What DeDup sends off your phone, and what stays on it

This post lists what DeDup 1.5.3 on Android and DeDup 1.0.1 on iPhone keep on the phone, and what they send to Google's Firebase services. I read both apps' code and then compared the result with the privacy policy on the DeDup website. The policy has more detail, and nothing here is meant to replace it.

What stays on the phone

• Your photos, videos and files. Scanning, comparing and grouping run on the device. I found no code in either app that uploads a photo, video or file. The one piece of network code in Android's Agent Mode downloads model files, and its comments say it sends no file names, paths or conversation text.
• Scan results, scan history and Trash records. Android keeps them in a local database. iPhone keeps them in on-device storage.
• Your settings.
• On Android, the profile you sign in with (name, email, photo address) is also saved in encrypted preferences on the phone.

What is sent

• Crash reports (Crashlytics, both apps). The policy says they include the device model and OS version. The iPhone app also records non-fatal errors with a short description.
• Usage analytics (Firebase Analytics, both apps). The events are things like app opened, screen viewed, feature opened and closed with how long it was open, scan started and finished, and settings changed. Scan and cleanup events carry counts and byte totals, such as how many duplicates were found, but not file names. Android's analytics code is built from fixed lists of values so that names, paths and typed text can't get into an event. I read that design and didn't check every call. On iPhone, an error event carries an error message cut to 100 characters.
• Feedback you type. The feedback forms in Settings send your text, an account ID (or the word "anonymous"), the time and the platform. Bug reports also send the device model, OS version, app version and language. On iPhone, sending feedback needs a signed-in account.
• Account data, if you sign in. Firebase Authentication holds your name, email address and an account ID. Android offers Google sign-in. iPhone offers Apple or Google.
• Messages from DeDup. Both apps include Firebase push messaging and in-app messages, and a Remote Config value for a minimum app version. The iPhone app also asks Apple's app lookup service about new versions, sending its bundle identifier and your region.

Android also writes a short error report to the same Firebase database when Google sign-in fails or is cancelled. It contains the error type and message, the account ID or "anonymous", and device details such as model, Android version and app version.

What I did not verify

• What Google does with the data once it arrives. The policy links to Firebase's own privacy page for that.
• Where voice audio goes. That depends on the speech service on your phone, and the policy explains it.
• Whether the Firebase console is set up exactly as the policy describes. I only had the app code.
• I found no switch in either app to turn analytics off.

Scope of this post

Checked against: DeDup 1.5.3 source code (Android) and DeDup 1.0.1 source code (iPhone), plus the privacy policy text on the DeDup website.

Not tested on a device: I didn't watch network traffic from either app, so this is a reading of the code, not a measurement. The privacy policy is the authoritative statement.