Privacy Policy: SudoDB

SudoDB is a local-first app for PostgreSQL, MySQL, MariaDB, SQL Server, MongoDB, and SQLite. It does not require an account, does not include ads or analytics SDKs, and does not send your databases, queries, or files to SudoCod servers. Data stays on your device except for:

• Play Billing for optional SudoDB Pro (monthly or yearly subscription, or one-time lifetime unlock) and entitlement checks
• Optional system backups you (or your device) enable

SudoDB is freemium: free to install, with core read-only browsing available without paying. SudoDB Pro is optional and sold through Google Play as:

• an auto-renewing monthly subscription (sudodb_pro_monthly, base plan sudodb-pro-monthly)
• an auto-renewing yearly subscription (sudodb_pro_annual, base plan sudodb-pro-annual)
• a one-time lifetime unlock (sudodb_pro_lifetime, Buy option sudodb-lifetime-buy)

There is no free trial. Displayed prices come from Google Play and may vary by country or storefront. Monthly and yearly billing renew unless you cancel in Google Play subscription settings. Free users can inspect cell values; Save and other writes (procedure Run, DDL) run only after you confirm them and only if Pro is unlocked — they go to the database you connected to, not to SudoCod.

Use this table when completing Google Play Data safety. Categories reflect app functionality, not advertising or analytics.

Personal info (name, email, phone): Not collected by the app. SudoCod does not operate an in-app account for SudoDB.

Payment is processed by Google Play Billing, not by SudoCod directly. The app does not collect, store, or transmit payment card numbers, billing addresses, or other payment credentials.

SudoCod may receive limited purchase or payout reports from Google (for example that a subscription or lifetime purchase started, renewals, cancellations, and settlement details for the developer). Those reports do not include your on-device databases or queries.

Product IDs (must match Play Console):

Monthly and yearly subscriptions auto-renew unless cancelled. You can manage or cancel them in Google Play subscription settings. Lifetime is a one-time purchase and does not renew. Deleting the app does not by itself cancel a Play subscription.

When you use the app, it may store locally:

• A cached Pro entitlement flag (and, when known, the Play product id) so Pro features keep working offline after a successful check. Values are stored as encrypted strings in a Keystore AES-GCM preferences file (sudodb_pro_unlock, same encryption approach as database passwords). That file is excluded from Android Auto Backup / device transfer, so restoring a backup does not restore Pro access without a fresh Play entitlement check
• Connection metadata you enter (display name, database engine, and server connection fields or SQLite file path) in an on-device Room database (sudodb_connections.db). Supported server engines: PostgreSQL, MySQL, MariaDB, SQL Server, and MongoDB (host, port, optional database name, username, SSL mode). For MongoDB, username and password may be left blank when connecting to a server that does not require authentication; when a database name is set it is also used as the authentication database. For SQLite, the stored “host” field is the absolute path to the database file on this device; port, username, database name, and password are unused. Passwords are not stored in that database. If database is left blank on PostgreSQL, SQL Server, or MongoDB, the app browses all databases on that server when you open the workspace. On MySQL and MariaDB, leaving database blank lists user databases as schema nodes on that server
• Database passwords (server engines only), encrypted with the Android Keystore (AES-GCM) in a separate encrypted preferences file. Passwords are never written in plaintext, are never shown on connection tiles, and are excluded from Auto Backup / device transfer. When you edit a connection, leaving the password field blank keeps the existing stored secret. SQLite connections do not use or store passwords
• SQLite database files you create or import via Browse… / Create new…. New databases and imported copies are stored in the app’s private storage (files/databases/). Browse… uses the Android document picker; the app copies the file you choose into that private directory so JDBC can open it reliably. These files stay on your device and are not uploaded to SudoCod. They are excluded from Auto Backup (same as connection metadata)
• Temporary workspace data while a connection is open (schema/object lists including tables, views, MongoDB collections and views, functions, procedures, and triggers; Structure metadata such as columns/fields, routine parameters, unique keys, indexes, foreign keys, incoming references, SQL Server identity/collation when shown, and MongoDB view source collection; MongoDB view aggregation pipelines when you open the Pipeline tab; lazy-loaded DDL/CREATE scripts for relational objects when you open that tab; procedure Run parameter values and last Results; paginated row previews or MongoDB document trees; draft cell values while you edit in table or tree view; and optional row-filter state). If the server lists a database but denies opening it, the app keeps a short on-device permission message on that tree node and does not load that database’s schemas or rows. Filter text, procedure arguments, and cell values you Save are used only to build queries, bound CALL/EXEC, or single-row / field updates against the database you chose (remote host or local SQLite file). This data is held in memory for browsing on this device and is not uploaded to SudoCod. Closing the workspace ends the database session (JDBC for relational engines and SQLite; MongoDB driver for MongoDB)
• Other database files or query work you create or open in the app (these stay on the device; they are not uploaded to SudoCod)

This data is stored in the app's on-device storage (or held in memory for the active session). It is not uploaded to SudoCod. Payment card details are never stored by the app. Database passwords are never sent to SudoCod.

Debug builds may offer an explicit Continue without Play (debug only) unlock for development. That unlock is local, is not a Play purchase, and is never granted by Restore purchases.

The app may:

1. Contact Google Play Billing to load the monthly and yearly subscriptions and the lifetime one-time product, complete purchases, restore purchases, and verify entitlement. Those systems are operated by Google under their policies — not by SudoCod.
2. Read device network connectivity state so it can re-check Pro status when you are online and rely on the local entitlement cache when you are offline.
3. Connect to database hosts you configure — including Test connection, opening a saved connection in the database workspace, loading schemas and objects (tables, views, functions, procedures, triggers) or MongoDB databases with Collections and Views groups (system databases such as local/config and system.* namespaces can be shown via an optional tree toggle; when shown, system collections are not opened or queried), Structure metadata for selected objects (including MongoDB collection indexes from listIndexes, MongoDB view source collections, and SQL Server identity/collation metadata when shown), MongoDB view aggregation pipelines when you open the Pipeline tab, DDL/CREATE scripts for relational objects when you open the DDL tab (not used for MongoDB; some system objects may have no definition), running stored procedures you choose (bound parameters), fetching paginated row or document previews for tables/views/collections, and saving cell edits you confirm in the Data tab (single-row UPDATE by primary key for relational tables and SQLite, or a MongoDB $set by _id for a field or nested tree path; views, MongoDB _id, binary fields, and JavaScript Code with scope are not editable; other known MongoDB types such as Date — shown like Compass as 2024-06-15T13:45:00.000+00:00 — Timestamp, Regex, ObjectId, and JavaScript Code stay typed on save). When browsing all databases, opening a database the login cannot access fails on-device with a permission message and does not load that database’s contents. You may optionally apply a row filter in the Data tab: a SQL WHERE expression for relational engines and SQLite, or a JSON filter document for MongoDB. That filter is included in preview queries sent to the host. Traffic goes directly from your device to that host (PostgreSQL, MySQL, MariaDB, and SQL Server over JDBC; MongoDB over the MongoDB wire protocol via the official MongoDB Java sync driver). Those hosts will see a connection from your device (and your username / password when you provide them as part of normal database authentication). Row, schema, DDL, pipeline, procedure, and cell-edit results are shown in the app on this device only. Safe on-screen error text is derived from the failure (for example permission denied, constraint violation, or missing definition); detailed diagnostics may be written to on-device logs and never include your password. SudoDB does not proxy that traffic through SudoCod servers and does not send connection passwords to SudoCod. Cleartext database traffic is disabled at the app level; SSL/TLS mode is chosen by you (default Require). SQL Server uses JDBC transport encryption settings mapped from your SSL choice; MongoDB uses TLS when Require or Prefer is selected.
4. Open local SQLite database files — for SQLite connections, browse/create/import, workspace preview, and cell edits run entirely on this device. No network connection is made for SQLite. Browse… uses the system document picker; the app copies the selected file into private app storage before opening it. SudoCod does not receive the file contents.

These requests are made only for features you use. The app does not phone home to SudoCod for telemetry, crash reporting, advertising, or account sync. Opening, testing, browsing, previewing, or editing a database does not send that database to SudoCod.

Play crash symbolication (not SudoCod): Release App Bundles uploaded to Google Play may include an R8 mapping file and native debug symbol metadata (for stripped SQLite / Compose .so libraries) so Google Play can symbolicate stack traces in Android vitals / Play Console. That metadata is for Play’s crash tooling only. It does not include your databases, connection passwords, queries, or cell values, and it is not sent to SudoCod servers. The app still does not embed a third-party crash SDK that reports to SudoCod.

• System backup / device transfer: If backup is enabled, Android may include eligible app files in system backups (for example Google Backup or OEM device transfer). The offline Pro entitlement cache (sudodb_pro_unlock), connection database, encrypted password store, and SQLite databases in app-private storage are excluded from Auto Backup and device transfer. After restore, Pro access depends on a live Google Play entitlement check (or Restore purchases), and saved database connections (and any SQLite files created in the app) must be re-created or re-imported. Controlled by your device / Google account settings, not by SudoCod servers.
• Manual export/import: If the app offers export (for example a file you save), you choose where to save it. You control who can access exported files. Export does not send files through SudoCod.

The app only requests access needed for its features. It does not request contacts, location, camera, microphone, or your photo library for core use.

The app draws edge-to-edge (behind system bars and display cutouts) using Android window insets, with transparent system bars so content can extend behind the navigation bar. Interactive controls apply inset padding so they stay usable. That is a layout/display behavior only; it does not collect additional personal data or require extra permissions.

SudoDB is not directed at children under 13. We do not knowingly collect personal information from children through this app.

SudoCod does not sell your data. The app does not share your databases with third parties for advertising. Third parties that may receive limited technical information in the course of a feature you use include:

• Your backup provider or storage destination if you enable system backup or export a file there
• Google, for store purchase, (if enabled) platform backup, and (when you use Play) optional Android vitals / crash or ANR reports plus any R8 mapping or native symbol files you upload with the App Bundle — under Google's privacy policy
• Database servers you choose to connect to (when you test, open, browse, preview, or edit cells on a server-engine connection)

SQLite connections do not contact third-party database servers.

Data remains on your device until you delete it in the app, clear app storage, or uninstall. Uninstalling removes local app data (system backups you already made may still exist until you delete them through your account or device backup settings). Exported files remain wherever you saved them until you delete them. Google Play manages monthly and yearly subscription and lifetime purchase records under Google's policies.

We may update this policy when the app's behavior changes. The effective date at the top will be revised when we do. Continued use after an update means you accept the revised policy.

Questions about this policy or the app:

• Web: https://sudocod.com
• Product: https://sudocod.com/products/sudo-db/
• Privacy: https://sudocod.com/products/sudo-db/privacy/
• Terms: https://sudocod.com/products/sudo-db/terms/
• Email: privacy@sudocod.com
• Developer: SudoCod