-
Notifications
You must be signed in to change notification settings - Fork 4
Android storage privacy story
Android storage privacy has evolved over the years. With significant developments happening through version 9-11.
This information is scattered across many pages in Android related docs. We try to collect and summarize relevant info here.
Internal storage directories: These directories include both a dedicated location for storing persistent files, and another location for storing cache data. The system prevents other apps from accessing these locations, and on Android 10 (API level 29) and higher, these locations are encrypted. These characteristics make these locations a good place to store sensitive data that only your app itself can access.
source: https://developer.android.com/training/data-storage/app-specific#internal
See Tl;Dr summary at bottom
Scoped storage active
To give users more control over their files and to limit file clutter, apps that target Android 10 (API level 29) and higher are given scoped access into external storage, or scoped storage, by default. When scoped storage is enabled, apps cannot access the app-specific directories that belong to other apps.
source: https://developer.android.com/training/data-storage/app-specific#external
The restriction is concretized to all apps (using scoped storage or not)
Apps can no longer access files in any other app's dedicated, app-specific directory within external storage.
source: https://developer.android.com/about/versions/11/privacy/storage#other-app-specific-dirs
{.exception} If using SAF following take effect only if your app targets Android 11 or higher.
Apps targetting Android 11 or later using SAF can't access
- android/data
- android/obb
source: https://developer.android.com/about/versions/11/privacy/storage#file-access
Can other apps access our app specific directory on External storage?
| Android version | Bare access (with permission^a^b) | Scoped Storage | SAF (file picker) | External dir safety |
|---|---|---|---|---|
| 9 | yes | - | yes | 🔴 |
| 10 | yes | no | yes | 🟠 |
| 11 (other app targets 10) | no(?) | no | yes^c | 🟡 |
| 11 (other app targets 11) | - (scoped storage mandatory^d) | no | no | 🟢 |
Ref:
- ^a https://developer.android.com/training/data-storage#permissions
- ^b https://developer.android.com/training/data-storage/manage-all-files#operations-allowed-manage-external-storage
- ^c When using SAF,
android/data,android/obbare restricted only if app tarets Android 11+ - ^d https://source.android.com/docs/core/storage/scoped
Note: Google play mandates targeting Android 11+ since 2021, so for Android 11 the last row may be considered normative.