Vyxel Apps Privacy Policy
Effective 12 October 2026 · App: Vyxel Apps (com.vythera.vyxelapps) · Developer: Vythera
- No ads, no advertising IDs, no third-party analytics or tracking SDKs. We never sell your data.
- Your favourites, history, settings, tokens and keys stay on your phone unless you choose to sign in with Google.
- Signing in with Google is optional. If you do, we keep your Google account ID, email, name and a backup of your Vyxel settings so you can restore them on another phone. You can delete it all from the app at any time.
- The app sends a small, anonymous device check-in (hashed device ID, model, Android version, app version, session length, approximate location from your IP) so we can keep the service running and stop abuse.
- When you browse or download apps, your phone talks directly to the app sources you enable (for example GitHub or F-Droid), which see your IP address.
1. Data that stays on your device
The following is stored only in the app's private storage on your phone and is not sent to us:
- Favourites, recently viewed apps, search history, followed apps, tracked apps, custom repositories, install history and downloaded installer files.
- Your settings: theme, language, enabled sources, hidden apps and similar preferences.
- Your GitHub token and your APKMirror (Parse) API key, if you add them. They are only ever sent to GitHub or APKMirror respectively, to make the requests you ask for.
- Your PRO licence key and the signed licence token.
- Accounts you create with an email and password. These live only on your phone; the password is stored as a salted hash, never in plain text, and is never sent anywhere.
Sign-in session data is kept in encrypted storage and is excluded from Android's own cloud backup.
2. Sign in with Google and cloud backup (optional)
You can use Vyxel without an account. If you choose Continue with Google, Google shares the following with Vyxel after you pick your account:
- your Google account identifier, email address, name and profile picture.
Our account service (a Cloudflare Worker with a Cloudflare D1 database) verifies the sign-in with Google and stores:
| What | Why |
|---|---|
| Google account identifier, email address, name, when you signed up and when you last used the service | To recognise your account and show who is signed in. |
| One backup of your Vyxel data: profile name and theme, appearance settings, favourites, followed apps, tracked apps, custom repositories, enabled and hidden sources, preferences, and the list of apps you installed (package names and versions, so they can be offered for reinstall) | To restore your setup on a new or reset phone and keep your phones in sync. |
Your profile picture is shown in the app from Google's link; we do not store the image. Backups never include your GitHub token, APKMirror key, PRO licence key or licence token, passwords, downloaded files, or the list of system apps on your phone.
Backups are limited in size and are kept until you delete them. To delete your account and backup, open Profile → Delete account in the app; this removes them from our database immediately. Signing out removes the account from your phone but keeps your backup so you can sign in again later.
3. Device check-in
Each time the app is opened and closed it sends a short check-in to our service so we can see how many devices use Vyxel, keep it available, and disable it on a device if the service is being abused. It contains:
- a device identifier that is a one-way SHA-256 hash (the raw Android ID never leaves your phone), a random installation ID and a session ID;
- device manufacturer and model, Android version, app version and whether it is a phone or TV;
- how long the app was open in that session.
From the connection we derive an approximate city, region and country. Your IP address itself is not stored. We also keep when the device was first and last seen and how many times the app was opened. This data is not linked to your name, email or Google account.
4. PRO themes
When you unlock PRO, the app sends your licence key, the app's package name and the hash of the app's signing certificate to our licence service, which checks the key with the store you bought it from (Polar or Gumroad) and returns a signed token. The token is stored on your phone and is periodically re-checked. The premium theme pack is then downloaded and stored encrypted on your phone. Your purchase itself (payment details, billing email) is handled by Polar or Gumroad under their own privacy policies; we never see your payment details.
5. Services your phone contacts directly
To list, search, update and download apps, Vyxel connects from your phone directly to the sources you enable. These services receive your IP address and the requests you make, under their own privacy policies. Depending on your settings they include GitHub, GitLab, Codeberg, F-Droid and its mirrors, IzzyOnDroid, Flathub, WinGet, Aptoide, APKPure, Uptodown, TapTap and APKMirror (only with your own API key). The app also loads its app catalogue, featured apps and announcements from our content host on GitHub Pages, and uses Google Translate if you translate app descriptions.
6. Where data is processed
Our account, check-in and licence services run on Cloudflare's network and store data in Cloudflare D1. Cloudflare may process connection information, such as IP addresses, to deliver and protect these services. Data may be processed in countries other than yours.
7. Security
All connections use HTTPS. Google sign-ins are verified on our server against Google's published keys. Sessions expire after 30 days. Sign-in data on the phone is stored encrypted. No method of storage or transmission is completely secure, but we keep what we hold to the minimum described here.
8. Your choices
- Use Vyxel without an account; nothing in section 2 is collected.
- Delete your account and cloud backup at any time from Profile → Delete account.
- Turn off any app source in Settings so your phone no longer contacts it.
- Uninstalling the app removes everything stored on your phone.
- To ask about, or request deletion of, any data we hold (including device check-ins), email us at the address below with the device code shown in the app if you have one.
9. Children
Vyxel is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has signed in, contact us and we will delete the account.
10. Changes
If this policy changes, we will update the date above and, for significant changes, announce it in the app or on our Telegram channel.
11. Contact
Vythera · narzo9990@gmail.com