TileShell is a launcher (home-screen replacement) for Android. It does not have a server backend, does not create user accounts, and does not transmit personal data to the developer. All personalisation data (layout, settings, photos) stays on your device.
TileShell requests the following permissions. Each is optional — the relevant feature simply stays inactive when a permission is denied.
| Permission | What it reads | Where the data goes |
|---|---|---|
READ_CONTACTS | Contact names and profile photos for the People tile and hub, and Quick Search. Your favourites order and which ones show on the favourites tile are saved as contact identifiers in TileShell's settings (and in backups you export) | Stays on device |
READ_CALENDAR | Upcoming calendar events for the Calendar tile and hub, and the Productivity hub's next meeting | Stays on device |
ACCESS_COARSE_LOCATION | Device coarse location (city level) for the Weather tile, hub and widget | Sent to Open-Meteo (see §2) |
ACTIVITY_RECOGNITION | Your phone's built-in step-counter sensor reading, for the Health hub and its tile and widget. A daily step history (about four months) is kept in a file on the phone, never uploaded. Asked only when you add a steps tile or open the hub's steps. | Stays on device |
READ_MEDIA_AUDIO | Music files, albums and playlists on your device, for the Music hub library | Stays on device |
NOTIFICATION_LISTENER (special access) | Notification titles, snippets and attached images for badges, message previews and the People hub's "what's new"; the names of people who message you in chat and SMS apps, kept 30 days for "recently messaged"; replies you type are sent back through the posting app's own notification | Stays on device |
NOTIFICATION_LISTENER — Money hub | New bank SMS (as shown by your messages app) and payment-app notifications, to record transactions: amount, debit or credit, merchant or person, account last 4 digits, method and balance. Card statements, bill-due reminders (amount and due date) and card bill payments too, shown as bills due by date. Only new notifications — SMS history is never read. OTPs and promotions are ignored. The Money tile shows amounts only if you choose it. Can be turned off in the Money hub's settings. | Stays on device |
USE_BIOMETRIC | Nothing read; asks for your fingerprint, face or screen lock before showing the Money hub's transactions | Not read; no data transmitted |
PACKAGE_USAGE_STATS (usage access, special access) | How often each app was opened over the last 30 days, and per-app screen time, to sort the People and Productivity hubs' apps pages and to show screen time in the Battery hub | Stays on device |
POST_NOTIFICATIONS | Nothing read; shows the Music hub's playback controls and your task reminders in the notification shade | Not read; no data transmitted |
SCHEDULE_EXACT_ALARM ("Alarms & reminders", special access) | Nothing read; lets a task reminder go off at the exact minute you set | Not read; no data transmitted |
RECEIVE_BOOT_COMPLETED | Nothing read; sets your task reminders again after the phone restarts | Not read; no data transmitted |
WRITE_SETTINGS (special access) | Nothing read; lets the Quick Panel change screen brightness and timeout | Not read; no data transmitted |
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS | Nothing read; keeps live updates running while the screen is off | Not read; no data transmitted |
INTERNET | Weather, news, stock, commodity and sports data, podcasts, radio streams and wallpapers | Sent to the services in §2 |
BIND_ACCESSIBILITY_SERVICE (optional) | Used only to perform system actions you trigger: lock screen, recents, and opening the notification shade or quick settings with an edge swipe | Not read; no data transmitted |
FOREGROUND_SERVICE, FOREGROUND_SERVICE_MEDIA_PLAYBACK, WAKE_LOCK | Nothing read; keeps music, podcasts and radio you started playing with the screen off, with controls in the notification shade | Not read; no data transmitted |
READ_EXTERNAL_STORAGE (Android 12 and older only) | Music files on your device for the Music hub, as READ_MEDIA_AUDIO does on newer Android | Stays on device |
SET_WALLPAPER | Nothing read; sets the photo or wallpaper you choose on your home and/or lock screen | Not read; no data transmitted |
REQUEST_DELETE_PACKAGES | Nothing read; opens Android's own uninstall prompt when you choose "uninstall" on an app | Not read; no data transmitted |
ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE | Whether you're online and Wi-Fi is on, for the Quick Panel and to skip fetches while offline | Not read beyond on/off; no data transmitted |
BIND_INPUT_METHOD — TileShell keyboard (beta, optional) | Only when you turn the TileShell keyboard on in Android's keyboard settings and choose it: the text you type into the field you're typing in, and text you copy (for clipboard history). See "TileShell keyboard" below | Stays on device |
VIBRATE | Nothing read; a short buzz on key presses in the TileShell keyboard (turn off in its settings) | Not read; no data transmitted |
BIND_DEVICE_ADMIN (optional, Android 8–9 only) | Used only to lock the screen when you ask, on Android versions without the accessibility lock action | Not read; no data transmitted |
TileShell holds no SMS or call-log permission and never reads your SMS inbox or call log — bank messages are seen only as notifications, as described above. It does not use the microphone or camera, and reads no files beyond photos you explicitly pick for the wallpaper and live-photos slideshow, the music on your device, and the videos in folders you choose in the music + videos hub (read through the system folder picker, only those folders, never copied or sent anywhere; a video opens in your phone’s own video player).
The TileShell keyboard is optional and works only after you turn it on in Android's keyboard settings and choose it. Android shows its own warning at that step, as it does for every keyboard, because a keyboard sees what you type. The TileShell keyboard never connects to the internet: nothing you type, learn or copy is sent anywhere. It has no voice typing and does not use the microphone. Its word lists ship with the app. Nothing is learned or kept in password fields.
When you grant coarse location for weather, TileShell sends your approximate coordinates to Open-Meteo to retrieve a forecast. The request contains latitude/longitude only — no device identifiers, no account information. Open-Meteo's own privacy policy applies to data they receive.
The Feed page fetches articles from the RSS/Atom feeds you have enabled. Each request is a standard HTTP GET to the feed URL; no personal data is included. The feed providers' own privacy policies apply.
Stock and commodity tiles and widgets fetch prices from Yahoo Finance; sports tiles and widgets fetch scores from ESPN. Each request contains only the symbol or league/team you picked — no personal data.
The shopping hub reads order updates ("out for delivery", "delivered", delivery OTPs) from the notifications of your shopping, food and courier apps, and from SMS and email notifications that name a store, and from business chats (such as WhatsApp) with a store, as they arrive; the same stores' promotional notifications are kept as "deals" for up to 14 days; it needs no SMS permission and cannot read old messages. Orders and deals are kept on the phone only (orders for up to 90 days), are not uploaded and are not in exported backups. Delivery OTPs stay hidden until you unlock with your fingerprint, face or screen lock (when set). You can turn reading off or clear the history in the hub's settings.
The news hub's live tv page plays a news channel's live stream inside TileShell through YouTube's own embedded player, or opens it in YouTube (or your browser). When the page is shown, TileShell fetches each listed channel's public YouTube page to see whether it is on air; the request carries only the channel's name, no personal data. The channels you choose are stored on the phone (and in exported backups); saved stories are stored only on the phone and are not exported. Google's own privacy policy applies to what YouTube receives when a channel plays or is opened.
If you use TileShell Music in Android Auto, the car screen shows your music library, playlists, favourite podcasts and stations from this phone. Android Auto (Google) is the only app, besides the system and TileShell itself, that can browse or control it. TileShell does not send any of this anywhere, and voice requests are handled by your assistant, not by TileShell.
The Music hub searches podcasts through the Apple iTunes Search API and radio stations through the Radio Browser directory (radio-browser.info), then streams from each show's or station's own server. Requests contain only your search words, category or country filter.
When "bing daily wallpaper" is on, TileShell downloads Microsoft Bing's image of the day. The request contains only your language/region, to pick the right image.
Tapping the search pill on the Feed page opens a Google Search query in your default browser. TileShell does not intercept or log these queries.
TileShell stores the following data locally on your device (using Android Room and DataStore):
You can export a backup file of this data (including notes and tasks) from Personalize, and optionally have TileShell save one automatically to a folder you choose (for example in Google Drive). The files go only to that folder, which you pick and can change or stop at any time. None of this data is backed up to the developer's servers. Android's standard auto-backup to Google may back it up according to your device's backup settings.
TileShell is not directed at children under 13 and does not knowingly collect personal information from children.
Material changes will be noted in the app's release notes and reflected by updating the "Last updated" date above.
Questions about this privacy policy: vivek.sovani@gmail.com