Privacy

This website

1. Controller

Michael Heitzinger
c/o Online-Impressum.de #24174
Europaring 90
53757 Sankt Augustin
Germany
Email: info@corvihome.app

2. Server and logs

This website runs on a rented server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located in Falkenstein (Vogtland), Germany. A data processing agreement under Art. 28 GDPR is in place with the hoster.

When you open a page, the server technically has to process some data to deliver it: your IP address, date and time, the requested address, the status code and the amount of data transferred. The server writes the IP address to its log only in shortened form (for IPv4 without the last block); browser identifier and referring page are not stored. The logs are deleted automatically after 7 days.

The purpose is running the website securely, for example detecting attacks and errors. The legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR).

3. No cookies, no analytics, no third-party content

• This website sets no cookies and uses no storage in your browser.
• There are no analytics, statistics or advertising services, no tracking pixels and no social media buttons.
• Fonts, images and icons are on our own server. Opening a page transfers no data to third parties.
• Two pages run a small script from our own server: on the Corvi Drop page it moves the speed bar, on corvihome.app/d it picks the language. Neither sends anything.

4. Links from Corvi Drop (corvihome.app/d)

Corvi Drop codes have the form of a web address: https://corvihome.app/d#…. If a device without the app opens such a code while online, its browser opens this website, and section 2 applies.

The part after the “#” contains the key of the transfer. Browsers do not send this part to the server, and the page does not read it. So it does not appear in the server logs either.

5. Contact by email

If you write to info@corvihome.app or support@corvihome.app, we process your email address and your message to answer you (Art. 6(1)(b) GDPR for questions about our apps, otherwise (f)). The mailbox is operated by Hetzner Online GmbH as well (web hosting, servers in Germany) as a processor. We delete messages once they are dealt with, unless legal retention duties apply.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). A short email to info@corvihome.app is enough. You can also lodge a complaint with a data protection supervisory authority.

The Corvi Drop app

1. In short

Corvi Drop transfers files directly from one device to another. We do not receive any data. There is no server of ours involved in transfers, no account, no advertising, no analytics or statistics services and no crash reports. Whatever the app stores stays on your device. The controller is the one named above.

This applies to Corvi Drop for Android and for Windows. The only connection to us: the versions you download directly from corvihome.app check now and then whether there is a new version (section 6). On Windows, history and settings are stored in the folder “%APPDATA%\Corvi Drop”.

2. What data the app processes on your device

• Files you send or receive. They are only transferred between the devices involved. The app saves received files in your device’s “Download/Corvi Drop” folder, where they stay until you delete them.
• History: date, direction, the other device’s name, file names and sizes, transfer route, duration and speed. It is kept only in the app’s private data. You can delete single entries or everything in the app.
• Settings, for example the device name shown to others (“Your name for others”). The default is the device name from the Android settings.
• Resuming after an interruption: if receiving breaks off, the app keeps the state for at most 60 minutes so it can continue: the transfer code with its one-time key, the file list and the unfinished file. After that, after completion or when you discard it, this is deleted.
• Diagnostics: technical details of the last transfer, such as route, timings, speed, local network addresses and device model. They are for troubleshooting, stay on the device and only leave it if you copy and pass them on yourself.

The legal basis for this processing on your device is providing the function you requested (Art. 6(1)(b) GDPR). We ourselves do not process any personal data in the process.

3. Transfer between devices

• The devices connect directly: on the same Wi-Fi or via Wi-Fi Direct, a direct radio link without a router. No internet is used and no server sits in between.
• Between two Corvi Drop apps the transfer is end-to-end encrypted (AES-256-GCM). The key is only in the QR code or NFC signal and is valid for this transfer only.
• The device name is sent encrypted to the other device so it can show “from [name]”.
• The QR code or NFC signal also contains the sender’s local network addresses and the access data of its Wi-Fi Direct network. Anyone who sees or scans the code can pick up the files as long as the sender offers them. So only show the code to the intended receivers.
• The code has the form of a web address (https://corvihome.app/d#…). If Corvi Drop is installed, the app opens. Otherwise the browser opens this website, and the first part of this policy applies. The part after “#”, which contains the key, is not sent to the website by the browser.

4. Receiving in a browser (for receivers without the app)

If the sender chooses “The other person has no Corvi Drop”, their phone starts a small web page. It can only be reached on the sender’s local Wi-Fi or Wi-Fi Direct network, not on the internet.

• The page shows file names and sizes and offers the files for download, one by one or as a ZIP, plus on Android devices the Corvi Drop app itself.
• The page uses no cookies, no JavaScript, no external content and no analytics.
• This transfer is not end-to-end encrypted (HTTP on the local network). It is protected by the Wi-Fi password and a random access code in the address. The sender sees how often the page was opened and what was downloaded. The page ends when the sender taps “Done” or after 15 minutes without a download.

5. Permissions

• Camera: only for scanning the QR code. No pictures are stored.
• Nearby devices (Android 13+) or location (Android 10–12): required by Android for Wi-Fi Direct. The app does not read your location.
• NFC: pass on the code by holding the phones together. Can be switched off in the settings.
• Notifications: progress during a transfer.
• Internet / network: Android needs this permission for any network connection, including between two phones on the local network. The app does not connect to any server on the internet – except, in the version from this website, for the update check (section 6).
• Install apps (only in the version from this website): so that Corvi Drop can install its own updates. Android asks you before you allow it.

6. Updates (only versions from this website)

If you download Corvi Drop directly from corvihome.app – the setup for Windows or the APK for Android, including when you got it from another phone – the app keeps itself up to date:

• Now and then it asks corvihome.app whether there is a new version: on Windows about every 6 hours, on Android about every 12 hours on Wi-Fi and when you open the app. It only fetches two small files (/download/drop-windows.json or drop-android.json with a signature).
• Only the technically necessary connection data is transmitted, as with any page request (IP address, time, requested address), plus the app’s name and version as an identifier. The rules from section 2 of the website apply: IP address shortened in the log, no browser or app identifier in the log, deletion after 7 days. There is no device ID, no account and no statistics.
• If there is a new version, the app downloads it from our server and installs it when nothing is being transferred. Every update is digitally signed; the app checks this before installing.
• You can switch this off at any time in the app under Settings → Updates (“Update automatically”). The app then never checks by itself, only when you tap “Check now”.
• Versions from a store (Google Play, Uptodown, Microsoft Store) do not contact us; there, the store updates the app.

The legal basis is our legitimate interest in providing you with bug fixes and security updates (Art. 6(1)(f) GDPR).

7. No sharing, no tracking

We do not share or sell any data and do not analyse anything. The app contains no ads, no trackers and no analytics libraries.

8. Your rights

Since we receive no personal data from you through the app, there is nothing we hold that we could disclose or delete. You can delete all of the app’s data yourself: the history in the app, everything else via “Clear app data” in the Android settings or, on Windows, in the folder “%APPDATA%\Corvi Drop”, or by uninstalling. You have the right to lodge a complaint with a data protection supervisory authority. We are happy to answer questions at info@corvihome.app.

9. Children

The app is not specifically aimed at children and does not collect data from children.

10. Changes

If the app or this website changes so that this policy is no longer accurate, we will update it. The version published here applies.

As of 6 November 2026