SandFly privacy policy

Version of 29 October 2026. This policy covers the SandFly screen reader, SandFly Pro, and the servers that receive feedback and SandFly Pro requests.

Who is responsible

Aaron Hewitt, United Kingdom. Email: aaron.graham.hewitt@gmail.com, or Settings, Help & feedback, Send feedback in SandFly.

Summary

• SandFly works on your phone. What it reads from the screen stays on the phone unless you use a feature listed below that sends it.
• SandFly has no advertising, analytics or tracking of its own, and data is never sold.
• Features that send screen content, images, audio or text to an AI service use your own account with that service, except SandFly Pro.
• The SandFly Pro agent sends screenshots and screen text to SandFly's server and Anthropic while a task runs. SandFly's server deletes them when the task ends.
• The SandFly Pro server logs every request it receives, with your IP address, for up to 7 days. The logs do not contain screen content, images or what you type or say.
• SandFly Pro is not end-to-end encrypted. What it sends can be read by SandFly's server, and so by SandFly's developer, and by Cloudflare and Anthropic. Only features that run on the phone keep data from everyone.

Encryption and who can read your data

Everything SandFly sends uses an encrypted connection (HTTPS), so it cannot be read on the way. It is not end-to-end encrypted: the receiving server decrypts it, and an AI model has to read what it is given in order to answer.

• On-device features (on-device AI, Whisper, Google on-device recognition, on-device translation, text recognition and handwriting): the data stays on the phone and no one else can read it.
• AI services with your own key: the data goes directly to the service you chose, which can read it. SandFly's servers and its developer never receive it.
• SandFly Pro (the agent and the AI service): the data passes through SandFly's server on Cloudflare, where it is decrypted and sent on to Anthropic. SandFly's developer, who runs the server, and Cloudflare could read it there, although the server does not store or log it beyond what this policy says. Anthropic reads it to produce the answer. Use an on-device feature or your own key for anything you do not want to pass through SandFly's server.
• Feedback, purchase records, codes and server logs: readable by SandFly's developer, and by the companies that host them (Cloudflare, GitHub, Stripe or PayPal).

What leaves the phone, and when

Send feedback

When you send feedback, SandFly sends what you wrote (type, area, title, app, description, steps) and the SandFly version. Depending on the switches on the form it also sends:

• Include device information (on by default): Android version, manufacturer and model.
• Email for replies (empty by default): the address you enter.
• Include SandFly log (off by default): SandFly's recent log, the last crash and the last time SandFly was turned off, with the app in front and the accessibility services turned on. The log can contain text from the screen.

Feedback goes to SandFly's feedback server (Cloudflare) and is stored as an issue in a private GitHub repository, until it is deleted. To follow replies, SandFly keeps a random token for each report and checks for replies about once an hour. The server keeps a one-way hash of the token. It also keeps a one-way hash of your IP address for two days to limit the number of reports sent.

Update checks

Automatically check for updates is on by default. SandFly asks GitHub for the latest release once a day (once an hour with development builds), sending the SandFly version. Updates are downloaded from GitHub. GitHub receives your IP address, as with any website.

AI services that use your own key

These features are off until you add an API key or download a model and turn them on. Data goes directly from the phone to the service you chose, under your account and that service's terms and privacy policy. SandFly's servers do not receive it.

• Describe image: the image.
• Describe screen and its follow-up questions: a screenshot, the text and type of up to 400 items on the screen, your questions and the language.
• Live recognition with Gemini or another AI service: camera pictures every few seconds while it runs.
• Dictation with Rambler (Gemini): the recorded audio. Correct dictation with AI: the recognized text and up to 300 characters before the cursor, never from password fields.
• Speech input other than Dictate, such as the agent's Speak button, questions about images and the screen, and voice commands, uses the same recognition and correction as dictation.
• Translation with Google Cloud, DeepL, Microsoft, LibreTranslate or an AI service: the text to translate.

The services SandFly can send to are Google Gemini, Anthropic, OpenAI, Mistral, Groq, OpenRouter, Ollama, a server address you enter, and the translation services above. On-device models, Whisper and on-device translation run on the phone.

Downloads

Models are downloaded when you ask for them, from Hugging Face, Google and FUTO. Scripts and sound themes are downloaded from the sources you add, and from SandFly's official script source on GitHub. Installed scripts are checked for updates once a day. A script you allow to use the network can send data to the addresses it chooses; SandFly asks before installing such a script.

Google ML Kit

Text recognition, language detection, on-device translation and handwriting use Google's ML Kit, which runs on the phone and downloads its language models from Google. ML Kit libraries can send usage and diagnostic data to Google, as described in Google's ML Kit terms.

Speech engines and backup

SandFly speaks through the text-to-speech engine you choose. Speech input is recognized by the recognition chosen in Dictation settings: Google on-device recognition and Whisper run on the phone, Rambler sends audio to Gemini as above, and Android speech recognition uses the service Android provides. The makers' privacy policies apply. SandFly turns off Android backup, so its settings and API keys are not copied to cloud backups. Export settings saves settings to a file you choose, without API keys.

SandFly Pro

Buying a code

Payments are handled by Stripe or PayPal, which receive your card or PayPal details under their own privacy policies. SandFly's server never sees card details. It stores the email address Stripe or PayPal gives for the payment, the payment reference, the period bought, the amount, the date and the version of the terms of sale you agreed to.

Codes and devices

Activating a code sends the code and a random ID that SandFly makes for the installation. The ID is not linked to the phone's hardware or to you. The server stores which device IDs use each code. It uses your IP address to limit how many codes can be tried. SandFly checks the code with the server when you open SandFly Pro settings and when a task finds it no longer valid. Support can add a note to a code, for example about a refund or a warning.

The agent

While an agent task runs, SandFly sends to SandFly's server, for each step: a screenshot, the text, type and position of up to 800 items on the screen, including the keyboard, and the app in front. It also sends your task, your answers to the agent's questions, the results of its actions, and the names of the SandFly commands it can run. Text the agent puts on the clipboard, and the commands it runs, stay on the phone.

The server sends this to Anthropic's Claude models: one decides the actions, and a second checks each action for safety. Anthropic processes it under its commercial terms, which do not allow training models on it. Anthropic keeps it for a limited time under its privacy policy.

SandFly's server deletes the task, screenshots, screen text and answers when the task ends, and 20 minutes after it started if it was never ended. It keeps the cost of each code's use per calendar month, to apply the monthly limit. Requests are also logged, as described under Server logs.

SandFly Pro as an AI service

When SandFly Pro is the AI service in use, the images, screenshots, screen text, camera pictures, questions and text that those features send go to SandFly's server, which sends them to Anthropic's Claude models and returns the answer. The server does not store them; it keeps the cost of each request, for the monthly limit. Requests are also logged, as described under Server logs.

Server logs

Cloudflare logs every request to the SandFly Pro server: the time, the address requested and the result. The address includes the code's ID when you add time to a code, the payment reference when Stripe or PayPal returns you to the server, and the code or email address searched for when support looks up a purchase. Each log entry also holds your IP address, the approximate location Cloudflare finds from it (country, region, city and postcode), your network provider, and the name and version of the app or browser that sent the request.

For errors and refused requests, such as an ended code, the usage limit or a failed agent step, the server adds the kind of request, the error code and the error message. The logs never contain the content of a request: no screenshots, screen text, images, task text, questions or answers.

The logs are used to find faults and abuse, and Cloudflare deletes them after at most 7 days. SandFly's feedback server does not keep logs.

Emails

If emailing codes is turned on, codes are sent to the payment's email address through Resend. It is not turned on now.

Who processes data for SandFly

• Cloudflare: hosts SandFly's servers and databases, and keeps the SandFly Pro server's logs.
• GitHub: stores feedback.
• Anthropic: runs the SandFly Pro agent.
• Stripe and PayPal: handle payments, as independent controllers of payment data.
• Resend: would send code emails, if turned on.

These companies are mostly in the United States. Data goes to them under the safeguards they provide for transfers from the UK, such as the UK–US data bridge or standard contractual clauses.

Legal bases

• Performing the contract: SandFly Pro codes, activation and the agent.
• Legitimate interests: answering feedback, preventing abuse and fraud, limiting requests, finding faults with server logs.
• Legal obligation: keeping purchase records for tax.

How long data is kept

• Agent tasks: until the task ends, at most 20 minutes after it starts.
• Feedback: until the report is deleted. Ask to have yours deleted at any time.
• Purchase records: as long as UK tax law requires, currently about six years after the end of the tax year.
• Codes, device IDs and monthly use: while the code can be used, and then with the purchase records.
• Hashed IP addresses for feedback limits: two days.
• SandFly Pro server logs: at most 7 days.

Your rights

You can ask for a copy of your data, and to correct or delete it, restrict or object to its use, or receive it in a portable form. Write to the address above. If you are not satisfied with the answer, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

SandFly Pro is sold to adults. Anyone under 18 needs a parent or guardian to buy it.

Changes

When this policy changes, the version date at the top changes, and SandFly Pro buyers are asked to agree to the new version.