Who we are and what this covers
This policy explains how Zylos Projector (Android package com.zylos.projector, iOS bundle com.zylos.projector) handles information. The app is published by Zylos TechSolutions LLP (“we”, “us”) as part of the Zylos family of apps. Zylos Projector shows photos, videos, music and PDF slides from your phone on a TV or projector (Chromecast/Google Cast and DLNA smart TVs), mirrors your screen to a browser on the same Wi-Fi (Android), casts web videos, and includes a TV remote for Roku and Google TV. Its More Tools tab has three built-in tools — Wi-Fi Analyzer, App Usage (screen time) and App Manager — the same features as the separate Zylos apps, read on your phone.
Available for Android and iOS. Mirroring to a browser and the Google TV remote are Android only; on iPhone, screen mirroring uses Apple's own Control Center / AirPlay. The Zylos account, cloud backup, push notifications, analytics and crash reporting described below are currently active in the Android version only; on iPhone and iPad they are switched off until a later update.
Information the app uses on your device
The app needs the following information to work. It is read, processed and stored on your device. It reaches us only if the table or “Your Zylos account and cloud backup” below says so.
| Information | Why the app uses it | Where it is kept and for how long |
|---|---|---|
| Photos and videos you pick (system photo picker), music and PDFs you pick (document picker) | Showing them on your TV; PDF pages are rendered to images on the phone for slides | Not copied; served only while casting, then access ends |
| Names and models of TVs you connected to (last 8) | Recent devices and one-tap reconnect | App-private storage, until you tap “Forget recent devices” or uninstall |
| Saved TVs for the TV Remote (name, model, IP address) and, for Google TV, a pairing certificate | Reconnecting without pairing again | App-private storage; the certificate's key is kept in Android's secure keystore; until you forget the TV or uninstall |
| Your screen, while mirroring (Android) | Showing it in a browser on the TV or computer | Captured with Android's screen-recording permission only while mirroring is on; frames are kept in memory and never saved |
| Links you paste and pages you open in Web Cast | Finding a playable video to send to the TV | Not stored by the app; the in-app browser (Android WebView / iOS WKWebView) keeps its normal cookies and cache in app storage |
| Settings (slideshow speed, keep screen on, theme) | Your preferences | App-private storage, until uninstall |
| Which other Zylos apps are installed | More Tools shows “Open” or “Get app” | Checked on the phone each time; not stored or sent |
| Wi-Fi Analyzer: current network (name, signal, speed, IP, gateway, DNS) and nearby networks | Showing your Wi-Fi, nearby networks, channel crowding, network checks and a Wi-Fi QR code | Read from Android when you open those screens; not stored |
| Wi-Fi Analyzer: room signal log (room names you type, signal readings) and check history (network names only if you turn that on) | Comparing rooms and past check results | App-private storage until you delete them or uninstall |
| App Usage: Android's usage records (which apps were on screen, for how long, how often opened) and your daily goal | Screen time, opens, reports, categories and a daily goal | Read from Android when you open App Usage (needs Usage access, which you grant in Settings); the goal is kept in app-private storage |
| App Manager: apps with a home-screen icon (name, icon, version, dates, install source, size), their sensitive permissions, and apps you select | Listing apps, storage by category, the permissions explorer and uninstalling several at once | Read from Android when you open App Manager; selections are in memory only |
- The app has no access to your whole photo library on Android: the system photo picker shares only the items you select.
- Wi-Fi Analyzer, App Usage and App Manager are the same screens as the Zylos WiFi Manager, App Usage and App Manager apps. App Usage's daily limits and reminders are only in the App Usage app.
- Only apps you can open from the home screen are listed; the app does not request the list of all installed packages.
Your Zylos account and cloud backup (optional)
- Optional. Every feature works without an account. In the app's Settings → Account you can sign in with Google, create an account with email and password, or continue as a guest.
- What we receive when you sign in: a user ID (a random identifier from Firebase Authentication). With Google sign-in, also your name, email address and profile-photo link from your Google account. With an email account, your email address and the name you enter, if any; your password is handled by Firebase Authentication and never seen by us. A guest gets an anonymous user ID only, with no name or email. We record the sign-in method and when your profile was last updated.
- Cloud backup (only while you are signed in): app and slideshow settings (theme, colour mood, language, slide timing, order, shuffle, loop, keep-awake, haptics). It is saved to your account so you can restore it on another phone. Uploads happen only when this data changed, at most every 10 minutes while the app is open and when it goes to the background; one backup per app, at most 32 KB.
- Never backed up: photos, videos, music, documents and web pages you cast; recent TVs and projectors; launch and review counters, ad timing.
- Where it is stored. Firebase Authentication and Cloud Firestore, run by Google LLC as our service provider (Firebase project
zylos-techsolutions; Firestore region asia-south1 (Mumbai, India)). Security rules let only the signed-in owner read or write their profile and backups. - One Zylos account works across the Zylos apps; each app keeps its own separate backup.
- Deleting. Settings → Account → Delete account removes your sign-in, your profile and every Zylos backup at once. You can also ask for deletion on the web at apps.zylostechsolutions.com/delete-account. Signing out keeps your backup for the next sign-in; a guest account can't be recovered after signing out.
Push notifications
- The app uses Firebase Cloud Messaging (Google) to receive occasional announcements, such as new features or tips. To do this, Firebase gives the app a registration token (a random device identifier).
- Messages are sent from the Firebase console to topics only — everyone with any Zylos app or game, everyone with a Zylos utility app, or everyone with this app — never to a person picked by name, email or behaviour. No personal data is used to target them.
- A message may include a link to a screen in the app, which opens when you tap it. Messages that arrive while the app is open appear as a short in-app notice.
- On Android 13 and later, the app asks for notification permission once, never before your third launch, and not again if you say no. You can turn notifications off at any time in your device's settings.
Information that leaves your device
- Advertising. The Google Mobile Ads SDK contacts Google to request and show ads; through AdMob mediation, the ad networks named under “Advertising and consent” may also receive ad requests and show ads. See that section below.
- Your Zylos account and backup, only if you sign in — see above.
- Analytics, crash reports and Remote Config (Firebase, Google) — see “Analytics, crash reporting and app configuration”.
- Push notifications (Firebase Cloud Messaging) — see above.
- To your TV, on your local network. While casting, the phone runs a small web server bound only to its Wi-Fi address. Each picked file gets a random, unguessable address (128-bit token), and your TV (Google Cast or DLNA) fetches it directly from the phone. The server stops when casting ends. This local traffic uses plain HTTP, as TVs require, and never goes to the internet.
- Screen mirroring (Android). While you mirror, the phone serves your screen as a stream of images to browsers on your Wi-Fi at an address with a random 6-digit code (at most 3 viewers). Everything on your screen is shown, including notifications, and no sound is sent. The stream is plain HTTP on your local network: anyone on the same Wi-Fi who has the address and code could watch, so stop mirroring when you're done.
- TV Remote. Key presses and text you type are sent only to the TV you control on your Wi-Fi: Roku through Roku's local control protocol (plain HTTP), Google TV/Android TV through the Android TV Remote protocol (encrypted TLS).
- Google Cast. Device discovery and playback control use the Google Cast SDK (Google Play services on Android). Google may collect diagnostic data under its own terms: Google Privacy Policy.
- Web Cast. Links and pages you open load directly from those websites, which receive your IP address and set cookies under their own policies. If you cast a web video, your TV fetches it from that website. YouTube and Vimeo links open in their own apps.
- We run no servers of our own. Firebase and AdMob are Google services; Firebase processes data for us as a service provider. Apart from Google and the ad networks named under “Advertising and consent”, we don't share your information with anyone, and we never sell it.
What we never collect
We never sell your information. Without signing in, nothing you create in the app reaches us. In particular, the app never uploads:
- your photos, videos, music, documents or screen contents
- names or addresses of your TVs
- text you type into the TV remote
- your browsing in Web Cast
- your contacts or location (location permission only unlocks Wi-Fi names; the app never requests your location); your name and email only if you sign in to a Zylos account
- Wi-Fi names, addresses or your app list and usage
- anything you create or open in the app, as part of analytics or crash reports
Permissions and why they are needed
Android asks for your permission where the system requires it. You can change any permission at any time in your device settings; the app keeps working without the optional ones and explains what stops working.
| Permission | Purpose | Technical name |
|---|---|---|
| Screen mirroring | Mirroring your screen to a browser while you choose to. Android asks every time (“Start recording or casting?”) and shows a notification while it's on; you can stop from the notification. | android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION (+ the system's screen-capture consent) |
| Notifications (Android 13+) | The ongoing notification while mirroring, with a Stop button. Also occasional announcements from us (see “Push notifications”), asked for at most once and never before your third launch. | android.permission.POST_NOTIFICATIONS |
| Wi-Fi information and multicast | Finding Chromecast, DLNA, Roku and Google TV devices on your Wi-Fi and serving media on the Wi-Fi address. | android.permission.ACCESS_WIFI_STATE, CHANGE_WIFI_MULTICAST_STATE |
| Location (while using the app; Wi-Fi Analyzer only) | Android only reveals Wi-Fi names and nearby-network scan results to apps with location permission and with Location turned on. Asked only when you open Wi-Fi Analyzer, after an explanation; the app never requests your location. Background location is blocked. | android.permission.ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION |
| Wi-Fi scans and network details | Refreshing the nearby-network list and reading link details for Wi-Fi Analyzer. | android.permission.CHANGE_WIFI_STATE, ACCESS_NETWORK_STATE |
| Usage access (special access, you grant it in Settings) | App Usage's screen time and App Manager's data sizes and last use. Optional; asked only when you open those tools, with the steps explained first. | android.permission.PACKAGE_USAGE_STATS |
| Request to uninstall apps | App Manager asks Android to uninstall the apps you select. Android shows its own confirmation for each app. | android.permission.REQUEST_DELETE_PACKAGES |
| Pick photos, videos, music and PDFs | Only the files you select are shared with the app. Broad media and storage permissions are removed from the Android manifest. | Photo picker and document picker (no manifest permission) |
Permissions present in every Zylos app
| Permission | Purpose | Technical name |
|---|---|---|
| Network access | Loads ads from Google AdMob, talks to Cast/DLNA TVs and TV remotes on your Wi-Fi, and loads web pages you open in Web Cast. | android.permission.INTERNET |
| View network connections | Checks whether the phone is online before loading ads and casting. | android.permission.ACCESS_NETWORK_STATE |
| Advertising ID | Added by the Google Mobile Ads SDK. Lets the SDK read the Android advertising ID, subject to your consent and your device's ad settings. | com.google.android.gms.permission.AD_ID |
| Android ad services (Privacy Sandbox) | Added by the Google Mobile Ads SDK for Android's privacy-preserving ad APIs. Controlled by your device's ad privacy settings. | android.permission.ACCESS_ADSERVICES_AD_ID / _ATTRIBUTION / _TOPICS |
| Background work | Added by bundled Android libraries (e.g. WorkManager used by the ads SDK) to finish short background tasks. | android.permission.WAKE_LOCK, android.permission.FOREGROUND_SERVICE |
| Vibration | Haptic feedback on taps. Can be turned off in the app's Settings. | android.permission.VIBRATE |
| Play Install Referrer | Added by a bundled Expo library. The app does not read or send the install referrer. | com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE |
| Receive push messages | Added by Firebase Cloud Messaging so the app can receive the occasional announcement sent to all of its users (see “Push notifications”). | com.google.android.c2dm.permission.RECEIVE |
iPhone and iPad
- Local Network — to find Chromecast and Google TV devices on your Wi-Fi.
- Photos (system picker) — only the photos and videos you select.
- Screen mirroring on iPhone uses Apple's own Control Center / AirPlay; the app only shows a guide and the AirPlay picker.
- No App Tracking Transparency prompt (non-personalised ads only).
Not requested: camera, microphone, contacts, background location, phone state, overlay, the list of all installed packages (QUERY_ALL_PACKAGES), and broad storage/media permissions (all explicitly removed).
Advertising and consent (Google AdMob)
- The app is free and shows ads from Google AdMob, provided by Google LLC (Google Ireland Limited for users in the EEA and Switzerland).
- Consent first. Before ads load, the app uses Google's User Messaging Platform (UMP). Where the law requires it (for example in the EEA, the UK and Switzerland, and in US states with privacy laws), you see Google's consent form and can accept, reject or customise. Where Google tells the app that privacy options are required, Settings → Privacy → Ad privacy choices lets you change your choice at any time.
- What Google collects. When ads are requested or shown, the Google Mobile Ads SDK collects information such as your device's advertising identifier (on Android), IP address, app and device information, ad interactions and diagnostic data. Google uses it to show ads (personalised only if you consent), measure them, and prevent fraud and abuse. This happens under Google's own policies: How Google uses information from sites or apps that use its services and the Google Privacy Policy.
- Other ad networks (AdMob mediation). To fill an ad request, AdMob may let these networks bid, and the winner shows the ad: Liftoff Monetize (Vungle), Meta Audience Network, Mintegral, Unity Ads. Their SDKs are part of the app. When a network requests or shows an ad, it receives information such as your device's advertising identifier, IP address, app and device information and ad interactions, and uses it under its own privacy policy (linked above) to show and measure ads and prevent fraud. They receive your choice from Google's consent form (IAB consent and US privacy signals) and show personalised ads only where you allowed it.
- Which ads. The ad networks, ad formats and how often ads appear can be adjusted remotely (Firebase Remote Config, below), within fixed limits built into the app. Your account, backup and analytics data are never given to ad networks.
- iPhone and iPad. The app requests non-personalised ads only and does not use Apple's advertising identifier (IDFA), so it does not show the App Tracking Transparency prompt.
- Your controls. On Android you can reset or delete your advertising ID in Settings → Privacy → Ads (wording varies by phone). You can also manage Google ad personalisation at adssettings.google.com.
- Ads are limited to content suitable for a general audience (maximum ad content rating “PG”). Banners sit below the content of calm screens, never on the player, a running slideshow, the browser or a TV pairing code. A full-screen ad may appear only when you open another tab or feature (at most one per two taps, never in the first minute), and never while casting, mirroring, pairing or using the TV remote; all ads are suppressed while you mirror your screen.
Analytics, crash reporting and app configuration
- Firebase Analytics (Google) records how the app is used: which screens and features are used, settings chosen, counts and similar events (media kinds and counts only; never file names, device names or URLs), together with an app-instance ID, the advertising ID where available, device model, operating system and version, app version, language and an approximate country or region derived from the IP address. We use it to see which features help people and what to improve — not for advertising, and we don't share it.
- Firebase Crashlytics (Google) receives a report when the app crashes, and the app's own warnings and errors in release builds: the technical trace, device model, operating system, app version, free memory and storage, and a Crashlytics installation ID. Reports never include your content.
- Firebase Remote Config (Google): when the app starts, it downloads settings such as which ad formats are on and how often ads may appear. The request carries a Firebase installation ID and app and device information, but no personal information.
- Firebase keeps analytics data for the retention period set in our Firebase project (at most 14 months) and crash reports for 90 days. See Firebase privacy and security.
Children
The app is a general-audience utility and is not directed to children under 13 (or the minimum age in your country). We do not knowingly collect personal information from children. Ad requests are not tagged as child-directed. If you believe a child has created a Zylos account, contact us and we will delete it.
Keeping and deleting your information
- Everything the app stores on your device lives in its private storage. Uninstalling the app deletes it. You can also use Android's Settings → Apps → Zylos Projector → Storage → Clear storage.
- Use Settings → “Forget recent devices”, and “Forget” in the TV Remote, to remove saved TVs at any time.
- Web Cast cookies and cache are part of the app's storage and are removed when you clear the app's storage or uninstall.
- Android cloud backup of the app's data is turned off, so no copy is made in your Google account by Android.
- Your Zylos account and backups are kept until you delete them (in the app, or at apps.zylostechsolutions.com/delete-account). Deleting removes them from Firebase right away; copies in Google's encrypted system backups expire within Google's standard backup cycle.
- Analytics data is kept for at most 14 months and crash reports for 90 days. Information collected by Google for ads is retained and deleted under Google's policies; see the links above.
Security
- All connections to Firebase and to Google's ad services use encryption in transit (HTTPS/TLS). Google encrypts stored Firebase data at rest.
- Firestore security rules allow only the signed-in owner to read or write their profile and backups; nobody else, including other users, can read them.
- Your password, if you create one, is handled by Firebase Authentication; we never receive or store it.
- The casting server listens only on your Wi-Fi address, only while casting, and serves only the files you picked under random addresses.
- The mirroring server listens only on your Wi-Fi address while mirroring, answers only under the random code, and allows at most 3 viewers.
- Google TV pairing uses TLS with a client certificate in Android's keystore; the TV's certificate is pinned after pairing.
- Local TV traffic (casting, DLNA, Roku, mirroring) is unencrypted HTTP inside your network — use trusted Wi-Fi.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR, India's DPDP Act or US state privacy laws), you may have rights to access, correct, export or delete your personal information, to object to or restrict its processing, and to withdraw consent. You can delete your account and backups yourself in the app or at the web link above, see your account details in Settings → Account, and change your ad consent in the app. For anything else, including a copy of your account data, contact us at the address below. You may also complain to your local data-protection authority.
Changes to this policy
If the app's data practices change, we will update this page and the date at the top before the change ships. Significant changes will also be noted in the app's release notes.
Contact
Questions or requests: support@zylostechsolutions.com. If you email us, we receive your email address and whatever you write (the app's feedback link adds only the app version and Android/iOS version). We use it only to reply and delete it when the conversation is finished.
Help and frequently asked questions: Zylos Projector support. Terms for using the app: terms of use.
Publisher: Zylos TechSolutions LLP.