Privacy Policy for NAS Manager
NAS Manager is an independent, unofficial application. It is not affiliated with, endorsed by, or sponsored by QNAP Systems, Inc.
1. Scope
This Privacy Policy explains how NAS Manager accesses, uses, stores, and protects information. NAS Manager is a client for network-attached storage devices selected and configured by the user. Connections are made directly between the Android device and the configured NAS. The developer does not operate an intermediary service for these connections.
2. Information handled by the application
Depending on the features used, NAS Manager may process:
- NAS names, network addresses, usernames, passwords, connection settings, certificate choices, trusted-login tokens, and session identifiers;
- two-factor authentication codes entered during login;
- system status, resource usage, processes, services, logs, alerts, notices, and background tasks;
- file and folder names, metadata, permissions, and content selected for upload or download;
- Container Station applications, containers, images, volumes, logs, YAML configuration, and interactive shell input and output;
- Download Station tasks, search keywords, download addresses, torrent files selected by the user, RSS feeds, and the username and password entered for a download that requires a login;
- NAS user accounts and groups: names, descriptions, email addresses, phone numbers, group memberships, shared-folder and application permissions, and the passwords entered when creating an account or changing its password;
- App Center applications installed on the NAS and the catalog of available applications;
- firewall, antivirus, malware-removal, remote-access, and other supported NAS settings.
This information is processed only to provide functions requested by the user.
3. Information collected by the developer
NAS Manager does not include advertising, analytics, telemetry, crash-reporting, or developer-operated cloud services. The developer does not receive NAS credentials, authentication codes, files, NAS logs, or NAS configuration through the application. Subscription purchases are processed by Google Play Billing.
Information sent directly to a NAS is not sent to the developer. The NAS and its installed services may process or retain information according to their own configuration and policies.
If a user contacts the developer for support, the developer receives only information voluntarily included in that request, such as an email address, message, diagnostic details, or attachments. It is used to answer the request and investigate the reported issue.
4. Local storage and security
NAS connection profiles are stored locally on the Android device.
- Passwords are stored only when the user explicitly chooses to remember them.
- Trusted-login tokens are stored only when the user enables trusted login.
- Stored credentials and tokens are encrypted using Android cryptographic storage backed by Android Keystore facilities.
- Two-factor authentication codes and TOTP secrets are not stored.
- Biometric data is handled by Android. NAS Manager does not receive or store biometric templates or raw biometric information.
- Android cloud backup and device-transfer backup are disabled for the application.
When home-screen widgets are added, NAS Manager reads the information they show from the NAS in the background, about every 15 minutes and when the user asks for an update. The last values read (for example status, resource usage, storage, downloads, containers, applications, security status, and recent log entries) are kept on the device to draw the widgets, and the session used for these reads is stored encrypted like the credentials above. Widgets are drawn by the Android home screen on the device; their content is not sent anywhere else.
Downloaded files and exported reports may remain in app storage or user-accessible device storage until deleted by the user or removed with the application, depending on the selected destination and Android storage behavior.
5. Network communications
NAS Manager communicates with NAS addresses configured by the user. NAS connections use HTTPS. The application may let the user explicitly trust a self-signed certificate presented by a configured NAS. The selected certificate information is retained locally for subsequent connections.
The security and availability of each connection also depend on the NAS configuration, certificate management, network, remote-access configuration, and services controlled by the NAS owner.
6. File access
For uploads, NAS Manager uses the Android system file picker and receives access only to items selected by the user. Downloads, reports, YAML files, packet captures, logs, and other exports are created only following a user action. Another application receives access only when the user opens or shares a file through Android, or when the file is stored in a user-accessible location.
7. Sharing of information
NAS Manager does not sell personal information and does not share it with advertisers, data brokers, analytics providers, or developer-operated servers. Information may be transmitted only to:
- the NAS and NAS services selected by the user, as required for requested operations;
- Google Play, when checking, purchasing, restoring, or managing a subscription;
- applications selected by the user when opening or sharing content through Android;
- the developer, when the user voluntarily submits a support request.
8. Subscriptions and payments
Optional Advanced and Complete subscriptions are offered through Google Play. NAS Manager receives the selected product identifier, purchase state, purchase token, and acknowledgement state needed to unlock and restore the purchased features. Payment credentials, such as card or bank details, are collected and processed by Google Play and are not available to NAS Manager or the developer.
Subscriptions renew and can be managed or cancelled through the user's Google Play account. Google processes billing information according to its own privacy policy and terms.
9. Retention and deletion
NAS profiles and locally stored credentials remain on the device until the user removes the profile, forgets trusted login, clears app storage, or uninstalls the application. Removing a NAS profile deletes its locally stored password, trusted-login token, certificate choice, related configuration, and the widget information and widget session kept for it. Removing a widget stops its background reads. Logging out invalidates the active NAS session but may preserve trusted-login information until explicitly removed.
Files exported outside private app storage may need to be deleted separately. Removing a profile does not delete the corresponding account or data from the NAS.
Support correspondence is retained only as long as reasonably necessary to answer the request, resolve disputes, maintain security, and meet legal obligations.
10. Demo mode
When the built-in demo credentials are used, representative NAS responses are generated locally on the device. Demo mode does not contact a demo server and does not modify an external NAS.
11. Children's privacy
NAS Manager is a system administration utility and is not designed or directed to children. It does not knowingly collect personal information from children through a developer-operated service.
12. Third-party software and services
NAS Manager uses Android platform components and open-source libraries for app functionality. They are not used by the developer for advertising or behavioral tracking. A configured NAS, its operating system, installed applications, and network services are controlled by the NAS owner or their respective providers, and their data practices are outside the developer's control.
13. Changes to this policy
This policy may be updated when app functionality, data practices, legal requirements, or distribution requirements change. The effective date will be updated when a revised policy is published.
14. Contact
Davide Zanella
davide.zanella10@gmail.com