Privacy Policy

The Short Version

• We have no servers. There is no BSON Studio backend. We never receive, see, or store your data.
• Your data stays on your device, in encrypted app-private storage.
• The app only talks to servers you choose it to — your own MongoDB databases, and, optionally, your own AI provider. Nothing is sent anywhere unless you initiate it.
• No analytics, no telemetry, no advertising, no third-party trackers. Ever.

Information We Collect

None. BSON Studio has no user accounts and no sign-up. We do not collect personal information, usage analytics, telemetry, advertising identifiers, device fingerprints, or location data. There is no developer-operated server for such data to be sent to.

Information the App Handles, and Where It Stays

Everything below is stored locally on your device in the app's private storage. None of it is transmitted to us.

• Data you import or create — imported MongoDB exports, document collections, snapshots, dashboards, charts, and saved queries. The document store and snapshot store are encrypted at rest with SQLCipher (AES-256).
• Connection details — MongoDB connection strings, which may contain database credentials. These are encrypted using the Android Keystore before being stored.
• AI provider API keys (optional, see below) — also encrypted using the Android Keystore.
• A first-launch timestamp — a single local timestamp used to recognize early ("founder") installs for a future upgrade offer. It contains nothing that identifies you.

The encrypted database files and stored secrets are excluded from Android cloud backup and device-to-device transfer, so they are not copied to your Google account.

Connections to Other Services (All User-Initiated)

BSON Studio only communicates over the network when you ask it to, and only with the services you point it at:

1. Your MongoDB Servers

When you add a live connection, the app connects directly from your device to the MongoDB server you specify. This traffic does not pass through any server operated by us. Your connection string is stored encrypted on your device. You can mark a connection read-only to block all writes from the app. If you use a plain mongodb:// connection without TLS, that traffic is not encrypted in transit — the app warns you when this is the case; prefer tls=true or mongodb+srv://.

2. AI Providers — Optional, Bring-Your-Own-Key

Natural-language query translation works fully offline using a built-in translator, and this is the default. If you choose to add your own API key for a cloud AI provider, then when you run a natural-language query the app sends, directly to that provider:

• your query text, and
• the field names and data types of the relevant collection.

It does not send your document values or the contents of your data. Requests go only to the provider whose key you supplied:

• Anthropic (Claude): https://api.anthropic.com
• OpenAI (GPT): https://api.openai.com

Your use of these providers is governed by their own privacy policies. You can remove your key at any time in the app's settings, which stops all communication with the provider.

3. Google Play Billing

If you purchase the optional one-time "BSON Studio Pro" unlock, the transaction is processed by Google Play Billing. We receive only your entitlement status (whether the unlock was purchased) — we do not receive your name, payment card, or billing address. This processing is governed by Google's Privacy Policy.

Crash Reports

If the app crashes, it saves a single diagnostic report on your device only. This report is never uploaded automatically and contains no data from your collections — it holds the app version, device model, Android version, and the technical stack trace. You can view, share, or delete it in Settings → Intelligence → Diagnostics. If you choose to share it, it goes only where you send it.

Permissions the App Uses

• Internet / network state — to connect to the servers you choose: your MongoDB databases, your AI provider (only if you add a key), and Google Play for billing.
• Billing — to offer the optional one-time Pro purchase through Google Play.

The app does not request access to your location, camera, microphone, contacts, call logs, or your files outside its own private storage.

Data Security

Your imported data and snapshots are encrypted at rest with SQLCipher (AES-256), and your connection strings and API keys are sealed with the Android Keystore using device-bound keys. No method of electronic storage is ever completely secure, and the protection provided by the Android Keystore depends on your device's integrity — a rooted or compromised device weakens these guarantees.

Data Retention and Deletion

Because your data lives only on your device, you control it entirely:

• Delete individual collections, snapshots, connections, or keys within the app.
• Uninstalling the app removes all of its data, including the encrypted stores and all stored secrets.

We hold no copy of your data, so there is nothing for us to retain or delete on our side.

Your Privacy Rights (GDPR, CCPA, and Others)

Because BSON Studio does not collect or hold your personal data, we have nothing to disclose, export, correct, or delete on your behalf, and we do not sell or share personal information. Any personal data you handle through the app resides in your own MongoDB databases or with your chosen AI provider; for that data you are the controller and should exercise your rights directly with those services.

Children's Privacy

BSON Studio is a developer tool intended for adults and is not directed at children. We do not knowingly collect any information from children.

International Use

The app processes your data locally on your device. Cross-border transfer happens only if and when you connect to a MongoDB server or AI provider located in another region — a choice you make and control.

Changes to This Policy

We may update this policy to reflect changes to the app. The "Last Updated" date at the top will always show the current version, and material changes will be noted there.

Contact

Questions about this policy or the app's privacy practices:

Stephen Taylor — [email protected]