SumaFlow Digest does not see your documents. The app imports, reads, redacts, extracts from, and summarizes your documents entirely on your phone or tablet. There is no server for your data to travel to.
No data collected. No data shared with third parties.
This is the posture Digest's Google Play Data Safety card declares.
SumaFlow Digest is in open beta — Google Play open testing, free to join and free to use while it lasts. Beta status changes what is polished, not what is private: the architecture this policy describes is the one that ships, and none of the promises below are relaxed for testers. We collect nothing extra from beta users — no usage analytics, no crash telemetry, no tester profile.
Data collected
None. Your documents, the text recognized from them, your redactions, extractions, summaries, and metadata are created and stored on your device. They are never transmitted to SumaFlow or to any third party, because there is no SumaFlow server to receive them.
Data shared
None. No data is shared with third parties. The app contains no analytics SDKs, no ad SDKs, and no crash reporting that phones home.
What stays on your device
- Documents — PDFs, scans, photos, and DOCX files you import or capture; encrypted the moment they are ingested.
- Recognized text — OCR runs locally via Google ML Kit's on-device text recognition; the cloud variant is forbidden and regression-tested against.
- Redactions, extractions & summaries — generated locally by Gemma 4 E2B via LiteRT-LM, or by a deterministic extractive engine on RAM-constrained devices.
- Collections & metadata — document titles, optional client/project labels, and dates.
- Export audit log — a local, append-only record of every export you make (timestamp, destination, and a SHA-256 fingerprint of what was exported). It is your record, on your device, and it is free — never paywalled.
Security practices
- Encrypted at rest. Files are encrypted with AES-256-GCM; documents, extractions, and redactions live in a SQLCipher-encrypted database. Keys are held in the Android Keystore (StrongBox where available). No plaintext is persisted.
- App lock. A biometric or PIN gate protects the app on launch and resume, so a lost or stolen device is not a breach.
- No data in transit. The core app makes no outbound network calls carrying user content. Cleartext (non-HTTPS) traffic is disabled at the manifest level, and Android backup is switched off so your encrypted data never rides along in a device backup.
The one network use
The app's INTERNET permission exists for exactly one purpose:
optional, opt-in, Wi-Fi-gated downloads of the on-device AI models from
huggingface.co (the Gemma 4 E2B model, and the optional
higher-fidelity E4B model). These downloads pull a public model file
down to your device — they never upload your content — and each is
SHA-256-verified against a pinned commit. After download, all processing runs
on-device. A privacy regression test enforces huggingface.co as the
only allowed host. The full detail is on the
privacy architecture page.
In-app purchases
SumaFlow Digest Pro will be an optional in-app purchase processed by Google Play. We run no payment server and receive no payment details — your card, billing address, and Google account are handled by Google, not by us — and buying Pro creates no account with SumaFlow. Pro unlocks app features only; it does not change where your documents live, and the billing channel carries none of your content. Purchases are governed by Google Play's own terms and privacy policy.
What leaves your device
Only an export you explicitly initiate (PDF, share sheet, or copy). Redacted exports go through a mandatory review step — you confirm every redaction before anything leaves — and every export is recorded in the local audit log. Where the data goes next is governed by the receiving app's own privacy policy.
Redaction, honestly
Redaction is assisted, never guaranteed complete. Names and unusual formats can be missed, which is why the review step is mandatory and you remain the final authority on what leaves your device. We never claim automatic or complete redaction, anywhere.
Diagnostics
There is no remote crash reporting. If something goes wrong, the app keeps an on-device, user-readable diagnostic log that you can choose to export and send to us. It is never sent automatically.
Data deletion
You control retention. Deleting a document or a collection performs a cryptographic erase — the keys are destroyed, rendering the data unrecoverable. Uninstalling the app destroys all keys and has the same effect on everything.
Children
SumaFlow Digest is designed for professional use and is not directed at children under 13.
Contact
For privacy questions or data-rights requests, email [email protected]. For security reports, [email protected].