Privacy Policy: SC Photos, SC Drive and SC Server
Publisher: Second Core
Contact: [email protected]
Effective date: November 3, 2026
This policy covers three Android apps published by Second Core: SC Photos (photo backup and gallery), SC Drive (files) and SC Server (turns a phone you own into the server for the other two).
The short version
- Your photos and files stay on your own server phone. Second Core never receives them. On your home network they go straight to your server phone. When you use remote access, they pass through our relay inside an encrypted connection that only your phone and your server phone can open; the relay counts bytes and cannot read the content.
- You can use the apps at home without an account. An account is needed only for remote access and for Second Core Pro.
- The apps show ads through Google AdMob. Second Core Pro (a one-time purchase) removes them.
What we collect and why
| Data | When | Why | Who processes it |
|---|---|---|---|
| Email address, name and account ID from Google or Apple sign-in | Only if you sign in | Your account, remote access quota, Second Core Pro | Google Firebase (on our behalf) |
| Remote access quota records: bytes moved over the relay, times, bytes earned from rewarded ads | Only when you use remote access or watch a rewarded ad | Counting your allowance and preventing abuse | Our backend on Google Firebase; our relay server |
| Purchase records: order ID and a one-way hash of the purchase token | Only if you buy Second Core Pro | Granting Pro, restoring it, handling refunds | Google Play; our backend |
| App and device integrity tokens (Firebase App Check, Play Integrity) | When the app talks to our backend or relay | Confirming that requests come from the genuine app | |
| An anonymous ID for each server phone | When SC Server uses remote access | Registering your server with the relay | Google Firebase; our backend |
| Advertising ID, app set ID, IP address (approximate location), ad interactions and diagnostics | While ads are shown | Showing and measuring ads, preventing ad fraud | Google AdMob, as described in Google's own policy |
Your IP address reaches our relay when you connect to it. The relay keeps it in memory only, to limit connection rates, and does not log it.
What stays on your phone: the Wi-Fi network name (read with the location permission only to tell whether you are at home), the camera image when you scan a pairing QR code, and transfer statistics.
Ads and consent
Before the first ad, where the law requires it, the app asks for consent through Google's consent form. Without consent, ads are non-personalized. Where that form applies, you can change or withdraw your choice at any time in each app's Settings → Privacy choices. In Android settings you can also reset your advertising ID or opt out of personalized ads. Second Core Pro removes ads from all three apps for the account that bought it. On SC Server you sign in with that same Google account, and that sign-in has no other effect.
Google's use of advertising data is described at https://policies.google.com/technologies/partner-sites.
Sharing
We do not sell your data. Data reaches only:
- Google, as our service provider for Firebase (sign-in, database, functions) and Play (purchases, integrity);
- Google AdMob, for ads, as listed above.
We may disclose data if the law requires it.
Security
All traffic is encrypted in transit (HTTPS or TLS). Connections to your server phone are pinned to that phone's certificate.
Retention and deletion
- Account and quota records are kept while your account exists.
- You can delete your account in SC Photos: Settings → Delete account. This removes your quota records, purchase records and your sign-in account from our backend, and you lose Second Core Pro on that account. SC Drive uses the same account; delete it from SC Photos or ask us at [email protected]. The web page for deletion requests is https://secondcore.dev/delete-account/.
- Deleting your account does not touch the photos and files on your server phone; they are yours and remain there.
- Uninstalling an app removes what that app stored on the phone.
Children
The apps are not directed at children under 13.
Your rights
Depending on where you live (for example under the GDPR or Türkiye's KVKK), you may ask to access, correct or delete your data, or object to its processing. Write to [email protected].
Changes
We will post changes here and update the effective date.