Ambry Get the app
Legal

Privacy Policy

Effective date: March 21, 2026 · Last updated: March 21, 2026 · Questions: hello@ambryapp.io

1. Who we are

Ambry (“we,” “us,” or “our”) is a privacy-first cloud storage application for iOS and Android. Our service allows you to store, encrypt, and manage your files using your own Google Drive accounts as backend storage.

By using Ambry, you agree to the collection and use of information as described in this Privacy Policy.

2. The short version

We are a zero-knowledge service. Your files and file names are encrypted on your device before they reach our servers. We cannot read your files, see your file names, or access your photos — even if compelled to do so. Your encryption keys never leave your device.

We do not sell your data. We do not run ads. We do not share your personal information with third parties for marketing purposes.

3. Information we collect

Account information: When you create an Ambry account, we collect a username or email address and a hashed account identifier. Your password never leaves your device and is never transmitted to our servers.

Encrypted file data: We store and route encrypted ciphertext on your behalf. This data is mathematically unreadable to us without your encryption key, which only you hold.

Usage data: We may collect anonymised usage statistics such as app version, operating system, crash reports, and feature interaction counts. This data does not identify you personally and is used solely to improve the app.

Google account tokens: When you connect a Google account, we store OAuth refresh tokens on our server so we can upload and manage files in your Google Drive on your behalf. These tokens are stored securely and encrypted at rest. We use them only to perform the actions you explicitly request within the app.

4. How we use Google Drive

Ambry’s use of Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a Google account to Ambry, we request the drive.file scope. This scope grants Ambry permission to:

  • Create files in your Google Drive that were created by Ambry
  • Read, update, and delete files that Ambry created

Ambry cannot and does not access any files in your Google Drive that were not created by Ambry. We cannot see your existing photos, documents, or any other pre-existing Drive content.

All files written to your Google Drive by Ambry are encrypted ciphertext. Google and Ambry alike cannot read the contents of these files without your device-held encryption key.

We do not use Google user data to serve advertisements, train machine learning models, or share with third parties. Google account data is used solely to provide the core storage functionality of the Ambry app at your explicit direction.

5. How we use your information

We use the information we collect to:

  • Provide, maintain, and improve the Ambry service
  • Route your encrypted files to and from your connected Google Drive accounts
  • Authenticate your identity when you sign in
  • Respond to your support requests
  • Detect and prevent fraud or abuse
  • Send service-related communications (not marketing) where necessary

We do not use your information to serve targeted advertising, build advertising profiles, or sell data to data brokers or any third party.

6. Data storage & security

Ambry is built on a zero-knowledge architecture:

  • Encryption keys are generated from your password using Argon2id and stored only on your device. They are never transmitted to or stored on our servers.
  • File contents, file names, thumbnails, and metadata are encrypted on your device using XChaCha20-Poly1305 before upload. Our server handles only ciphertext.
  • OAuth tokens for your Google accounts are stored on our servers encrypted at rest and are transmitted only over TLS-encrypted connections.

Because we do not hold your encryption keys, we cannot decrypt your files under any circumstances — including in response to legal requests. In the event of a server breach, your file contents remain protected by your device-side encryption.

7. Data sharing & third parties

We do not sell, rent, or trade your personal information. We may share limited information only in the following circumstances:

  • Google LLC — as your chosen storage provider, encrypted file data is stored in your own Google Drive account under your Google account credentials.
  • Service providers — we may use trusted infrastructure providers (such as cloud hosting) who process data on our behalf under strict confidentiality agreements.
  • Legal obligations — we may disclose account-level metadata (not file contents, which we cannot decrypt) if required by law. We will notify you of such requests where legally permitted.

8. Your rights & controls

  • Access: You can view your connected accounts and stored data within the app at any time.
  • Deletion: You can delete individual files, disconnect Google accounts, or delete your Ambry account entirely from within the app. Deleting your account removes all server-side data associated with you.
  • Disconnecting Google: You can revoke Ambry’s access to any Google account at any time from your Google Account permissions page or from within the app.
  • Data portability: Your encrypted files reside in your own Google Drive. You retain full ownership and can access or delete them independently of Ambry.

To exercise any of these rights or for any privacy-related requests, contact us at hello@ambryapp.io.

9. Data retention

We retain your account information for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it by law.

Encrypted files stored in your Google Drive are not deleted when you delete your Ambry account — they remain in your Drive under your full control.

10. Children’s privacy

Ambry is not directed at children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at hello@ambryapp.io and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by email at least 14 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Continued use of Ambry after changes take effect constitutes your acceptance of the updated policy.

12. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

Ambry
Email: hello@ambryapp.io
Website: ambryapp.io

We aim to respond to all privacy-related inquiries within 5 business days.