What leaves your device

AutoFile sends the text extracted from a document — or the image of its first page when there is no text to read — and the tree of your filing folders, both the ones you have shown it and the ones it has created itself. These paths carry the names you gave them: your bank's, your doctors', your employer's. The document you share with AutoFile goes directly to a Drive you have linked to AutoFile. A file made with one of the app's tools can also be sent, by you, wherever you choose.

What leaves the device

What	To where	Why	Retention
The text extracted from the document (roughly the first 6,000 characters) — or, when the document is a scan or a photo with no text to read, the image of its first page only, in greyscale. Never the following pages, never the file itself. An image made from a PDF page by a tool and then filed is a document in its own right: it is read and sent like any other document, and this rule applies to each one	AutoFile server, then the AI provider	To propose a file name and a folder	Not kept by AutoFile
The original file name — the one the document had when you shared it, which can be telling on its own	AutoFile server, then the AI provider	It often carries a date or a sender that the text does not give, and that is what lets the app name a document that reading alone was not enough to identify	Not kept by AutoFile
The tree of your filing folders: up to 150 paths, or 6,000 characters, with the year and month levels removed. These paths contain the names you gave your folders. Alongside it travels a plain yes or no: whether your folder tree had to be cut down to fit this ceiling — never the number of folders you actually have	AutoFile server, then the AI provider	So the model files into a folder that already exists, instead of having a new one created under a slightly different name	Not kept by AutoFile
Failing a folder tree — when AutoFile could not read it, or this sending is switched off — the name and path of up to 10 folders, chosen among the ones it knows	AutoFile server, then the AI provider	So the model files among your folders, instead of inventing one	Not kept by AutoFile
Up to 60 names of organisations for which you have already filed a document, each with its domain and the last type used	AutoFile server, then the AI provider	So the same company is written the same way and filed in the same place, instead of ending up in three different folders	Not kept by AutoFile
The app's language	AutoFile server	To draft a fallback title when the model offers nothing usable	Not kept by AutoFile
A random identifier, specific to the installation	AutoFile server	A daily cap, so that one device cannot use up the whole analysis budget	A counter, cleared after 48 hours
The file of a document you share	A Drive you have linked to AutoFile, from the device to Google	This is the whole point of the app	In that Drive, under its owner's control
A file made by a tool: PDF, images, ZIP archive	Wherever you send it yourself, through the phone's share sheet; or a Drive you have linked to AutoFile, if you file it	You choose to send it, and where to	With the recipient you chose, under their own rules; in the Drive where you filed it, under its owner's control
The list of documents already filed, one per linked account: for each one, a fingerprint of its bytes (size and MD5), the date of filing and the Drive folder it went into (its identifier and its displayed path). Never the document's name, never its content. It carries the identifier of the Google account concerned and holds 20,000 entries at most. When you move a document from one profile to another, the list of the account it leaves also notes its fingerprint and the date of removal, so that it no longer counts as filed there (the removals table)	The Drive of each Google account you give access to, from the device to a `.autofile-filed.json` file that AutoFile creates at the root of that account's “My Drive”, never in a shared folder. Neither the AutoFile server, nor the AI provider, nor Sentry receives any of it	To recognise a document shared a second time before it is read, analysed or counted, and tell you “Already filed”, with the date and the folder — after a reinstall too, and on every phone of the account	In the Drive of each account, until you erase it: “Delete my data”, or from Google Drive (see “Deletion”)
Moving a document from one profile to another: a request to Google Drive to change the file's folder, or to put the original in the trash. Never its content	The Drive of the account where the original is, from the device to Google, with that account's access only	To file the document in the other profile without keeping two copies	In Drive's trash, where Google keeps the file for 30 days before erasing it; you can take it out before then
The identifier of your Google account (the “sub”, a number)	AutoFile server, and RevenueCat; and Google, for a video that tops up documents (see “Advertising”)	To keep your document balance, and to recognise a subscriber. This is what makes your balance and your subscription follow your account, not your phone	Until the account is deleted
Your document balance	AutoFile server	To know how many documents you have left	Until the account is deleted
The day of your last successful analysis: a date, with no time, in universal time	AutoFile server, next to your balance	To count the accounts active today and over the last 30 days, without keeping a list of accounts. The counters receive only the move from one day to the next: they keep totals, with no identifier	Replaced on your next day of use; erased by “Delete my data”. You can object to it (see “Your rights”)
Two usage measurements, and nothing else: an ad video shown, and whether it was closed before the end (top-up or tool); a suggested name and folder saved as is, or changed. Never a document, a file name or a folder	AutoFile server. Not Google, nor any third party	To know how many videos are abandoned, and whether the suggestions are right. The request carries your account's token, used only to refuse a blocked account or to leave out an account that has objected: it is neither logged nor kept. Unrelated to advertising consent	A total per day, with no identifier
Your phone's type (Android or iPhone), sent with every request, and your account's first sign-in	AutoFile server. Not Google, nor any third party	To break down the documents filed by phone type, and to count the accounts signing in for the first time, per hour and per phone type. The counters receive only the hour and the phone type: they keep totals, with no identifier	A total per hour, with no identifier. You can object to the counting of your first sign-in (see “Your rights”)
The device's advertising identifier	Google, through the Google Mobile Ads SDK	To show and measure the rewarded video, whether it tops up documents or is used for a tool	As set by Google. Resettable in your phone's settings
The identifier of your Google account (the “sub”), for a video that tops up documents only	Google, through the Google Mobile Ads SDK, which passes it back to the AutoFile server once the video has been watched	To check that the video was watched to the end before crediting your documents. A tool video does not send it	As set by Google
Crash reports	Sentry	To know when the app breaks	90 days at most
Subscription status and purchase history	RevenueCat	To know which plan and which rights are open	As set by RevenueCat
Identifiers of purchases already credited	AutoFile server	To prevent a purchase from being credited twice	For as long as AutoFile is offered, including after the account is deleted, with nothing that identifies you
Mark that the welcome documents have already been given	AutoFile server	To prevent getting them again by recreating the account (fraud prevention, legitimate interest)	For as long as AutoFile is offered, including after the account is deleted; an encrypted fingerprint of the account identifier, nothing else

What never leaves the device

The file of a document you share with AutoFile, anywhere other than to a Drive you have linked to AutoFile. A file made by a tool, on the other hand, can go wherever you send it yourself (see above).
Any file name, folder name or document content, inside a crash report or a measurement event. Those events only carry durations, counters, booleans and fixed values.
Your Google access tokens, and the refresh token of each account linked through the browser: they stay in the Android vault (Keystore).
The memory of each profile's folders and the filing history. They live in the app's private storage, on the phone only. Apart from your documents, the only thing AutoFile keeps in each linked Drive is the list of documents already filed, described above.
Your contacts, your location, your photo library.

Rating the app. When the app asks you for a rating, the window is the store's own (Google Play or the App Store): the rating and the review go straight to the store, and AutoFile does not receive them.

What is stored on the device

What	Where	Deleted when
The copy of a shared document	The app's working directory	2 days after it is filed, except while the original of a move is still to be removed; 30 days after a failure nobody can retry
The list of your profiles (their name and each one's account) and, for each profile, the memory of its folders and the filing decisions	The app's documents directory	On sign-out, when the profile is deleted, or on uninstall
The lists of documents already filed, one per linked account (fingerprint, date, folder)	The app's documents directory	On sign-out, when the profile whose account is no longer used is deleted, or on uninstall. Their copy in the Drive of each account is kept, unless you choose to erase it by deleting the profile
The “original to remove” note: the account, the folder and the fingerprint of the original of a document that was moved. Never its name	The app's documents directory	As soon as the original is in the trash or was left in place, or on sign-out. While it exists, the copy of the document also stays on the phone
Copies of the files chosen in a tool, and the PDFs, images and ZIP archives it makes	The app's cache directory	The next time a tool is opened, when the app starts, and with “Delete my data”. A file you choose to file is first copied into the list of documents waiting, and then follows that row
Google tokens — including one refresh token per account linked through the browser — , the address of each linked account, and the installation identifier	System vault (Keystore)	On sign-out, when the profile whose account is no longer used is deleted, or on uninstall

Locked profiles. If the subscription stops, the profiles beyond the oldest one are locked: AutoFile files nothing in them, but keeps their name, their folder memory and their lists on the phone, with no time limit, until you sign out or delete the profile. They become usable again with a subscription or lifetime access.

The artificial intelligence provider

AutoFile calls Google Gemini, through its own server. Three consequences, stated plainly:

The paid tier is used, and that is deliberate. Google's free tier allows the content sent to be used to improve its products. That is not acceptable for someone's personal documents. The paid tier carries the opposite commitment.
What the provider receives contains neither your account, nor your email address, nor your device identifier: nothing tells it that two documents came from the same person. But that does not make it anonymous, and it needs saying: the text of a document carries your name, and the tree of your folders carries those of your doctors, your bank and your employer.
AutoFile does not use any of this to train a model, and does not authorise anyone else to do so on its behalf. That is a commitment, not merely a restriction imposed by the contract that binds us to the provider.

Advertising

AutoFile shows a single form of advertising: a rewarded video, which you request yourself — to top up your document balance, or to use a tool from the Tools tab without a subscription. A tool video tops up no documents. There is no banner, no interstitial, and no ad ever appears while you are filing a document.

It is served by Google Mobile Ads, which reads your device's advertising identifier to choose the ad and measure its display. This identifier is specific to the phone, not to you: you can reset it, or ask for non-personalised ads, in Android's settings — Settings, Google, Ads.

For a video that tops up documents, Google also receives the identifier of your Google account (the “sub”, a number — not your email address), on top of the advertising identifier: this is how Google confirms to the AutoFile server that the video was watched to the end, before your documents are credited. A tool video sends neither this identifier nor anything beyond what Google's SDK requires to serve the ad.

Subscribing removes advertising entirely: a subscribed account never loads an ad, and so never passes on an advertising identifier.

No content of your documents is passed on to the ad network. The text that is read goes to the AI provider and nowhere else; the ad, for its part, knows nothing about the document you were filing, nor about the files you put through a tool: not their names, not their page count.

Access to Google Drive

AutoFile requests a single Google Drive permission, and nothing else: drive.file.

drive.file only grants access to files AutoFile has created, plus those you explicitly hand it through Google's picker. AutoFile therefore cannot read your Drive, list your folders, or see a document it has not placed there itself.

The list of documents already filed is one of those files: .autofile-filed.json, which AutoFile creates at the root of “My Drive”, never in a shared folder. It is visible in Drive, read only by AutoFile and by you, and deleted like any other file. It lets AutoFile recognise a document you share a second time, even after a reinstall or on another phone.

This is a product decision, not a technical limit. The permissions that would allow reading an entire Drive are classified “restricted” by Google. AutoFile will not request them.

Several Google accounts

Each profile can file into another Google account, which you link yourself. AutoFile asks that account for the same permission, drive.file, and nothing else: no identity, and no reading of its other files. The account's address is read from Drive to check that it is the account you meant; it stays in your phone's vault.

Depending on the device, the account is linked through Google's screens built into the phone, or through the browser. In the second case, AutoFile keeps in the phone's vault a refresh token specific to that account, to get Drive access back without showing you Google's screen again. It is used for that account only, is never sent to the AutoFile server, and is erased on sign-out or when no profile uses the account any more.

A .autofile-filed.json file is created at the root of the “My Drive” of each Google account you give access to, and only there. Two profiles that share an account share that file.

Moving a document

If you share from Google Drive a document already filed in another profile, AutoFile offers to move it. It files it in the chosen profile like a new document, then, only if it finds the original with certainty in the account it comes from, puts it in that account's trash, using that account's access only. Google keeps the trash for 30 days; AutoFile never erases anything permanently. Within the same account, it changes the file's folder, with no copy. If the account it comes from no longer answers, the document is filed, the original stays where it is, and AutoFile tries again as soon as the account is connected again.

Someone else's account

Filing into a relative's account is allowed only if you have their agreement, or the power to represent them (see the terms of use). AutoFile then puts files, including .autofile-filed.json, in that account, where its owner can see them. Nothing from that account is used for your balance or your subscription, which stay those of the sign-in account.

Deletion

Signing out revokes the tokens with Google, clears them from the device's vault, and deletes the memory of your folders as well as the filing decisions. It erases the list of documents already filed from the phone, but keeps its copy in your Drive: that is how you find it again when you sign back in. A document still waiting to be filed is kept: losing it is the one failure this app promises never to have.
“Delete my data”, in the Settings tab, first erases the list of documents already filed from your Drive, while access is still there; if it cannot — offline, or Drive refusing — the app tells you and deletes nothing. It then erases your balance, your recorded subscription and the day of your last analysis from the server, then wipes the phone and revokes access to your Drive. The full procedure, and the email route for someone who has uninstalled the app, are described on the deletion page.
Uninstalling erases everything on the phone, including the copy of a document still waiting to be filed. It does not touch the balance kept on the server, which is returned to you if you sign in again, nor the list of documents already filed kept in your Drive. To erase that list without the app, delete the .autofile-filed.json file at the root of “My Drive”, like any other file. The publisher has no access to this file, so a request by email cannot erase it.
Documents already filed live in the Drive of their account and belong to its owner. AutoFile keeps no copy of them. The only index is the list of documents already filed, one file per linked account, in its own Drive, which you can erase as described above.
If you used an earlier version (0.9.3 or before), an old copy of that list may remain in the hidden application folder of your Drive, which AutoFile can no longer reach. To erase it: in Google Drive on the web, Settings (gear) › Manage apps › AutoFile › Options › Delete hidden app data.

With several linked accounts. Signing out withdraws the permission of each distinct account, then erases the list of profiles, the data of each profile and the stored addresses; if a withdrawal fails, the app says so, for that account. “Delete my data” first erases the list of documents already filed of each account, then withdraws each one's permission. If a linked account can no longer be reached — its owner withdrew access — everything else is erased, then the app tells you which .autofile-filed.json file to delete by hand, and in which account. A temporary failure, such as having no network, stops everything and deletes nothing: trying again later loses nothing. Deleting a profile erases its data on the phone; if no other profile uses its account, the app offers to erase that account's list as well, then withdraws its permission.

An original put in the trash by a move stays there until Google erases it 30 days later; deleting your data neither restores nor erases it. To take it out or delete it sooner, use Google Drive.

The website

This website, autofile.bencs.app, is hosted by Cloudflare, Inc., in the United States. On every visit, your browser hands it what any web page receives: your IP address, the page asked for, the page you came from and your browser. Cloudflare needs them to serve you the page.

The site's fonts are loaded from Google Fonts (Google LLC, United States): your browser therefore also sends Google your IP address and the address of the page.

Audience measurement. The website uses Cloudflare Web Analytics. It sets no cookie, writes nothing to your browser's local storage and gives you no persistent identifier. It produces only aggregate statistics, read by the publisher alone: pages viewed, the pages visitors came from, country, type of device. It tells us which pages are read and how people reach the website.

Legal basis: legitimate interest (Article 6.1.f) — knowing whether the website does its job, without following anyone.
Retention: 25 months at most.
Transfer outside the European Union: Cloudflare, Inc. is in the United States. This transfer rests on Cloudflare's certification under the EU-U.S. Data Privacy Framework and, failing that, on the European Commission's standard contractual clauses.
Objecting: block the measurement script in your browser (a content blocker is enough), or write to contact@bencs.app.

Your rights (GDPR)

Data controller: Benjamin Cohen Solal, individual entrepreneur (a French sole-trader status, “entrepreneur individuel”), 6 rue des Fauvettes, 95160 Montmorency, France.
Legal basis for filing: performance of the contract (Article 6.1.b). You ask for a document to be named and filed, which cannot be done without reading its text.
Legal basis for sending to a model: your explicit consent (Article 9.2.a), which adds to the performance of the contract without replacing it. A prescription is health data, and so is a laboratory's name inside a folder path. Performance of the contract is not enough for that kind of data: AutoFile asks you the question before the first submission, separately from accepting the terms, and filing keeps working if you answer no — on its local rules alone, with no model ever seeing anything.
Minimisation: the text is capped at roughly 6,000 characters; the folder tree at 150 paths or 6,000 characters, with the year and month levels removed because they are computed on the device; already-filed organisations at 60, each travelling only with its last type, never its history.
Transfer outside the European Union: the model's provider is Google LLC, in the United States. This transfer rests on the European Commission's standard contractual clauses.
Retention at the model provider: the paid tier used by AutoFile forbids Google from using this data to improve its products. That does not mean it keeps it for zero seconds either: requests and responses are logged there for a limited time, for abuse detection, and this cannot be switched off from our side.
Legal basis for advertising: your consent, collected before any personalised ad is shown. Refusing it costs you nothing: the video stays available, non-personalised, and credits the same number of documents, or unlocks the same tool.
No profiling on our part, and no cross-app tracking: AutoFile builds no profile and cross-references your documents with nothing. What Google Mobile Ads does with the advertising identifier is covered by Google's own privacy policy.
Legal basis for activity measurement: legitimate interest (Article 6.1.f) — running the service, and setting its price and its AI budget, on true figures. It covers the day of your last analysis, your account's first sign-in and the two usage measurements described above. You can object to it by writing to contact@bencs.app from the Google address you sign in with: your account is then no longer counted among active accounts or among new accounts, and the usage measurements sent from it are no longer counted either.
Portability and erasure: your documents, the memory of your folders and the list of documents already filed are on your device or in a Drive you have linked to AutoFile, under your direct control. The AutoFile server keeps, tied to the identifier of the Google account you sign in with, your document balance, your recorded subscription and the day of your last analysis: “Delete my data” erases them (see “Deletion”). Your subscription status is also held by RevenueCat.
Exercising your rights, or writing to us: Delete your account contact@bencs.app. You may also lodge a complaint with the CNIL — or, if you reside in another country of the European Economic Area, with the supervisory authority of your country of residence, your place of work, or the place where you consider your rights to have been infringed (Article 77 GDPR). You also have a right of access, rectification, restriction and objection, and you can withdraw your consent at any time in the app's settings — withdrawing it is as simple as giving it.

Changes

Any change to this policy will be published on this page, with a new effective date. The version in force is the one shown here.

1 November 2026: added the section “The website” (hosting and audience measurement of the website), and a note on the rating the app asks for.