OneBox Privacy Policy

1. Overview

OneBox (also published under the name WanBaoHe on Chinese app stores, package com.shifenmiao.app) is a free image / document / AI toolbox. This policy explains what data the app collects, why, and how you can control it.

The operator of OneBox is referred to as "we", "us", or "OneBox" throughout this document. Contact: support@oneboxable.com.

2. Data We Do NOT Collect

• Your location (GPS / network-based)
• Your contacts, call logs, or SMS
• Camera or microphone content. Camera and microphone are used only for local on-device image/audio processing; no frames are uploaded to our servers.
• Your photos or documents unless you explicitly send them to a cloud service (e.g. WebDAV) you have configured yourself, or to an AI feature you trigger manually.
• Advertising ID or any cross-app tracking identifiers.

3. Data We Collect

3.1 Crash and performance data (Google Play flavor only)

We use Firebase Crashlytics to collect crash reports. A crash report contains the stack trace, device model, OS version, app version, and locale. Reports are sent to Google servers (US/EU). You can opt out by uninstalling the app or by disabling Wi-Fi and mobile data before launch — Crashlytics will then have no opportunity to send.

3.2 Usage analytics (Google Play flavor only)

We use Firebase Analytics to count app launches, active users, and which features are used. Firebase Analytics collects a randomized device identifier and the events listed above. No personally identifying information is attached.

3.3 Data sent to our backend (api.wanbaohe.com)

Every API request includes a synthetic device identifier (UUID generated on first launch, stored locally; you can erase it via "Clear Data" in Android settings) plus device model, brand, OS version, and network type. This is used only for diagnostics, rate limiting, and abuse prevention. The identifier is not linked to your real-world identity.

3.4 User-supplied content for AI features

If you use an AI feature (chat, document parsing, etc.), the text and/or images you submit are forwarded to the corresponding AI provider (OpenAI for chat, Baidu PaddleOCR for documents) via our backend proxy. The provider's usage policy then applies. We retain chat history in your local database only; you can clear it at any time via the in-app "Clear Data" action.

3.5 User-supplied cloud storage credentials

If you configure an external WebDAV or S3-compatible storage, your connection URL, username and password are stored locally in encrypted form using Android Keystore. We never transmit these credentials to our backend. The files you upload go directly from the app to the storage provider you selected.

3.6 Local app data

Settings, recent files, AI prompts, and bookmarks are stored in a local Room/SQLite database and an MMKV key-value store. They never leave the device unless you explicitly use a feature that sends them (AI chat, cloud sync, etc.).

4. Third-party Services

• Google Firebase (Crashlytics + Analytics) — governed by Firebase Privacy.
• OpenAI (only when you use the OpenAI engine) — governed by OpenAI Privacy Policy.
• Baidu PaddleOCR (only when you use the Baidu engine) — governed by Baidu Privacy.
• WebDAV / S3 providers you configure yourself — your relationship is directly with that provider.

5. Data Retention

• Crash reports and analytics: up to 90 days in Firebase, then aggregated.
• API request logs on our backend: up to 30 days, then deleted.
• Local app data: until you uninstall or tap "Clear Data".
• Cloud storage files: governed by the third-party storage provider's retention policy.

6. Your Rights (GDPR & CCPA)

If you are in the European Economic Area, the United Kingdom, or California, you have the right to:

• Request a copy of any personal data we hold about you
• Request that we correct or delete your data
• Object to processing or request restriction
• Data portability (receive your data in a machine-readable format)
• Withdraw consent at any time (by uninstalling the app or clearing data)
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email support@oneboxable.com. We respond within 30 days.

7. Children's Privacy

OneBox is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

8. International Data Transfers

Firebase servers are located in the United States and the European Union. By using OneBox, you consent to transfer of your data to these regions. We rely on Standard Contractual Clauses and Google's data processing addendum for such transfers.

9. Security

Data in transit is encrypted with TLS 1.2+. Local credentials are stored in Android Keystore. However, no method of transmission or storage is 100% secure; we cannot guarantee absolute security.

10. Changes to This Policy

We may update this policy. The "Last updated" date at the top will reflect the change. For material changes, we will show an in-app notice on the next launch.

11. Contact

OneBox / WanBaoHe
Email: support@oneboxable.com