This policy explains what personal data Device ID Changer (the "app"), its Instant Apply feature
and the licensing server at license.sdex.dev process, why, and what your rights are.
1. Who is responsible
The controller is Yurii Mysochenko, a sole trader registered in Poland (NIP 5243015493, REGON 529448662).
Contact: support@sdex.dev.
2. In short
- The app has no ads, no analytics and no tracking libraries.
- The app sends us only what the Instant Apply license needs: data that ties a license key to one device.
- The Android IDs you set are never sent to us, except in a report you choose to send us yourself (section 3.4).
3. What we process
3.1 Data that stays on your device
The app stores on your device: the IDs you set and their backups, your settings, the license token, app logs (kept for 7 days), and the files Instant Apply needs to run. None of this is sent to us.
To recognise your device after a reinstall, the app writes a device marker to
/data/system/idv2iap_bytes. It contains the app's own Android ID. It survives uninstalling the app
and is removed by a factory reset; you can also delete it with root. Only a one-way hash of it ever
leaves the device, when you activate Instant Apply (section 3.2).
3.2 Licensing (Instant Apply)
When you activate a license key, and when the app checks the license or downloads Instant Apply's components, the app sends:
- the license key (on activation only);
- a public key the app creates for your device (the private key never leaves the device's secure hardware), and signatures made with it;
- the certificate chain Android provides for that key, which describes the device's security hardware and software (for example Android version and security patch level);
- a hash of the device marker, and the device's manufacturer and model;
- the app version and the versions of the Instant Apply components it has.
Our server records these together with the time and your IP address, and links them to your license.
Why: to provide the license you bought (performance of a contract) and to prevent keys from being shared or abused (legitimate interest).
3.3 Purchases
Reseller. Orders are processed by our online reseller, which acts as the merchant of record, is named at checkout and handles your payment details under its own privacy policy. We receive the order details: your email address, the name you gave, your country, the product, the price, the date and the order number.
Cryptocurrency. Direct cryptocurrency payments are processed by OxaPay. We receive your email address, the amount, the currency, the transaction hash and the sending wallet address.
We use this data to issue and deliver your key, to help you recover it, to handle refunds and support, and to keep accounting records.
Why: performance of a contract, and our legal obligation to keep accounting records.
3.4 Reports you send us
Contact us and the crash prompt prepare an email to support@sdex.dev that you send from your own email app. Nothing is sent unless you send it. The email has a password-protected archive containing:
- the app's logs and, for Instant Apply, its hook log;
- device details: manufacturer, model, build fingerprint, Android version, security patch level, language, and the root, Xposed and SELinux status;
- system diagnostics read with root (kernel log and mount list);
- the list of installed apps with their versions and, when you send from Contact us, their current Android IDs.
We also receive your email address and what you write.
Why: to answer you and fix the problem (legitimate interest, and your request).
3.5 Website
The Device ID Changer pages at sdex.dev/id have no analytics and set no cookies. Firebase Hosting, which serves them, logs requests, including IP addresses.
3.6 Downloads from third parties
Depending on your setup, the app downloads a third-party tool from GitHub, and you may download the app itself from GitHub. GitHub sees your IP address under its own privacy policy.
4. What we do not collect
We do not collect usage statistics or analytics, the IDs you set (except as in section 3.4), your IMEI or other hardware identifiers, your location, contacts, messages, advertising ID or the content of other apps.
5. Who processes data for us
| Service | What for |
|---|---|
| Cloudflare | Hosting the licensing server and its database |
| Resend | Sending license key and recovery emails |
| Proton | Our email |
| Google (Firebase Hosting) | Hosting sdex.dev |
Our reseller and OxaPay process payments as independent controllers under their own privacy policies.
Some of these providers process data outside the European Economic Area, including in the United States. Where they do, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
We do not sell personal data.
6. How long we keep data
| Data | Kept |
|---|---|
| Purchases and licenses | As long as the license exists, and at least for the period Polish tax law requires (5 years from the end of the year of purchase) |
| Licensed devices | While active; 12 months after deactivation, which includes the end of the license (refund, revocation, or the end of a trial). Devices blocked for abuse: as long as the license exists |
| IP addresses in licensing records | 90 days |
| Support emails and reports | 12 months after the issue is closed |
| Short-lived security data (one-time codes, tokens) | Up to 30 days |
Cloudflare keeps request logs, including IP addresses, for a short period under its own retention rules.
7. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or transfer it to you in a machine-readable format.
Deleting license data also ends the license, so we will tell you before we do it. We may keep purchase records we are legally required to keep.
To make a request, contact us as in section 1. We reply within one month.
You can also complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl) or to the authority in the country where you live.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
8. Age
The service is for people aged 18 and over. We do not knowingly collect data from children.
9. Security
Data is sent over HTTPS. License keys are stored on our server only as one-way hashes, and reports are sent in password-protected archives. No system is perfectly secure, but we limit what we collect and who can access it.
10. Changes
We will publish any change to this policy with a new effective date on sdex.dev/id, and tell users in the app for significant changes.