Dualscan™ Share privacy policy
Effective October 26, 2026 · Version 1.2.0
Dualscan™ Share transfers user-selected USB folder contents and Git repository snapshots. It operates in your browser. There are no analytics, advertisements, telemetry services, developer-operated transfer servers, or automatic report uploads.
Information used
Save USB to Git enumerates and hashes the regular files in each folder you explicitly select. After you review and authorize a destination, it uploads those file contents and paths to your chosen GitHub, GitLab.com or Bitbucket Cloud repository. Large files may be uploaded to object-storage endpoints designated by that provider's Git LFS service, after an exact-host Chrome permission grant. There is no publisher-operated transfer relay. A generic USB snapshot does not require Smart Switch or OEM files.
Destination access tokens remain in open-page memory and are confined to the selected provider's API and validated LFS negotiation origin. Signed storage credentials are separate; account tokens are not sent to arbitrary storage hosts. Disconnect or reload/close the page to clear credentials. Reports and checkpoints exclude tokens, signed upload URLs and action headers. Provider sign-in/token links open its own website; this package contains no publisher OAuth application secret.
An explicitly selected or imported original-image baseline can be retained in local IndexedDB. It records relative protected paths, byte sizes, SHA-256 values and observed launcher metadata without credentials or a directory handle. It checks original app and opaque launcher byte identities rather than authenticating a publisher or determining license rights. A user-supplied derivative condition and registration notice can appear in exported save reports. You may export or replace this local reference explicitly.
The optional Connect existing USB backup flow reads only within the directory you choose with read permission. It discovers nested package folders, reads Smart Switch marker files and any local backup manifest, and observes relative payload/installer paths, sizes, modification times, and marker SHA-256 hashes. It may display a backup-info device description and snapshot folder identifier. It does not decrypt AppList or encrypted restore payloads, authenticate APK publishers, or verify current APK versions. The built-in OEM catalog contains reference names and installer versions without an inspected drive's absolute path or specific device/timestamp folders.
Connected-backup inventories and their directory handles remain in the open page's memory, are not transfer checkpoints, and are not sent over the network. You may explicitly export an inventory containing relative paths and observed metadata. This read-only connection flow never writes to the selected drive.
The extension reads your repository URL and optional ref, repository metadata, tracked file paths, backup-manifest contents, Git/LFS identifiers, and file bytes needed for transfer and verification. It may also read an optional commit-pinned, Git-verified PNG at assets/dualscan-usb-c.png for source artwork; otherwise it displays packaged artwork. It reads entries and existing bytes in the directory you select to detect conflicts and verify matching content. It writes only missing repository files you authorize there. It does not inspect unrelated browser tabs, browsing history, contacts, or files outside that directory.
An optional GitHub token is used for supported GitHub HTTPS requests during the open page session. It stays in page memory and is not saved in recovery records, settings, logs, exported reports, or transferred repository files. Closing or reloading the page requires entering it again.
Network requests
Repository requests go directly to GitHub-controlled api.github.com, raw.githubusercontent.com, and media.githubusercontent.com HTTPS endpoints. GitHub receives requested repository/ref/file identifiers and normal connection information such as your IP address. Optional authorization is attached only to supported GitHub API requests, not CDN/LFS media requests. GitHub handles its services under GitHub’s privacy statement.
Drive contents, checkpoints, and reports are not uploaded to a developer server. The extension does not sell information, use information for advertising, transfer it to data brokers, or use it for creditworthiness or lending. Information is used only to provide the requested transfer and integrity checks.
Local records and retention
Local IndexedDB may hold a recovery checkpoint, the pinned source plan, progress and verification metadata, and a browser-managed directory handle. These may contain repository file names and hashes. They remain in the local Chrome profile and are not Chrome sync data. Chrome controls directory permission.
Clear the extension’s checkpoint to remove stored recovery records. This does not delete files already written to a drive. Uninstalling removes browser-managed local extension storage. Exported reports and copied files remain at the locations you chose until you remove them.
Your choices
You choose a directory through Chrome’s picker and separately authorize transfer. You can pause, cancel, decline directory access, or choose whether to export a report. Later releases that change these practices must update this policy and the Store disclosures.
Support and privacy contact
For Dualscan™ Share support, privacy questions, or deletion requests concerning support correspondence, contact sa.cs2cd@gmail.com. Do not send access tokens, passwords, recovery phrases or private drive contents. If you contact support, the publisher receives the email address, message and attachments you choose to send and uses them to respond to your request. Support correspondence may be kept as needed to resolve the request or satisfy applicable obligations; you can request its deletion at the same address.
This public page
This policy is hosted on GitHub Pages. GitHub processes normal website connection information, including IP addresses, under its privacy statement. This page adds no analytics, advertising trackers or account-registration form. Updates to this policy will appear at this URL with a revised effective date.