Effective date: 30 October 2026. This policy describes the currently prepared Android product. It will be reviewed against the exact distributed build before Google Play publication.
Controller and purpose
Medicw Limited publishes NPM Pocket, an unofficial mobile client for infrastructure administered by the user.
Information handled
The app processes your server address, login information, two-factor authentication codes during login, session tokens, proxy host/certificate metadata and selected server responses. It connects directly to your configured endpoint and does not use a Medicw Limited relay.
Local credential security
Saved sessions and credentials are protected locally using Android Keystore-backed encryption. One-time 2FA codes are used to complete login and not intentionally retained afterward. Android cloud backup of app data is disabled.
Network transport
HTTPS is the default. Explicit opt-in to HTTP for trusted local network connections may expose transmitted credentials to network observers. NPMplus connections require HTTPS.
Developer data and SDKs
This app does not have a Medicw Limited account, advertising SDK, analytics backend, crash reporting SDK or developer-operated data collection relay. A server you control may separately retain access logs.
Retention and deletion
Delete a saved instance, clear app storage or uninstall to remove local profiles and protected credentials. No developer-hosted NPM Pocket account exists to delete.
Children
This infrastructure administration utility is not designed for children.
Policy changes
We may update this policy if the app, SDKs or data practices change. The effective date will be updated for material revisions.
Contact
Publisher: Medicw Limited. Privacy and product support: [email protected].