Security, explained precisely
Between two Corvi Drop apps every transfer is end-to-end encrypted with AES-256-GCM. The key is only in the QR code or the NFC signal and is new for every transfer.
Every piece is checked by the receiver. Anything altered on the way is not saved.
There is no server of ours, no account, no ads, no tracking and no crash reports. Corvi Drop keeps the history only on your phone.
Permissions – and what for
| Permission | What for | When asked |
| Camera | Scan the sender’s QR code. No pictures are stored. | On the first “Receive” |
| Nearby devices | Set up the direct Wi-Fi connection between the phones. Explicitly not for location. | On the first send or receive |
| Location (Android 10–12 only) | These Android versions require it for Wi-Fi Direct. Corvi Drop does not read your location. | On the first send or receive |
| NFC | Pass on the code by holding the phones together. Can be switched off in the settings. | Not asked |
| Notifications | Show progress and “Cancel” when you leave the app during a transfer. | Once; “Without” works too |
| Internet | Android needs it for any network connection, even between two phones. Corvi Drop connects to no server. | Not asked |
Not used: storage and media permissions, contacts, microphone, phone, SMS, accessibility, accounts, advertising ID. More in the privacy policy.