Privacy Policy

Last updated: October 20, 2026

Root My Android is designed around data minimalism: accounts are random numbers, and the default flow collects nothing about you. This policy describes exactly what is stored, why, and what never is.

1. What we store

• Account record — your randomly generated 16-digit account number, its creation time, credit balance, Nitro balance, and the Nitro ledger (purchases and consumption) attached to that number.
• Device audit snapshots — only when you explicitly sync them: device model, Android version, and audit results (for example, which installed apps participate in Android backup), keyed by an app-generated device ID. Each snapshot is overwritten by the next sync of the same device and audit type.
• Payment records — payment IDs, amounts, currencies, and transaction status as reported by the payment rail you used (currently NOWPayments, including the paying transaction ID). We never see or store card numbers, bank details, or your name.
• Guardian pairing data — when you pair the Guardian Angel app to an account, the pairing record between that account number and the managed device's ID.

2. What we never collect

• Email addresses, passwords, names, or phone numbers (there is no field to enter them).
• The contents of your backups — they are encrypted on your device with a key only you hold.
• Contacts, messages, photos, or files from your device.
• Advertising identifiers or cross-site tracking of any kind.

3. Website analytics

We measure website usage with our own first-party analytics, served from our own domain — no third-party analytics service is involved, and the data is never shared with or sold to anyone.

On the interactive app pages (account, audit, checkout), a small first-party script records the page path and title, the referring site's hostname (never the full URL), campaign (UTM) parameters when present, your coarse device type, browser, and operating system (derived from the user-agent), screen size, language, how long the page was visible, how far down the page you scrolled, and clicks on download and outbound links. All other pages ship no JavaScript at all; there, a tiny first-party pixel image records the page view and the same coarse device class — nothing else. Your approximate country, region, and city come from metadata derived at the edge from your IP address; the IP address itself is never stored.

Visitors are counted using a daily-rotating salted hash of IP address and user-agent: your raw IP address is never stored, and the hash rotates at midnight UTC, so you cannot be followed across days. We use no analytics cookies, no fingerprinting, and no cross-site tracking of any kind.

Requests from known bots and crawlers are filtered out of all of these metrics at collection time; for those we keep only a count and the bot's own user-agent string (no IP address, no visitor identity) so that we can report how much automated traffic was excluded.

4. Infrastructure

The Service runs on Cloudflare (website, API, database, and backup storage). Cloudflare processes standard edge connection metadata (IP addresses, TLS parameters) to deliver and protect the site; our /v1/device/whoami endpoint echoes this metadata back to you on request and stores none of it. Crypto payments are processed by NOWPayments; card / Apple Pay purchases, when offered, are handled by a third-party on-ramp — each provider processes your payment under its own privacy policy.

5. Children's privacy

The Guardian Angel application is a tool for parents and legal guardians to manage devices used by their minor children. It is installed and configured by the parent and syncs to the parent's account number. We do not knowingly collect any information directly from children, and no personal profile of a child is created or stored — the only records are the parent's account number and the managed device's audit data described above.

6. Data sharing and disclosure

We do not sell, rent, or share your data with anyone. Because accounts are anonymous, the only way data can be associated with you is through your account number or a payment trail on the rail you chose. We would disclose stored data only if legally compelled, and only to the extent it exists.

7. Retention and deletion

Account and ledger records are kept for the life of the account. Device audit snapshots are replaced on each new sync. To request deletion of data attached to an account number you control, contactsupport@rootmyandroid.com from the device or payment trail that proves control of the account.

8. Changes

The current version of this policy is always published atrootmyandroid.com/privacy with its revision date.