The App currently has no dedicated in-app switch to disable Firebase collection. Android advertising-ID controls are not a general opt-out from all analytics or crash reporting. Contact us with questions about data access or deletion; identifying a particular SDK installation may require additional information, and some records are retained under the provider's policies.
4. Storage and retention
| Local data | Retention |
|---|---|
| App-unlock history | Entries older than 7 days are pruned during history access or maintenance. |
| Browser history | Entries older than 30 days are pruned during history access, recording, or maintenance; you can also delete history. |
| Local files, shortcuts and settings | Kept until you delete or change them, clear app data, or uninstall, subject to Android's storage behavior. |
| Cookies and website storage | Managed by Android WebView and the website; cookie cleanup can be requested through the App's Settings. |
| Temporary files and caches | Some expire or are trimmed during maintenance. Android may also reclaim cached data. |
Pruning is performed when the App runs; it is not a continuously running deletion service while the device or process is off. The browser history setting requests cleanup when the app task closes; it is not a promise that visits are never written during a session. Task-close detection and cleanup can be delayed by process termination, force-stop, or device restrictions. Pending cleanup may be retried on a later launch.
Vault files and the App's local history databases are stored in Android's no-backup area. Other settings or platform-managed data may be affected by Android backup and device-transfer settings. App Lock does not provide cloud backup or guarantee recovery. Keep separate copies of important files before deleting app data or uninstalling.
5. Websites, sharing, and support
When you browse, search, or download, your device connects to the relevant website, search provider, or content server. Those services can receive your IP address, browser headers, requests, cookies, and information you submit, under their own terms and privacy policies. The built-in browser is not a VPN or anonymity service.
When you share or export a file, you choose the destination. The receiving app, exported copy, and original source file are outside the protection of the local file area. Importing a file does not automatically protect or remove all copies elsewhere.
If you email us, we receive your email address and the content you send. In-app feedback opens an editable email draft that may include the app version and Android version; you review and send it through your email app. Do not send lock patterns, passwords, biometric information, or private media.
6. This website
This site is a static informational website with no account, contact form, or analytics script added by us. It is intended to be hosted on Cloudflare Pages. Once deployed, Cloudflare may process request information such as IP addresses and security or operational logs to deliver and protect the site, under the Cloudflare Privacy Policy. Following an external link or sending email is governed by the receiving service's policies.
7. Security and your choices
The App uses Android app-private storage and a lock interface, but a lock screen is not a guarantee of file encryption, anonymous browsing, or protection against every attack. Rooted devices, uninstalling, revoked permissions, background restrictions, and changes to Android can affect protection. Keep your Android screen lock enabled.
- Choose protected apps, schedules and biometric preferences in the App.
- Delete browser history, remove shortcuts, and configure task-close history and cookie cleanup.
- Delete or export files from the local file area; separately manage copies outside the App.
- Review or revoke permissions in Android Settings.
- Clear app data or uninstall to remove app-private data; this does not automatically delete exported copies, email correspondence, Android backups, or previously transmitted SDK data.
8. Children, updates, and contact
The App is not intended for covert monitoring of another person. A parent or guardian should supervise a child's use and device permissions. Contact us if you believe a child has sent personal information to us that should be removed.
We may update this policy when features, SDKs, or data practices change. The effective date identifies this version. For privacy questions or requests, contact us below.