Privacy Policy

What Rewind does

Rewind reads notifications that the Android system delivers to its NotificationListenerService and stores them in a local database on your device. That local store is what powers the History screen, search, rules, snooze, the daily digest, the morning recap, analytics, the home-screen widget, the Quick Settings tile for the latest verification code, and the optional encrypted backup and restore flow. Every screen you see is computed on-device from data that never leaves your phone.

Data Rewind processes

When the system hands a notification to the listener, Rewind reads and stores the following fields:

• The posting app's package name and display label
• The notification title and body text, including the supplementary summary and info fields when present opt-out
• Multi-message threads from messaging-style notifications (WhatsApp, Messenger, Telegram, Gmail digest, etc.), captured as structured JSON inside the local database opt-out
• Notification-attached images: sender avatars, the photos attached to picture-style notifications, and per-message image attachments from messaging apps. These are written as JPEG files in Rewind's private app storage with a rolling 50 MB size cap opt-out
• The notification category and channel ID
• The posted timestamp
• Whether the notification was marked as ongoing
• A short key used internally to deduplicate rapid updates to the same notification

Text, message-thread, and image capture are all on by default. You can turn them off globally in Settings › Capture title and body text, Settings › Capture full message threads, and Settings › Capture images respectively, or flip text capture for individual apps under Settings › Text capture exceptions. When a category is off, none of those bytes reach disk.

Rewind does not read your call log, SMS, location, microphone, camera, photos, files, calendar, biometric data, or the contents of any other app's databases. Contacts are an opt-in exception: Rewind asks for the READ_CONTACTS permission only when you tap "Pick from starred contacts" inside the rule editor. See Permissions below for details. Picked names are turned into a local regex and never leave your device.

Where your data lives

All captured data is stored in a Room/SQLite database inside Rewind's private app storage on your device. Android sandboxes that directory: other apps cannot read it. The database is excluded from Google's auto-backup, is never synced to the cloud, and never leaves the device unless you explicitly export it through the system file picker (see Exports).

Notification-attached images are written as separate JPEG files alongside the database, inside the same private storage. They are subject to a rolling 50 MB cap: when the cap is reached, the oldest images are pruned automatically. The image bytes themselves are not bundled inside encrypted backups (only the filename references travel along), so a cross-device restore falls back to the source app's icon for any image the new device doesn't already have on disk.

Who Rewind shares data with

Nobody. Rewind has no servers, no analytics back-end, no advertising partners, and no third-party SDK that transmits user data. No part of your notification history leaves your device through Rewind under any circumstance.

The single network interaction Rewind initiates is with Google Play Billing, and only when you tap Unlock Pro. Google receives that purchase transaction directly under Google's own terms. Rewind does not transmit any of your notification data to Google, and Google does not send Rewind any personal information beyond the entitlement status of the rewind_pro_unlock product on your Google account.

Permissions Rewind requests, and why

Rewind does not request internet, location, SMS, microphone, camera, photos, files, calendar, biometric, or sensor permissions.

Purchases

Rewind is free to download. Rewind Pro is a single one-time in-app purchase that unlocks features such as extended retention, daily and weekly digest, morning recap, deeper analytics, snooze, per-app retention, encrypted backup and restore, the Quick Settings tile for verification codes, and JSON / PDF exports. Purchases are handled by Google Play. Please refer to Google's privacy policy for details on how Google processes the transaction.

Exports

You can export your notification history to CSV, JSON, or PDF (JSON and PDF require Pro) through Android's Storage Access Framework. You pick the destination file and folder; Rewind writes the file there and does not retain a separate copy of the export. We do not have access to anything you do with the exported file afterward.

Pro users can also save a single captured notification image to the device gallery by long-pressing it inside an expanded History row. The image is copied into the public Pictures/Rewind/ collection via Android's MediaStore. Once it lands there it is a normal photo: Rewind has no further control over it, and any photo-sync app you have installed (Google Photos, Samsung Gallery sync, etc.) may upload it under its own privacy terms.

Encrypted backups opt-in

Pro users can create an encrypted backup of every captured notification, rule, and per-app retention override. The backup is written as a single file through Android's Storage Access Framework; you pick where it goes. Rewind does not upload the file anywhere, and there is no online backup service.

The file is encrypted with AES-256-GCM using a key derived from your password via PBKDF2-HMAC-SHA256 at 600,000 iterations. The password is never written to disk and never leaves the app. We cannot recover a forgotten password: if you lose it, the backup is unreadable, including by us.

Where the file lives after you save it is entirely up to you. If you pick a folder that is synced by another app (for example Google Drive or Dropbox), the encrypted file will be uploaded by that app under its own privacy terms. Rewind itself never initiates that upload.

In-app feedback opt-in

Rewind ships an in-app feedback form at Settings › Send feedback. It is a thin wrapper around your existing email client: when you tap Send, Rewind composes a subject line and a message body and hands them to whichever app handles the Android mailto: intent (Gmail, Outlook, Samsung Email, etc.). The app itself never transmits the email; your email client does, on your tap, in whichever account you have configured.

The body of that email contains, by default:

• The feedback type you picked (Bug, Feature request, General idea, Other)
• The free-text details you typed
• A four-line device block: app version, device model and manufacturer, Android release, and your system language tag

The device block exists to help reproduce reported bugs. It contains no advertising ID, no IMEI, no account information, no notification content, and no location. You can leave it out entirely by toggling off Include device details in the form before sending. Nothing from your notification history is ever included.

OTP detection and the Quick Settings tile opt-in

For Pro users, Rewind can detect verification codes (one-time passwords) inside notifications and surface the most recent code on a Quick Settings tile so it can be copied with a single tap. Detection runs entirely on-device: a regex looks for 4 to 8 digit codes in the notification text Rewind has already stored. No code or notification is sent anywhere.

When you tap the Quick Settings tile, the latest detected code is written to the Android system clipboard. On some Android versions the clipboard is readable by any foreground app, so treat this the same as you would copying a code from a messaging app: only do it when you are about to paste it. The tile is added by you from the Quick Settings editor and can be removed there at any time.

After the freshness window expires (ten minutes), the separately-stored extracted code is automatically nulled out in the local database, even when the corresponding notification row is still in your history. The original notification text remains: the user-visible message is what powers the History list, and removing it would break unrelated features.

Data retention and deletion

Your retention window is controlled entirely by you:

• Free users keep up to 7 days of history.
• Pro users can choose any retention between 1 and 365 days, or "unlimited", and can set per-app overrides.
• You can delete individual entries from the History screen at any time, or clear an app's history from the analytics drill-in.
• Uninstalling Rewind erases the entire local database. There is nothing to delete server-side, because there is no server. Any backup files you exported still exist wherever you saved them, so delete those separately if you want them gone.

Children

Rewind is not directed at children under 13 and does not knowingly collect data from them. Because the app collects no data at all, no special protections under COPPA or comparable regulations are triggered. We still recommend that minors use the app only with parental supervision, since the device's notifications themselves may contain sensitive content.

Security

Your data lives in Android's per-app private storage, which is sandboxed from other apps. Rewind relies on the operating system's existing protections: the device lock screen and file-based encryption. We do not implement an additional at-rest encryption layer for the live local database, because the threat model of a single-user device is already covered by those OS-level controls. If you share a device with someone else, treat Rewind history the same as anything else in your apps.

Backup files written through the Encrypted backups feature are a separate matter, because they may end up in less-private locations (a Downloads folder, a synced cloud directory). Those files are encrypted with AES-256-GCM keyed by a password you choose, derived with PBKDF2 at 600,000 iterations. See Encrypted backups above.

Your controls

• Pause capture: Settings › Capture notifications.
• Stop capturing for specific apps: Settings › Don't capture from these apps.
• Stop capturing title and body text: Settings › Capture title and body text (or per-app under Text capture exceptions).
• Stop capturing message threads: Settings › Capture full message threads.
• Stop capturing notification-attached images: Settings › Capture images.
• Adjust retention or set per-app overrides: Settings › Retention.
• Leave device info out of feedback emails: toggle off Include device details inside the in-app feedback form.
• Clear all history: revoke notification access in Android Settings, then uninstall the app.
• Revoke notification access: Android Settings › Notifications › Special app access › Notification access.

Changes to this policy

If the way Rewind handles data ever changes materially, this page will be updated and the effective date at the top bumped. Because the app's privacy promise is structural (no servers, no SDKs), a substantive change would require a new app version, and we would surface a clear in-app notice before any change took effect.

Contact