Privacy Policy
This policy covers Breadstick's apps and its website: Breadstick Linux, Breadstick Shortcut Creator, Breadstick Mount and Sync, and breadstick.io.
The short version: our apps collect nothing. No accounts, no analytics, no tracking, no telemetry, no advertising identifiers. None of our apps sends us anything about you or your device. The only places we see anything at all are the standard access logs on our servers when you download from them, described below, and anything you choose to email us. Android itself can share anonymous crash and usage statistics with Google, which Google shows us in aggregate; that is explained under Crash and usage statistics.
Our website, breadstick.io, is different: it uses Google Analytics to understand how visitors use the site. That is explained under Our website.
Breadstick Linux
The free version's first-run download screen shows a credit for Rack1 Networks, which pays for the servers the Linux system downloads from. It is a picture and a link built into the app: it loads nothing from the network, sets nothing, and reports nothing to anyone. Breadstick Pro does not show it.
Everything stays on your device
The Linux system Breadstick runs, and every file inside it, lives in the app's private storage on your device. We cannot see it. Uninstalling the app deletes it.
Network use
Breadstick downloads software from package repositories: ours (apt.breadstick.io), Debian's, and, if you install certain apps, vendors' repositories such as Microsoft's for VS Code.
Our package server. When your device checks for or downloads Breadstick packages, apt.breadstick.io records a standard web-server access log: the requesting IP address, the file requested, the time, and the client's user agent. We use these logs only to operate the service: aggregate download statistics, troubleshooting, and abuse prevention. There are no accounts, so log entries are not linked to any identity, and logs are rotated automatically and kept only for a limited period.
Other repositories. Downloads from Debian's or vendors' repositories go directly from your device to those services under their operators' own privacy policies. Beyond package downloads, the Linux environment has network access and communicates only with whatever you use it for.
Storage access
If you grant the optional file-access permission, Linux apps can read and write your device storage (at /mnt/android). That data never leaves your device unless you move it yourself.
Other apps
Apps you allow to (Android asks you first, and Breadstick's Settings lists every app that has asked) can open your Linux apps and see their names and icons. Breadstick shares nothing else with them, and nothing with us.
Crash records and problem reports
If the app crashes, a diagnostic record is saved on your device only, so the problem can be understood. It is never uploaded automatically; it is shared with us only if you choose to send it. A report you email us contains what the report shows you before you send it: your device model and Android version, app settings, and recent logs. We use it only to look into your problem, and we delete it on request.
You can also save the same report, with fuller logs, as a file (Settings > About > Save logs). The file goes where you choose on your device and is not sent anywhere.
On-device AI
If you turn on On-device AI (Pro, Experimental), Linux programs on your device can send prompts to Gemini Nano, the AI model Android runs on the device itself (Android's AICore). Prompts, images and answers are processed on your device. They are never sent to us or to anyone else, and Breadstick includes no usage reporting of any kind for this feature: the parts of Google's libraries that would report usage are removed from the app. Android downloads the model, and keeps it up to date, from Google, as it does for its own features. Only programs on your device can reach it. Report a response opens an email you write yourself; nothing is attached.
Web terminal and web file browser
If you turn on the web terminal, or the web file browser (Pro), a browser on your network can open a Linux shell, or browse, upload and download the files in your Linux system and your shared folders, after you enter the password. The connection goes directly between that browser and your device, encrypted, and never passes through our servers; files you upload or download travel only between that browser and your device. The password and the certificate the app creates are stored only on your device. Anyone who has the password and can reach your device on the network can use them, so keep the password to yourself.
Breadstick Shortcut Creator
Shortcut Creator collects nothing and makes no network connections. With your permission it reads the names and icons of the Linux apps installed in Breadstick Linux, and it builds the launcher icons you ask for on your device. It signs them with a key it creates on your device, which never leaves it. Nothing about you, your device or your apps is sent to us or to anyone else.
Shortcut Creator is downloaded from breadstick.io. That download is recorded in the website's access log, described under Our website.
Breadstick Mount and Sync
Mount and Sync collects nothing. It has no accounts with us, no analytics and no tracking, and it sends us nothing.
Your servers and logins. The servers you add, and the usernames, passwords and keys you enter for them, are stored only on your device, encrypted with a key kept in Android's secure key storage. They are not included in device backups, and they are never sent to us.
Network use. The app connects only to the servers you add, and to Google Play for the in-app purchase. Your files travel directly between your device and your own servers; they never pass through ours. Folder sync runs on your device. The Nearby devices permission, if you grant it, is used only to reach servers on your local network. The optional helper for Samsung My Files is reachable only from your own device.
Purchase. Mount and Sync's upgrade is a single one-time in-app purchase, processed entirely by Google Play. We never receive your payment details; the app stores only a record that the upgrade is active.
Our website
When you visit breadstick.io or download a file from it, our web host records a standard access log (the requesting IP address, the page or file, the time, and the browser's user agent), used only to run the site and kept only for a limited period.
The Install button. When you tap Install on an app's page in the app catalog on an Android device, the page tells our server which app it was, with a one-time random number. If Breadstick is not installed, Android sends you on to Google Play through our server with the same number, so we can tell the two apart. We keep only daily counts per app of how often Breadstick opened and how often it did not. To count each device once a day, we also keep a one-way code made from your IP address with a key that changes every day; it cannot be turned back into the address, and it is deleted within two days. No cookies are set, and Breadstick itself sends nothing.
The breadstick.io website, including its documentation pages, uses Google Analytics, a web analytics service provided by Google LLC, to help us understand how people find and use the site. When you visit, Google Analytics collects information such as the pages you view, how you arrived (for example from a search engine or another website), your approximate location (city or country, estimated from your IP address), your browser and device type, screen size and language, and how long you spend on the site.
Google Analytics stores cookies in your browser, named _ga and _ga_
followed by an identifier, so that repeat visits can be counted. By default they expire after
two years. According to Google, Google Analytics 4 does not log or store IP addresses; it uses
them only to estimate location.
We use this information only as aggregate reports, to improve the website and to understand interest in Breadstick. We do not use it to identify you, we do not sell it, and it is never combined with anything from our apps. Google processes the data under its own terms; see how Google uses information from sites that use its services and Google's Privacy Policy.
If you visit from the European Economic Area, the United Kingdom or Switzerland, Google Analytics stays switched off and sets no cookies until you accept it in the banner shown on your first visit. Elsewhere it is on unless you turn it off. Either way, you can change your mind at any time with the Cookie choices link at the bottom of any page.
You can also opt out by blocking or deleting cookies in your browser, by using a browser or extension that blocks trackers, or by installing Google's Google Analytics opt-out browser add-on.
Google Analytics is part of the website only. None of our apps includes it, or any other analytics, and website statistics are never combined with the crash and usage statistics Google Play shows us.
Crash and usage statistics
Our apps contain no analytics or crash-reporting library and send no statistics of their own. Android, separately, can share usage and diagnostics data with Google if you allow it in your device's settings. When you do, Google Play collects reports about the apps you installed from it, ours included: crashes, freezes ("app not responding"), and performance figures such as startup time and battery use. Google shows these to us in Google Play Console only as anonymous, aggregate statistics: crash and freeze rates, the technical details of a crash (where in the app's code it happened), and the device models, Android versions and app versions involved. They do not identify you, we cannot tie them to any person, and we use them only to find and fix problems. Google collects them under Google's Privacy Policy, and you can turn them off at any time with Android's usage and diagnostics setting.
Purchases
Purchases in our apps (Breadstick Pro in Breadstick Linux, and the upgrade in Mount and Sync) are processed entirely by Google Play. We never receive your payment details. Google's own privacy policy governs the transaction. Shortcut Creator is free and has no purchases.
Children
Our apps are general-audience tools and are not directed at children under 13.
Changes
If this policy ever changes, we will update this page and the effective date above.