Data Security

Data Security

Effective Date: December 16, 2025
Version: 1.0

Our Commitment to Security

BooxDay takes data security seriously. This document explains the security measures we implement to protect your data, both on your device and during network transmission.

Local Data Security

Storage Location

All app data is stored in external storage on your Onyx Boox tablet:

/storage/emulated/0/Documents/booxdaydb/

This location:

• Is protected by Android file system permissions
• Survives app uninstalls (you can back up this folder manually)
• Can be encrypted using your device's full-disk encryption feature

Database Security

• Room Database: We use Android Room 2.8.4 for structured data storage with prepared statements to prevent SQL injection
• Credential Encryption: Google OAuth2 tokens are encrypted using androidx.security.crypto (AES-256-GCM) before storage
• Binary Encoding: Handwritten strokes stored in SB1 binary format with optional LZ4 compression, not human-readable without the app

Recommended Device-Level Security

We recommend enabling these Onyx Boox security features:

• Screen lock (PIN, password, or fingerprint)
• Full-disk encryption (available in Android settings)
• Regular Android security updates

Network Security

Encryption in Transit

All network communications use HTTPS (TLS 1.2 or higher):

• Google Calendar API: OAuth2 over HTTPS
• OpenRouter API: HTTPS with API key authentication
• ShipBook SDK: Encrypted crash logs over HTTPS

No Background Network Activity

BooxDay does NOT:

• Send data when the app is closed
• Upload data without your explicit action
• Use third-party advertising networks
• Track your location

Authentication Security

Google Calendar Sync

• OAuth2 Flow: Industry-standard authentication, no password storage
• Token Storage: Encrypted locally using androidx.security.crypto
• Scope Limitation: We only request calendar read/write permissions, not full Google account access
• Revocation: You can revoke access at any time via Google account settings

Admin Panel (Website)

• Password Hashing: Bcrypt with cost factor 12
• Session Security: HttpOnly, Secure, SameSite cookies
• CSRF Protection: All forms protected with CSRF tokens
• Rate Limiting: Max 5 failed login attempts, 15-minute lockout

Third-Party Service Security

What We Control

• We control what data is sent to third-party services (only when you enable features)
• We use HTTPS for all API communications
• We minimize data transmission (only OCR'd text, not handwritten images)

What We Do NOT Control

We rely on third-party services for certain features. Their security practices:

• Google: Google Privacy Policy
• OpenRouter: Review their documentation for data handling practices
• ShipBook: Crash logs with no personally identifiable information

Backup Security

Local Backups

• Data stored in /Documents/booxdaydb/ can be manually backed up by copying the folder
• Use encrypted storage for backups (e.g., encrypted USB drive, encrypted cloud storage)

Google Drive Backups

• If you enable Google Drive backup, data is transmitted over HTTPS
• Backup files are stored in your personal Google Drive account
• Google Drive's encryption and security policies apply

Export Security

• PDF, PNG, JPEG, and XOPP exports are unencrypted files
• Store exported files securely if they contain sensitive information

Secure Coding Practices

We follow secure development practices:

• Input Validation: All user input validated on client and server
• Prepared Statements: Database queries use parameterized statements (no SQL injection)
• Output Escaping: All HTML output escaped to prevent XSS
• Dependency Management: Regular updates to third-party libraries
• Code Review: Security-sensitive code reviewed before release

Incident Response

In the event of a security incident:

• We will investigate immediately
• Affected users will be notified via email (if we have contact information)
• We will publish an incident report and mitigation steps

Limitations

We are honest about security limitations:

• No system is 100% secure. We implement industry best practices but cannot guarantee absolute security.
• Physical device access: If someone has physical access to your unlocked device, they can access BooxDay data
• Third-party services: We do not control the security of Google, OpenRouter, or ShipBook
• Rooted devices: Rooted or modified devices may have reduced security protections

Your Responsibilities

To maintain security, you should:

• Use a strong device lock (PIN, password, or biometric)
• Keep your Onyx Boox device updated with Android security patches
• Review Google account permissions periodically
• Back up data regularly
• Report security issues to us at booxdaycalendar@gmail.com

Security Updates

We release security updates as needed. Critical security patches will be prioritized and released out-of-band if necessary.

Contact Us

To report security issues or ask questions about data security:

Email: booxdaycalendar@gmail.com

Please use "SECURITY" in the subject line for security-related reports.

This document provides practical, honest information about our security measures without false claims like "military-grade" or "100% secure."