XerahS Download
Privacy

Your files go where you send them.

XerahS has no servers and no accounts. It doesn't know who you are. This page lists what the app keeps on your phone and every time it talks to the internet.

Last updated 30 October 2026, for version 0.8

The short version

  • No analytics, no tracking, no ads and no crash reporting. Nothing about how you use the app is sent anywhere.
  • Files only go to the destinations you set up yourself.
  • Passwords, API keys and tokens are kept in Android's encrypted storage and left out of Android backups.
  • Apart from your uploads, the app makes a few requests of its own. They're all listed below.

What stays on your phone

Everything below lives in the app's private storage. Other apps can't read it, and it's deleted when you uninstall XerahS.

Upload history
For each upload: the file name, size and type, the link, the delete link if the host gave one, which destination and profile it went to, and when. It also keeps a SHA-256 hash of the file, which is how XerahS notices when you upload the same thing twice. Albums and tags live here too.
Settings and profiles
Your preferences and the names of your upload profiles. Secrets are not stored here.
Thumbnails
Small previews for the history list.
Copies of your files
When you share or pick a file, XerahS makes its own copy straight away so the upload can run in the background. Copies that aren't in your history any more are cleaned up after a week.
Local uploads
If you upload to the Local destination, the file is kept in the app's folder and removed when you delete it from history.
Passwords and keys
Stored with Android's encrypted shared preferences, using a key held by the Android Keystore.
SFTP host keys
The fingerprint of each SFTP server you connect to, so XerahS can warn you if it changes. Fingerprints are public, so they're stored with the other settings.
S3 previews
The S3 explorer caches image previews, up to 50 MB, in the app's cache.

Backups

Android backup

If Android backup is turned on, your history, albums, tags and settings can be included in your Google backup or a transfer to a new phone. These are always left out:

  • passwords, API keys and tokens;
  • the copies of your files, the thumbnails and Local uploads.

So after a restore you'll need to enter your passwords again.

XerahS backup

Settings, Backup exports a file that you save wherever you like. It does include your passwords and keys, so it's encrypted with a passphrase you choose (AES-256-GCM, with the key derived using PBKDF2). Without that passphrase the file can't be opened, by you or anyone else.

When XerahS goes online

Your uploads

Files go to the destination you pick, signed in with the details you entered for it. That might be Imgur, your S3 bucket, your Nextcloud, or any other host you set up. From then on, that service's own privacy policy applies to the file.

Photos can carry GPS location and camera details. Turn on Strip EXIF metadata under Settings, Uploads to remove them before upload. It's off by default.

Update check

About once a day, when you're online, XerahS asks the GitHub API for the latest release of XerahS for Android. It also checks when you open Settings, Updates. If you download an update in the app, the APK comes from GitHub too. GitHub sees your IP address, as with any web request.

Link shortener

Only when you shorten a link, that link is sent to is.gd, or to the shortener you picked instead, such as Bitly.

Upload from a link

When you ask XerahS to upload the file behind a link, it downloads that file from the address you gave it.

Text recognition

OCR runs on your phone using Google Play Services. The first time you use it, Play Services may need to download the recognition model. Your images are not uploaded for this.

Permissions

Internet
To upload, and for the requests listed above.
Notifications
Upload progress, failures with a Retry button, and new screenshot offers.
Photos
Only asked for when you turn on screenshot uploads, so XerahS can see new screenshots. Picking a file yourself doesn't need it.
Foreground service
Keeps an upload running when you leave the app.
Biometrics
For the biometric lock under Settings, Security, if you turn it on.
Install apps
Lets XerahS install an update you downloaded in the app. Android asks you first.

Questions

XerahS for Android is open source, so you can check all of this in the code on GitHub. If something here is wrong or you have a question, open an issue on GitHub Issues.