Privacy Policy

Last updated: October 4, 2026

This Privacy Policy explains what information the PenCast apps collect and how it is used. PenCast consists of an Android app (package com.pencast.app, "the Android app") that turns your stylus into a wireless drawing tablet, and free companion receiver apps for macOS and Windows ("the desktop apps"). PenCast is developed and operated by Ahmed Esa ("we", "us"), an individual developer.

In short: there are no accounts and no ads. Your pen/stylus data goes only to your own computer, never to our servers. We use Google Firebase (Analytics and Crashlytics) to learn how the app is used and to fix crashes. Purchases are handled by Google Play. We do not sell your data.

Information we collect
Information we do not collect
Stylus data and local connections
Permissions
Purchases
Sharing and service providers
Retention
Data deletion and your rights
Children
Security
Changes
Contact

Information we collect

PenCast does not ask you to create an account or enter personal details. The only data sent off your device is the technical data below, collected automatically by Google Firebase SDKs that are built into the apps.

Data	Used for
Crash logs and diagnostics (Firebase Crashlytics): stack traces, error type, app version, device model, Android/OS version, and device state at the time of a crash (for example memory and orientation).	Finding and fixing bugs; app stability (app functionality, analytics).
App interactions (Firebase Analytics): anonymous usage events such as "connection to computer succeeded/failed", "Bluetooth connection started", sessions, plus the approximate country/region derived by Google, app version, device model and language.	Understanding which features work and are used so we can improve PenCast (analytics).
Device or other IDs: the Firebase app-instance ID generated by Google's SDK, and a random install identifier (a UUID created on first launch and stored only on your device) that is attached to crash reports so we can tell whether many crashes come from one installation or from many.	Counting unique installations and crashes. These identifiers are random; they are not linked to your name, email, phone number or Google account by us.

We have disabled the collection of the Android Advertising ID and the Android SSAID by Firebase Analytics, and the Android app does not request the advertising-ID permission. Analytics events and crash reports do not include your computer's name, Bluetooth device names or IDs, or your IP addresses; connection error details are reduced to a generic error type before they are sent.

The desktop apps use the same Firebase services: Firebase Analytics on macOS and Windows, and Firebase Crashlytics on macOS (Crashlytics is not available on Windows).

Information we do not collect

No name, email address, phone number, postal address, or account information (the apps have no sign-in).
No precise or approximate location from device sensors. (Google derives only a coarse country/region from the network connection for Analytics.)
No contacts, messages, photos, videos, audio, files, or calendar data.
No payment card or bank details — payments are processed by Google Play.
No advertising profiles. PenCast shows no ads and contains no advertising SDK.

Stylus data and local connections

The core function of PenCast is sending your pen position, pressure, tilt and hover data from your Android device to your own computer running the PenCast desktop app. This travels directly over your local WiFi network, a USB cable (ADB tunnel) or Bluetooth Low Energy. It is not sent to us or to any server operated by us and is not stored by the app beyond what is held in memory while you draw. Please note that the WiFi connection is not encrypted, so use PenCast on networks you trust.

The app remembers settings on your device, including the last computer IP address you used. It also keeps a small local log file for troubleshooting (up to about 500 KB) in the app's private storage. These stay on your device and are not uploaded automatically. The Android app disables Android's automatic backup, so these local settings are not copied to Google Drive.

Permissions

Camera — used only to scan the QR code shown by the desktop app so your devices can pair. Images are analysed on your device in real time; nothing is recorded, stored or transmitted.
Internet, network state, WiFi state, multicast — to find and connect to your computer on the local network (mDNS discovery) and for Firebase and Google Play to work.
Bluetooth (scan, connect, advertise) — for the optional Bluetooth connection to your computer. On Android 11 and lower, Android requires location permission for Bluetooth scanning; PenCast declares it only for those versions and does not read your location.
Wake lock — keeps the screen/CPU awake while you are connected.
Google Play Billing — to offer and verify the Pro purchase.

Purchases

PenCast Pro is a one-time, non-subscription in-app purchase handled entirely by Google Play. We never see your card or payment details. On launch the app asks Google Play whether your Google account owns PenCast Pro and keeps a local on/off flag; no purchase information is sent to our servers (we do not run any). When you connect to a desktop app, the app tells it whether Pro is active for that session only.

We do not sell your data and do not share it with advertisers or data brokers. The data described above is processed by Google LLC (and its affiliates) as our service provider through Firebase Analytics, Firebase Crashlytics and Google Play, under Google's own terms and privacy policy (see firebase.google.com/support/privacy and policies.google.com/privacy). Google may process data in the United States and other countries. We may disclose information if required by law.

Retention

Analytics and crash data are kept by Google Firebase according to the retention settings of our Firebase project and Firebase's standard policies (crash data is typically kept for about 90 days; analytics event data for a limited period of up to 14 months). Local data on your device remains until you clear the app's data or uninstall it.

Data deletion and your rights

How to delete your data:

On your device: clear the app's storage or uninstall PenCast. This deletes local settings, the log file and the random install identifier; reinstalling creates new identifiers, so earlier analytics/crash data can no longer be connected to you.
Data held by Firebase: email ahmedesa1997@gmail.com with the subject "PenCast data deletion request" and, if you can, the approximate dates you used the app and your device model. Because the data is not linked to your name or email, we may not be able to locate it without an identifier, but we will delete what we reasonably can and respond within 30 days.
Purchase records are held by Google; manage or request their deletion through your Google account.

Depending on where you live (for example the EU/EEA, UK, Turkey under KVKK, or California), you may have the right to access, correct or delete personal data, to object to or restrict processing, and to lodge a complaint with your local data-protection authority. Contact us at the address below to exercise these rights. There is currently no in-app switch to turn off Analytics or Crashlytics; uninstalling the app stops all collection.

Children

PenCast is not directed to children under 13 and we do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will delete it.

Security

Communication with Firebase and Google Play uses HTTPS. Stylus data on your local network is sent without encryption, so we recommend a trusted network or a USB connection. Only people on the same local network could intercept it; no data is routed through the internet by PenCast.

Changes

We may update this policy, for example when the apps change. The date at the top shows the latest revision; material changes will also be reflected in the Play Store listing's data-safety section.

Contact

Ahmed Esa — ahmedesa1997@gmail.com