Artissavvy

Effective date: 10 August 2026 (revising the 3 June 2026 edition)

Artissavvy ("Developer") values the privacy of VXplorer ("App") users and their file data. VXplorer is a local-first file manager, and the Developer operates no servers. Your files, media, passwords, Vault data, and browsing history are never sent to the Developer.

The App contains no advertising SDK, no analytics SDK, and no crash-reporting SDK.

1. Permissions

| Permission | Purpose |
| --- | --- |
| MANAGE_EXTERNAL_STORAGE | Browsing, copying, moving, deleting, renaming, compressing, and storage analysis. On Android 10 and below, legacy storage permissions are used. READ_MEDIA_* permissions are not declared. |
| INTERNET | SMB, FTP, FTPS, SFTP, WebDAV, IPTV, the built-in browser, and the local casting server |
| ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE | Connectivity checks and showing the device IP |
| CHANGE_WIFI_MULTICAST_STATE | Discovering cast and TV devices |
| POST_NOTIFICATIONS | Transfer progress and server status |
| FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC, WAKE_LOCK | Keeping transfers and servers alive with the screen off |

2. Processed only on your device

The following are handled locally and never sent to the Developer:

File lists, file contents, thumbnails, PDF and media previews
Storage analysis results, large file and folder lists, duplicate candidates and hash values
Favourites, home shortcuts, tabs, theme, view options, media skip interval and other settings
Browser history, bookmarks, last closed tab
Recycle bin original paths and deletion timestamps
Image, video and APK thumbnail caches
Cast playback resume positions

3. Remote server credentials — important notice

When you add an SMB, FTP/FTPS, SFTP, or WebDAV server or a WebDAV cloud preset, the host, port, username, password, domain, display name, encoding, and path are saved in app-private storage.

These credentials are stored without encryption. Other apps cannot read app-private storage by ordinary means, but the data may be exposed if the device is rooted, or included in Android backup as described in section 6. Please take this into account for sensitive accounts.

Credentials are used only to connect to servers you specify and are never sent to the Developer. With unencrypted protocols such as plain FTP, transport security is limited to what that protocol provides. The App permits cleartext traffic, which plain FTP and the local casting server require.

4. IPTV and live TV

If you add IPTV playlists (M3U), EPG sources (XMLTV), or Xtream Codes accounts, those URLs and credentials are stored on your device, and playback sends requests directly to the IPTV provider you specified.

The Developer does not collect this information and provides no IPTV service. Communication with a provider is governed by that provider's own policies.

5. Servers the App runs, and local-network behaviour

When you start them, the App runs these servers on your device:

Device FTP server: devices on the same network can access the configured file area until you stop it.
Local HTTP server for casting: serves local files to a Chromecast device.
TV session host: accepts socket connections from the companion TV app to control playback.

Network discovery also attempts connections to SMB (445), FTP (21), and SFTP (22) ports across your local subnet to find reachable hosts. This runs only when you start a scan, and results stay on your device.

6. Notice about Android Backup

The App permits standard Android backup. If Google backup or device transfer is enabled in your device settings, your app settings, the server credentials in section 3, and the IPTV information in section 4 may be included in your own Google account backup.

The Developer cannot access that backup. You can disable backup for this App in your device settings.

7. Built-in browser and media casting

The built-in browser displays sites you visit. Those sites can receive standard browser data — requests, cookies, IP address, and browser information — exactly as with any browser.

When casting web media, the App locally detects the media URL, request headers, cookies, and Referer/User-Agent needed for playback. This is used only between your device, the cast device, and the origin media server, and is never sent to the Developer.

The default home page and search are set to Google and can be changed in settings.

8. VXplorer Vault

Files moved into the Vault are encrypted with AES-GCM in app-private internal storage. The key is generated and held by the Android Keystore and cannot be exported. The Developer cannot access Vault files or keys.

Two points stated precisely:

Biometric authentication gates access to the Vault screen. The encryption key itself is not bound to biometric authentication.
The original filename is written to the file header in plaintext. File contents are protected; filenames are not.

Uninstalling the App or clearing its data destroys the Vault files and the key needed to decrypt them, and recovery is not possible. Move files out of the Vault before uninstalling.

9. Retention and deletion

No data is held on Developer servers. Local data is removed as follows:

Files: acted on only when you run a delete, move, or copy command.
Smart recycle bin: deleted files are kept in a .VXplorer folder in shared storage. This location is not app-private, so it survives uninstalling the App. To remove it fully, empty the bin in the App or delete that folder yourself.
Browser history and bookmarks: cleared with the in-app functions.
Favourites, settings, network profiles, IPTV information: removed when deleted in the App or when the App is uninstalled.
Thumbnail cache: cleared in-app or on uninstall.
Vault: decrypt files out, or delete entries. Not recoverable after uninstall.

10. Third parties

The App does not sell personal or file data. Data you choose is passed to the remote servers, cloud services, websites, IPTV providers, cast devices, and sharing targets that you connect to.

Google Cast and Google Play services SDKs are used for Chromecast. Google's and the cast device's policies may apply when those features are used.

11. Children's privacy

The App does not knowingly collect personal information from children under 13.

12. Changes

This policy may be revised as laws, Google Play policies, or App features change. Significant changes will be announced in the App or the Google Play listing.

13. Contact

Developer: Artissavvy
Email: artissavvy.dev@gmail.com