ThoughtFerry: Quick Capture Privacy Policy

# ThoughtFerry: Quick Capture Privacy Policy Last updated: August 25, 2026 ## Overview ThoughtFerry is a local-first Android capture and routing utility developed by Quazmoz. The current Phase 1 implementation captures content locally first, preserves it durably, then lets the user deliberately route it to a supported destination. ThoughtFerry has no Quazmoz/ThoughtFerry backend, analytics SDK, advertising SDK, billing SDK, or cloud-sync service in the current implementation. ## Data ThoughtFerry stores ThoughtFerry may store on your Android device: - text and URLs you enter or share to the app; - app-private attachment bytes, or a verified persisted Android document URI permission for an attachment you deliberately select through Android's document picker; - local capture, delivery request, and delivery-attempt status/history; - user-created route configuration such as a selected Markdown document tree and opaque/versioned references to HTTPS webhook secrets; - encrypted webhook endpoint values and encrypted custom webhook header values in local Android Keystore-backed secret storage; - delivered-content retention preferences; - temporary draft state needed to recover meaningful in-progress capture text and attachment ownership; - a temporary app-private Sharesheet handoff containing shared text, error, and attachment metadata until the normal draft store safely adopts it. This data is used to provide capture, Local Inbox, delivered history, recovery, route management, and user-directed routing features. ## Android Sharesheet handoff When another app shares supported content to ThoughtFerry, the Sharesheet receiver validates the share and copies accepted attachment bytes into ThoughtFerry-owned private staging before issuing the private handoff. The share payload is stored in app-private handoff storage, and the launcher receives a random handoff token rather than raw shared text or app-private attachment paths. The normal draft store adopts the content before the handoff is removed. Abandoned handoffs expire and are cleaned using reference-aware attachment ownership rules so cleanup does not reclaim an attachment still owned by a draft, handoff, or committed capture. ## Data transmitted Content leaves ThoughtFerry only when the user explicitly chooses or configures a destination that requires an external operation. ### Document-tree delivery ThoughtFerry can write captured content to an Android Storage Access Framework document tree selected by the user. The Android document provider chosen by the user may independently sync or process those files according to that provider's settings and privacy terms. ### HTTPS webhook delivery ThoughtFerry can send captured text or URLs to an HTTPS webhook endpoint configured and selected by the user. A request may include the captured text/URL content, capture source/type metadata, capture time, a random logical delivery identifier used for delivery identity/idempotency, local route identity/display metadata, and user-configured request headers whose values are resolved at execution time from local encrypted secret storage. The current webhook connector does not upload attachments. The webhook operator controls what happens after the request reaches that endpoint. ThoughtFerry does not proxy webhook traffic through Quazmoz infrastructure. ## Webhook endpoint and header security ThoughtFerry treats the complete webhook endpoint as sensitive because credential material can appear in path segments as well as more obvious authentication fields. The raw endpoint and all user-configured webhook header values are encrypted with Android Keystore-backed AES-GCM storage. Normal route configuration and immutable delivery-request snapshots persist only the exact opaque/versioned secret references required for that delivery. Current Phase 1 webhook endpoints must use HTTPS and cannot contain URL userinfo, query strings, or fragments. Raw endpoints and custom header values are intentionally excluded from normal Room route/request JSON, WorkManager input data, safe diagnostic codes, Android SavedState, and route recipe exports. ## Permissions and storage access ThoughtFerry uses Android scoped document APIs instead of broad filesystem access. It does not request MANAGE_EXTERNAL_STORAGE and does not use an AccessibilityService. The application declares normal Internet access because HTTPS webhook delivery requires network connectivity. Production cleartext traffic is disabled. Incoming shared attachments are accepted through Android content-provider URIs and copied into private staging before a private handoff is issued. Attachments deliberately selected through Android's document picker may instead use a verified persisted URI grant when Android actually grants it and the content can be reopened; otherwise the selected bytes are copied into app-private storage before ThoughtFerry claims the attachment is durable. ThoughtFerry warns when app-private attachment staging reaches 192 MiB and blocks new private copies at 256 MiB. Crossing those thresholds does not cause unresolved captures or attachments to be silently deleted. ## Delivery reliability and retry behavior ThoughtFerry commits the capture locally before external connector side effects begin. Automatic webhook retry occurs only for failures classified as safe enough to retry and where recorded duplicate risk is NONE or LOW. Automatic retries preserve the same logical delivery identity and immutable destination snapshot and are capped at three real connector executions. Ambiguous outcomes, possible-duplicate outcomes, authentication/permission problems, permanent failures, and exhausted retry budgets are not blindly replayed. Ambiguous retry requires explicit user review/authorization. ## Route recipes ThoughtFerry can export and import bounded route-recipe JSON for portability. Webhook route recipes intentionally omit the raw webhook endpoint, all stored webhook header values, device-specific endpoint/header secret IDs and versions, and Android Storage Access Framework tree URI grants. Import is preview-first and does not execute automatically. A receiving device must re-enter required webhook secret values or select a new document folder before an imported route can be saved. ## Backup The current implementation excludes sensitive capture databases, app-private staged attachments, drafts/preferences/DataStore files, temporary Sharesheet handoffs, and connector secret material from unintended Android cloud backup and device-to-device transfer. A future intentional encrypted backup or sync feature would require a separate security/privacy design and an updated policy. ## Retention and deletion Draft, queued, delivering, failed, or needs-action captures remain local unless an explicit delivery-safe deletion can complete. ThoughtFerry does not automatically delete unresolved content merely to reclaim storage. Delivered captures appear in local delivered history. The default delivered-content policy keeps the delivered body unless the user selects the available 7-, 30-, or 90-day delivered-content redaction option. Under those opt-in policies only the local delivered text/subject body is redacted after the selected age; delivery status, timestamps, immutable request metadata, and attempt history remain as local delivery evidence. The Local Inbox/history UI provides explicit deletion for locally retained captures where supported. Private staged files and persisted attachment grants are removed only when durable ownership/reference checks allow it. Removing a destination prevents new captures from using it. Existing queued delivery snapshots can still execute from their saved configuration, and endpoint/header secrets or document grants are released only when no outstanding delivery or live route still requires them. ## Data sharing and third parties ThoughtFerry does not sell user data and does not send capture content to Quazmoz infrastructure. The app may pass data to a user-selected document provider or webhook operator only when the user configures/selects that destination and initiates or queues delivery to it. Those providers/operators may have their own privacy policies and retention practices. Google Play and Android may process standard distribution, installation, update, security, and platform information under Google's policies. ## User requests ThoughtFerry creates no developer-hosted cloud account and stores no Quazmoz server-side user profile in the current Phase 1 implementation. Local app data can be deleted through ThoughtFerry's UI where available, Android app-storage controls, or uninstalling the application. Deleting data from ThoughtFerry does not delete copies already stored by a user-selected document provider or webhook destination. Those external copies must be managed under the destination's own controls and policies. ## Children ThoughtFerry is a general productivity utility and is not intentionally designed to collect personal information from children through a hosted service. ## Changes to this policy This policy will be updated before shipping functionality that materially changes data collection, sharing, cloud processing, analytics, advertising, authentication, billing, or external connector behavior. ## Contact For privacy questions, contact Quazmoz@vivaldi.net.