Toolkit Privacy Policy

Last updated: 12 November 2026

Toolkit (earlier called PDF & Doc Tools) is a file manager, gallery, media player, document reader, PDF editor and phone safety checker for Android, made by attnom. In short: Toolkit has no ads, no analytics and no account, and it does not send your files, your list of apps or anything else about you to anyone. Its one use of the internet is downloading threat lists, described below.

What stays on your phone

• Your files. Documents, photos, videos and music you open, edit, scan or create are read and written only on your phone. Files you create are saved in the Toolkit folders under Documents and Pictures. Toolkit never uploads them.
• Your list of apps. The App check reads the name, signing certificate and permissions of each installed app and compares them with the threat lists on the phone. The result is shown on the phone and kept in the app's private storage. It is never sent anywhere.
• Links you check. When you scan a code, share a message to Toolkit, or open a web link through Toolkit, the address is checked on the phone against the threat lists and for address tricks. Toolkit then passes the link to your browser, or stops and warns you. A short history of recent code scans and link checks may be kept on the phone.
• Your settings. Recently opened and starred documents, reading positions, bookmarks, saved signatures and settings stay on the phone. They may be included in your device's own backup if you turn on Android backup. You can clear them in Toolkit's Settings or by uninstalling the app.

The one use of the internet: threat lists

About once a day, after you have agreed, Toolkit downloads updated threat lists. They are static files on GitHub Pages, at miniwhale-git.github.io/toolkit-definitions. The request is a plain download. Toolkit sends no identifier, no account, no list of apps, no file name and no link with it. As with any web server, GitHub, which hosts the files, sees the IP address a request comes from and handles it under GitHub's own privacy statement. Toolkit checks each list against a signature built into the app before it uses it.

You can switch list updates off in the app. Toolkit then keeps using the lists that came with the installed version. Everything else in Toolkit works without an internet connection.

Permissions

• See all apps. Used only for the App check, to find known stalkerware and malware and risky behaviour among the apps you have installed. The list does not leave the phone.
• Remove apps. Lets Toolkit open Android's own uninstall screen. Nothing is removed until you confirm there.
• Internet. Used only for the threat-list download above.
• All files access. If you allow it, Toolkit uses it to list and manage the files on your phone in one place. You can refuse or withdraw it at any time in Android Settings. Toolkit then works through the system file picker.
• Notifications. Used for the playback and file-copy notifications.

Google Play services components

The document scanner and the code scanner are Google Play services components. They run on your phone through Google Play services, and Toolkit receives only the pages or the code you choose to keep. Anything those components report to Google is covered by Google's own privacy policy. Toolkit does not send your scans anywhere.

Ads, analytics and tracking

Toolkit contains no advertising, analytics, crash-reporting or tracking libraries, and does not use the advertising ID.

Children

Toolkit does not knowingly collect information from anyone, including children.

Changes

If this policy changes, the updated version will be published at this address with a new date.

Contact

Questions about this policy: support@attnom.com