ByteFlow
Privacy policy
Effective 1 November 2026
The short version: the developer of ByteFlow runs no server for the app and receives none of your data. No account, no analytics, no crash reports and no advertising. Your files go directly between your phone and your own Cloudflare R2 bucket.
This policy covers the ByteFlow mobile app and this website.
What the developer collects through the app
Nothing. The app has no backend, and it doesn't send usage data, device identifiers, file names, credentials or anything else to the developer. It contains no third-party analytics or advertising code.
The only network service the app contacts is the Cloudflare R2 endpoint you configure, or the custom endpoint if you enter one.
What is stored on your phone
| Data | How it's kept |
|---|---|
| Your Cloudflare details (Account ID, keys, bucket, URLs) | Encrypted with AES-256-GCM, with the key protected by your device's secure hardware and your login password |
| Password verification data | Argon2id hashes and wrapped keys, never the passwords themselves |
| File-encryption key, if you turn encryption on | Encrypted in the same way as your Cloudflare details. Your passphrase isn't saved; it's held only in memory while the app is unlocked. |
| Bucket listing (file names, sizes, dates, which files are encrypted) | A local database in app-private storage by default. You can move it to a shared folder of your choice. |
| Transfer queue, sync folders and shared-link history | A local database in app-private storage |
| Thumbnails of unencrypted photos and videos | App-private storage. Encrypted files never get a thumbnail. |
| Downloaded files | App-private storage by default, or a folder you choose. Files in a shared folder are ordinary files that other apps may read. |
| Settings | Local app storage |
ByteFlow opts out of system backups, so its app-private data isn't copied to Google Drive or iCloud, or moved to a new phone by a device transfer. Files you save to a shared folder are outside this, and your phone or cloud settings may back them up like any other file.
What goes to Cloudflare
Your files, file names and folder names are stored in your own Cloudflare account, and every request the app makes goes to Cloudflare directly from your phone. Cloudflare also receives your IP address and request details as part of providing R2. That relationship is between you and Cloudflare, under Cloudflare's privacy policy.
If you turn on file encryption, file contents are encrypted on your phone before upload. File names, folder names, sizes and dates aren't encrypted.
Links you share
When you create a share link, anyone who has that link can download the file until it expires, and a link can't be cancelled early without deleting the API token behind it. If you've set up a public URL, public links are permanent and need no authentication. You decide who receives them.
Device permissions
| Permission | Why it's needed |
|---|---|
| Internet | To reach your R2 bucket |
| Biometrics or Face ID | To unlock the app with your fingerprint or face. The phone's secure hardware does the matching, and ByteFlow never receives biometric data. |
| Storage access (Android) | To read folders you choose to sync, and to save downloads or the bucket listing to folders you choose. It's requested only when you use those features. |
Deleting your data
Because everything is in your hands, so is deletion:
- Settings, Wipe everything or the destruction password erases keys, credentials and app-private data from your phone.
- Uninstalling the app removes its app-private data.
- A bucket listing or downloads you placed in a shared folder stay there after a wipe or an uninstall, until you delete them yourself.
- Files in your bucket are managed by you, through ByteFlow or Cloudflare. A wipe doesn't touch them.
This website
This site is hosted on Cloudflare Pages. It sets no cookies, uses no analytics and loads nothing from third parties; its fonts are hosted here too. Download links take you to Google Play or the App Store, which have their own privacy practices. As the host, Cloudflare processes technical request data, such as IP addresses, to deliver and protect the site.
Children
ByteFlow isn't directed at children. It requires a Cloudflare account, and the developer collects no information from anyone.
Your rights
The developer holds no personal data about you through the app, so there is nothing to access, correct or delete on their side. If you email the developer, your message and address are kept only as long as needed to reply. For data held by Cloudflare, contact Cloudflare.
Changes to this policy
If this policy changes, the new version will appear here with a new effective date. The app can't notify you, as it has no connection to the developer.
Contact
Questions about privacy: techcyber598@gmail.com