Effective date: October 11, 2026.
Operator: 权宁. Privacy contact: support@mosodive.com. Website: otterfile.mosodive.com.
1. Scope
OtterFile is an iPhone and iPad app for managing and viewing files. This policy explains the handling of information related to files, connections, purchases, website visits and support contact. Local-first does not mean every feature works offline or that third-party services retain no data.
2. Local files, preferences and previews
Files you import, create, edit or download into OtterFile are primarily stored locally in the app. File listings, favorites, reading or playback positions and display preferences support the corresponding features. Previews may create thumbnails, converted content and temporary caches.
System file interfaces, sharing, export, cloud drives, servers and local-network transfers handle relevant information and files through the channel you choose. System backups and copies you have shared, exported or sent may remain with the relevant system or recipient.
Clearing caches does not delete original files. Deletion, Trash, restoration and automatic cleanup follow the app's actual notices. Removing a connection does not delete downloaded files or close a third-party account.
3. Cloud drives and server connections
Sign-in for Baidu Netdisk, Dropbox, Google Drive and OneDrive is handled by the provider and system authorization page. OtterFile receives authorization results and uses credentials to request account information, folders and files; it does not receive the password you enter on the cloud sign-in page. For servers, the app connects directly using the address and authentication information you configure.
To distinguish accounts and avoid duplicate connections, the app reads account names, account identifiers and, where returned by the provider, email addresses. These details and connection names are stored on your device. Fields vary by provider; the current Baidu connection flow does not actively read an email address. This does not create an OtterFile real-name registration.
OAuth access and refresh tokens and server authentication information are managed through the system Keychain and used in requests to the corresponding service. Normal system authorization sessions may use existing website sign-in state. Permissions depend on the actual authorization page and previous grants; updating the app does not automatically revoke older grants.
Removing an in-app connection removes its locally saved connection and credentials, but does not revoke every service-side grant or erase access records. Manage authorizations, accounts and cloud files through the provider. Cloud services and servers may retain authentication, access, security or transaction records under their own policies.
Google API data
The Google Drive connection reads account details and file or folder metadata, and downloads files you select, for account identification, browsing, viewing and local file management. The current drive.readonly permission allows reading Drive files; it is not permission for only one selected file and does not grant remote write access.
OtterFile handles Google API data in accordance with the Google API Services User Data Policy, including its Limited Use requirements. Data supports visible file features, with transfers limited to policy-permitted purposes. It is not used for advertising, data brokerage or credit assessment, or human access outside that policy. Sharing or transferring files sends them to your chosen recipient; externally referenced content is also subject to Section 5.
4. OtterFile Pro and purchases
Apple processes payments. OtterFile uses RevenueCat to validate transactions, maintain entitlements and analyze subscriptions. RevenueCat processes subscription-related information such as purchase history and an anonymous in-app service identifier. Current operating practices do not link subscription records to real names, email addresses or cloud account identities, or share them for cross-company advertising.
Current RevenueCat SDK requests also include technical information such as device model, operating system, app and SDK versions, and preferred languages, plus the identifier for vendor (IDFV) when available. An anonymous app identifier does not mean that no device identifier is transmitted; this transmission alone does not establish cross-company advertising tracking.
We do not ask you to send your Apple account password or payment card details to support. Subscription management, cancellation and refunds are handled through Apple. Clearing caches or deleting the app does not cancel a subscription or immediately erase transaction records. RevenueCat processes end-user information on our behalf to provide the subscription services. Relevant information is retained as needed for the service, legal obligations, dispute resolution and enforcement of the service arrangement. Send related privacy requests to us; we provide processing instructions to RevenueCat where needed. Its provider privacy information does not replace this policy. Apple's independent handling is described in the Apple Privacy Policy.
5. Permissions, access locks and online content
Photo library, camera and system file access follow actions you initiate and system permission prompts. Manage permissions in system settings; refusing permission may make a feature unavailable.
Apple performs Face ID and device authentication. The app receives an authentication result, not a facial template. The app passcode supports local access verification. App and Vault locks are access controls, not a promise of additional, independent app-level AES encryption for every Vault file.
Normal HTML previews can run scripts and load remote images, fonts and other resources as soon as a file opens, without waiting for a link tap. Website code and submitted forms may send relevant content to the destination website. Temporary in-memory website storage does not prevent remote retention. EPUB and other formats use different reading strategies; HTML behavior should not be assumed for every preview. Use care with untrusted files. External websites have their own policies.
Opening the Wi-Fi transfer page provides local-network HTTP file access and upload; leaving the page stops the service. Accessing devices can see names and sizes in the local file listing, read or upload files, and retain copies. The current transfer feature has no separate sign-in confirmation. Use a trusted network and close the page when finished. OtterFile cannot delete copies a recipient has saved.
6. Third-party components
OtterFile uses MobileVLCKit to play the audio and video you open, libpag to parse and play local PAG animations, and other components for text, documents and archive processing. These components process file content, necessary file metadata, player configuration, playback time and local caches for those features. Subscription processing is described in section 4; cloud-drive, server and online-content transfers are described in sections 3 and 5. Open-source license notices do not replace this privacy policy.
Where a media source requires network access, playback may request that media source, which can receive connection and request information. This is not the same as uploading the local file library to an SDK vendor.
Some earlier app versions using a vendor-precompiled libpag include logic to send technical reports to Tencent's Beacon analytics service under SDK-version and reporting-time conditions. The reviewed report fields include app name, identifier and version, current and previous SDK versions, event time, system version, and device/GPU technical information. This does not mean every PAG opening sends a report, or that a report contains a unique device identifier or PAG file content. Clearing local caches does not automatically erase reports held by the recipient; this policy promises no specific retention period for those reports. Contact us through section 8 with related privacy questions or requests.
The current source integration now builds libpag from fixed public source, and its local PAG preview integration does not include that reporting logic. A source change does not remotely modify already-installed older versions, nor guarantee zero collection by all historical versions or components.
7. Website visits and support email
The website uses Cloudflare for hosting and delivery. Cloudflare processes website requests, potentially including IP addresses, routing, system configuration and traffic information, for delivery, security and related service processing. Actual services and the Cloudflare Privacy Policy govern that handling. This policy promises neither zero website logs nor a fixed request-record retention period.
The website provides static product information and policy pages without embedded custom analytics scripts, advertising, forms or remote fonts. It does not collect cloud passwords, OAuth codes or tokens, or accept user-file uploads.
If you email support, we receive the address, message and attachments you choose to send solely to respond to support or privacy requests, not for marketing. Do not send passwords, verification codes or tokens; prefer redacted material. Support information is retained as needed to handle the request and meet applicable legal requirements, and deleted when no longer needed. You can also request deletion, subject to required legal retention.
8. Choices, retention, deletion and contact
Manage local files, caches, connections, permissions and app preferences on your device. Third-party accounts, purchase records, service logs and sent copies are managed by the relevant service or recipient; clearing local data does not erase those records for them.
To request access, correction or deletion of personal information held by us or processed on our behalf by service processors, contact support@mosodive.com. We handle requests according to the actual processing and applicable requirements, including forwarding instructions to processors where needed. Ordinary support does not require cloud passwords or tokens, and we cannot promise immediate deletion of every third-party record.
Material changes to data handling will be reflected in the policy and effective date with appropriate notice. New uses requiring renewed authorization will require consent as applicable.