FileBase

Privacy policy

About this policy

This policy explains how FileBase for Meta Quest handles information and how this website handles visits. FileBase is developed by Matt Sich. FileBase is independent of Meta and Slack. For privacy questions or deletion requests, email help@filebaseapp.com.

The short version

FileBase processes files on your headset. It does not require a FileBase account, upload files to the developer for processing, include advertising, or send app usage analytics to the developer. Files leave your device when you choose to share them, use an external destination, or enable Local Access. Your device platform, document providers and chosen services have their own privacy practices.

Files, permissions and on-device processing

FileBase reads file contents and metadata, such as names, types, sizes and locations, to browse, preview, edit, convert and share files. It accesses its FileBase workspace and files you open or share with it. If you enable all-files/shared-storage access in device settings, FileBase can browse accessible shared storage beyond its own folder; Android still restricts protected locations. System document providers can grant access to selected files or folders. Revoke permissions in device settings or the relevant provider. Revoking access does not delete copies already saved. Image processing, video export, text and document editing, PDF signing and 3D previews run on the headset. FileBase may create local copies, previews and temporary processing files. Your documents are not used by FileBase to train AI models.

Signatures, drafts and recent files

Saved signatures and initials can include drawn strokes, an imported image, a name you assign, and creation information. They are stored in the app’s private local storage for reuse. They are not sent to the developer. A signature you place in an exported document becomes part of that document and goes to anyone you share it with. FileBase also stores local settings, recent-file references and retained access grants, and text/document drafts used for recovery. PDF additions that have not been exported remain in memory. Treat saved signatures and signed documents as sensitive information, and protect access to your headset.

Camera and signature capture

Where a camera-based signature capture option is available and you choose to use it, FileBase requests the permissions needed for that capture. Images selected or captured for signatures are processed locally to prepare the signature. FileBase does not send these images to the developer. You can decline or revoke camera access in device settings; drawing or importing a signature remains a separate option.

Optional Slack connection

If you connect Slack, FileBase uses Slack’s authorization flow to obtain access and refresh tokens and information needed to identify the workspace and your connected account. It requests channel, conversation and people information so you can choose a destination. Credentials are encrypted in app-private storage using Android Keystore. FileBase communicates directly with Slack; there is no FileBase developer server in this flow. Only files you choose and confirm are uploaded, along with the file names and destination information needed for delivery. Slack, the workspace owner, recipients and any applicable administrators control access and retention after upload. Disconnecting removes the connection credentials from this headset and attempts to revoke access with Slack. If revocation cannot complete, remove FileBase through Slack’s app settings. Disconnecting does not delete previously uploaded files or recipient copies. Slack’s privacy policy and your workspace policies apply.

Sharing with other apps and services

When you invoke the system share sheet or save through a document provider, the app or provider you select may receive file contents, file names and the access needed to complete that action. Cloud-backed providers may upload or sync files under their own settings and policies. FileBase cannot verify final delivery by another app or delete copies held by recipients.

Local Access over Wi-Fi

Local Access is optional. While enabled, FileBase runs a web server on the headset that lets paired browsers on the local network browse, preview and download files in the shared FileBase folder, and upload files into it. Files outside that folder are not exposed by Local Access. The pairing code, connection information and browser session are used to authorize access. The browser receives a session-only HttpOnly, SameSite authentication cookie; it is for access control, not advertising or tracking. A fresh four-digit code is created for each new sharing session. Anyone able to pair can access the shared folder, so share the code only with people you trust. Transfers use HTTP and are not encrypted in transit. Use trusted Wi-Fi; do not expose or forward the sharing port to the public internet. No developer relay server carries these transfers. Turn Local Access off to end the session and invalidate access. Closing the app, process termination or the awake inactivity timeout also ends sharing. Headset sleep can pause connectivity and retain the session for wake, so sleep is not a reliable way to revoke access. Downloads already saved on another device remain there.

Website visits

This static website does not include advertising trackers, analytics scripts, third-party fonts, or email signup forms. It does not collect email addresses. When the website is hosted on Cloudflare, Cloudflare processes technical request data, such as IP addresses, requested URLs, timestamps and browser/network information, to deliver and secure the site. Cloudflare’s own privacy policy explains its handling of that information. Hosting/security records are separate from the files processed locally in FileBase. This website does not access the files on your headset.

Support and information you choose to send

If you contact the developer, the information you choose to provide—such as your email address, message, app version, device model, screenshots or diagnostic output—is used to answer your request and investigate problems. Do not send credentials, pairing codes, private documents or signatures unless strictly necessary. Diagnostic messages may contain file names, paths or provider identifiers; review and redact them before sharing. FileBase does not automatically upload these diagnostics.

Retention and deleting your information

Local files remain until you delete them. Saved signatures remain until removed in Signatures or app-private data is cleared. Recent-file entries can be removed from the recent list; this does not delete the original file. Drafts and private settings can be removed by clearing FileBase’s app storage in device settings. Uninstalling removes app-private data, but files saved in shared storage, including the FileBase folder, may remain and must be deleted separately. Exported signed documents retain their signatures even if the reusable signature is later deleted. Temporary processing artifacts from prior sessions are eligible for cleanup after one day; cleanup excludes retained drafts, signatures, saved files and outputs still in use. This is not an automatic deletion deadline for your documents. Disconnect Slack and revoke the authorization there to remove service access; delete uploads in Slack or contact the workspace administrator to address retained copies. Delete browser downloads on each receiving device. The developer cannot remotely erase files stored only on your headset or copies held by third parties. Support correspondence is kept only as needed to resolve the request, maintain necessary support records or meet legal obligations. If retention is required by law, the developer will explain the applicable reason when responding to a deletion request.

Your privacy choices and requests

You can control app permissions, disconnect integrations, stop Local Access, remove signatures and recent entries, and delete local files or app storage. Depending on your location and the information held, you may also have rights to access, correct, delete or obtain a copy of personal information, restrict or object to processing, withdraw consent, or complain to your local data protection authority. For information you send to the developer, request access, correction or deletion using the privacy contact below. The developer may request enough information to verify that the request concerns you, but will not need your Slack password, account tokens or pairing code. Requests concerning Meta, Slack, cloud providers or recipient copies should also be directed to the relevant service. FileBase does not sell personal information or share it for cross-context behavioral advertising.

Security and platform services

FileBase uses Android’s app-private storage for private settings, drafts and saved signatures, and Keystore-backed encryption for Slack credentials. Android app backup is disabled in the current build. Shared-storage documents and exported copies are not protected by the same app-private boundary. No system or network is completely secure, and Local Access has the unencrypted-network limitation described above. Meta Horizon OS, the Horizon Store and external services may process account, device, purchase or diagnostic information independently under their own policies. Purchases made through the Horizon Store are handled by Meta under its own policies; FileBase does not receive your payment card details.

Children and changes to this policy

FileBase is a general-purpose file utility and is not directed at children under 13. Do not send a child’s personal information through support. If you believe a child has provided personal information to the developer, use the privacy contact to request review and deletion. Platform age requirements also apply. The date above will change when this policy is revised. Material changes to how information is handled will be described before the new processing begins.

Privacy contact

Publisher: Matt Sich. For privacy questions, access or correction requests, or deletion of information you have sent to the developer, email help@filebaseapp.com with the subject FileBase privacy request. Please describe your request and use the email address associated with any previous correspondence where possible. Do not include passwords, tokens, pairing codes, or copies of signatures. For files stored only on your headset, follow the local deletion steps above. If a request cannot be fulfilled because the developer does not hold the information or must retain it to meet a legal obligation, the response will explain why. If you are reporting a child’s information, please say so in your message.