Privacy Notice

About this notice

This notice explains what personal information Droid Rooter ("we", "us") collects when you use our website, our remote Android services, and any app, tool, plan or account we offer now or in future (together, the "Services"), why we collect it, who we share it with, how long we keep it, and the choices you have. We are operated from Bangladesh by the Droid Rooter team, and we are the controller of the information described here unless we say otherwise.

In short, we collect the minimum we need to do the job you asked for, to run your account and to keep our Services safe from fraud. We do not sell your information, we do not run advertising trackers, and we do not browse your personal files during remote sessions.

1. Information we collect

When you contact us or ask for a quote, we receive your name or handle, your email address, your WhatsApp or Telegram identifier, your country or city, and what you tell us, including the device brand, model, Android version, a description of the problem and any screenshots or photos you send. If you use the contact form on our site, the details you submit reach us by email through a form-delivery service. Messages on WhatsApp and Telegram stay on those platforms under their own policies, and we do not export or keep full transcripts on our own servers beyond the short job notes described in section 4.

When we work on your device, we handle the technical identifiers needed for the job, such as the serial number, the device identifier, the build and firmware version, the lock and bootloader status, and log or error output. During screen-share we see what is on your screen at that time, and we do not download or copy your files, photos, messages, contacts or app data. For data recovery, we process the data on the device only as far as needed to recover it and we delete it after delivery. Temporary working files such as firmware images and recovery output are deleted when the job closes.

For higher-risk work we verify ownership, and that can mean we receive a purchase receipt or invoice, a photo of the box or label, a screenshot showing that the device is signed in to your account, notes about how you obtained the device and the result of our check. Section 6 explains how we handle these documents.

When you pay, we receive confirmation that a payment was made, with the amount, currency, date, method and the name or reference that the payment provider gives us. We never receive your full card number. Payments made through PayPal, Wise, mobile wallets, banks or cryptocurrency are handled by those providers under their own policies. Where a purchase or donation is processed by a merchant of record, that provider collects your payment details, billing address and tax information and tells us what we need in order to deliver what you bought.

When you create or use an account with our Software, we keep your email, an account identifier, your plan or trial and its dates, the devices you register, and records of the sessions and changes on your account. To run licensing and to protect the Software we also keep a device identifier tied to a cryptographic key, the app version and build, the time the device was last seen, and a history of IP addresses that we use as a support and risk signal, for example to spot account sharing or abuse. We never use an IP address as the identity of a device. Where a diagnostic is requested for your device, the device asks for your consent the next time it syncs, and diagnostics do not include the media you use inside the Software, camera frames, screenshots, secrets or raw system logs. Content you import into our Software stays on your device and is not uploaded to us. When you donate or unlock features, we keep the email you enter, the tier you chose and the app you were supporting, so that we can unlock the features for you and restore them later.

When you visit our website, Cloudflare Web Analytics gives us aggregated figures such as page views, referrers and country-level traffic, without cookies and without identifying individual visitors. Cloudflare also hosts and delivers our site and, as any host does, processes technical request data such as IP address, requested page and browser type in order to serve pages and block attacks. Our pages load typefaces from Google Fonts, which means your browser sends a request, including your IP address, to Google. We do not use Google Analytics, advertising pixels or social-media trackers on our site. We set no cookies of our own for tracking, and your browser may keep your theme and language choice on your own device. If you open a payment checkout, the provider may set the cookies it needs to take and secure the payment.

2. Why we use your information

We use your information to quote, perform and support the Services you ask for and to run your account, which we do because it is needed to carry out our contract with you. We use it to verify ownership, to prevent fraud, abuse, account sharing and work on stolen devices, and to keep our systems secure, which we do because we have a legitimate interest in protecting owners, customers and ourselves, and where the law requires it we do it to meet a legal obligation. We use payment information to get paid and to keep invoices and tax records, which is a matter of contract and legal obligation. We use your messages to answer you and handle complaints, and we use optional diagnostics only with your consent, which you can refuse when the device asks. We use aggregated analytics to learn which pages are useful, and we keep anonymised job statistics such as device model, country, problem type and turnaround time for quality purposes and for the figures on our portfolio page, and in those records no personal data is kept. We also use information to respond to lawful requests from authorities, to enforce our Terms and to defend legal claims.

If you are in the EEA, the UK or a similar jurisdiction, the legal bases for these uses are contract, legitimate interests, legal obligation and consent, as described above. We do not make decisions about you by solely automated means that have legal or similarly significant effects.

3. Who we share information with

We do not sell your information and we do not share it for advertising. We share it with service providers that help us run the business, namely Cloudflare for hosting, delivery and analytics, our form-delivery and email providers, WhatsApp and Telegram for messaging, our payment providers, and the cloud services that host our account systems. We share it with the rightful owner of a device or account, with the platform, carrier or manufacturer, or with the police, where we reasonably believe a device, account or licence is being used unlawfully or where the law requires or allows it, which is the main reason ownership checks exist. We also share it with advisers and authorities such as accountants, lawyers and tax or regulatory bodies where needed, and with a buyer or successor if our business or a product is transferred, with the same protections for your information.

4. How long we keep information

Device identifiers, logs and temporary working files from a job are deleted from our machines after the job is closed, unless you ask us to keep a backup for re-delivery. Recovered personal data is deleted after delivery to you, normally within 7 days. We keep a short record of what we did and agreed for 12 months after a job, to support our re-fix commitment and to deal with disputes. Payment, invoice and tax records are kept for as long as the law requires, which we expect to be six years. Account records are kept while your account is active, and after closure we keep the account together with its device, session and audit records for 24 months for security, dispute and fraud purposes, unless the law requires longer, and you can ask us to delete your account as described in section 8. Messages sent through the contact form or by email are kept for 12 to 24 months, and longer if a job or dispute follows. Website analytics are aggregated and kept under Cloudflare's own settings.

5. Sessions on your device

When we use screen-share we see only what is on your screen. When developer or recovery access is needed, we use commands limited to the agreed job, we explain what significant commands do, and you can stop the session whenever you like. We never ask for your banking credentials, your personal-account passwords or your two-factor codes, and if someone asks for them in our name it is not us.

6. Ownership-verification documents

Because we verify owners before risky work, we sometimes receive documents that contain more personal information than we need. We ask only for what shows that you own the device or have the right to work on it, and we ask you to hide your home address, national ID number, card number and any other detail we do not need before you send a receipt or invoice, and we may ask you to send a cleaned copy. We do not ask for passport or ID-card scans as proof of ownership of a device. If an official account-recovery process later requires identity documents, we will tell you where to submit them to the provider, and we do not need to see them. We use these documents only for verification, we store them privately, we share them only in the ways described in section 3, and we delete them within 30 days after verification is complete, or sooner if you ask. When we refuse a job because we suspect theft or fraud, we may keep a brief record of that so that the same request cannot be repeated.

7. International transfers

We operate from Bangladesh and our providers are in several countries, so your information may be processed outside the country where you live, including in Bangladesh and the United States. When we transfer personal information from the EEA or the UK to a country that has no adequacy decision, we rely on safeguards such as standard contractual clauses, or the equivalent that our providers offer.

8. Your rights and choices

Depending on where you live, you may have the right to ask for access to the personal information we hold about you, to have it corrected or deleted, to restrict or object to some uses, to receive it in a portable form, to withdraw a consent you gave, and to complain to your local data protection authority. To use any of these rights, message us on Telegram at @DroidRooter or write to contact@droidrooter.com. We may ask you to confirm who you are first, we reply within seven days where we can and within the time the law requires in every case, and we do not charge for reasonable requests. Some information we may need to keep despite a request, for example payment records that the law requires us to retain or records needed to defend a claim or prevent fraud, and we will tell you what we keep and why. We do not sell personal information and we do not share it for cross-context behavioural advertising, which is the practice that some US state laws regulate.

9. Children

Our Services are not directed at children under 16 and we do not knowingly collect their personal information. A parent or guardian may contact us about a child's device, and where we set up parental controls we do so at the guardian's request on a device the guardian is responsible for. If you believe that a child has given us personal information, contact us and we will delete it.

10. Security

We use access controls, encrypted transport and need-to-know access for the people who handle your information, and we delete working files when they are no longer needed. No online service is perfectly secure. If a breach affects your information, we will tell you and the authorities as the law requires.

11. Third-party links and changes

Our guides link to outside sites, such as manufacturer pages and open-source projects, and their own privacy policies apply once you leave our site. If we change this notice, we will update the date above and, for material changes, tell you through the site or your usual contact channel.

12. Contact

For questions or requests, reach us on Telegram at @DroidRooter, on WhatsApp through the link on our contact page, or at contact@droidrooter.com.