Privacy Policy

1. The short version

Your photos never leave your phone. Not the images, not the thumbnails, not the perceptual hashes computed to find duplicates, not the capture dates, not the file names, not the identifiers your operating system gives them. Every piece of image processing — the scan, the size estimate, the screenshot detection, the duplicate detection, your keep-or-discard decisions — happens on your device, and its results are written to a database that stays there.

That promise is narrow on purpose, because the app does use the network. All of it is named on this page:

Advertising. The free version shows a banner, and offers an optional video you can watch for ten more swipes. Both are served by Google AdMob, which receives the technical data that any advertising request carries. The advertising is not personalised (section 8). Buying GigaBack once removes the banner.
A small profile stored with Firebase. A handful of counters — how many swipe decisions you have used today, how many gigabytes you have freed in total, your streak — are kept under an anonymous identifier so that clearing the app's data does not hand out a fresh daily quota (sections 5 and 6). No photo, no thumbnail, no hash and no date is ever part of it.
Your purchase, which goes through the App Store or Google Play and is verified against the store (section 7).
Anonymous usage statistics, a fixed and short list of events with no exact values in them, which you can turn off in Settings (section 9).

There is no account to create and no login. We never ask for your name, your email address or your phone number to use the app.

The rest of this page is the detailed version. It is written to be read, not to be skipped.

2. Who is responsible for your data

The controller of the limited personal data described here is WISEPEAR - LABORATÓRIO TECNOLÓGICO, UNIPESSOAL, LDA, a Portuguese single-member private limited company (sociedade unipessoal por quotas) with a share capital of €2,500, registered under NIPC 516410300, whose registered office is at 564 Rua Carvalhal de Cima, 4990-610 Fontão - Ponte de Lima, Portugal, publisher of the GigaBack app.

Contact: hello@gigaback.app

No data protection officer has been appointed: the processing described here falls into none of the cases listed in Article 37 GDPR. The publisher is established in Portugal, inside the European Union, so no representative under Article 27 is required.

3. Your photos stay on your device

GigaBack needs access to your photo library to do its job. That access is used exclusively on the device, through the operating system's own photo APIs (PhotoKit on iOS, MediaStore on Android).

Specifically:

No photo, video, thumbnail or preview is ever uploaded, transmitted, backed up or shared with us or with anyone else.
No photo metadata leaves the device either — not the capture date, not the dimensions, not the file size, not the location data, not the file name, not the identifier the operating system assigns to an asset.
No perceptual hash leaves the device. The fingerprints the app computes to group duplicates and bursts are derived from your images, so we treat them exactly like the images: they are written locally and they stay locally.
The technical data the app computes — the per-photo record, the hash, the "keep" or "discard" status, the month it belongs to — is written to a local database inside the app's private storage. Nothing from that database describing a photo is ever sent anywhere. The only values that go the other way are the plain counters listed in section 6.
The app keeps working without a network. Sorting, the internal trash and the counters never wait for a connection; the profile in section 6 catches up later and the banner in section 8 simply stays empty. It is not an offline-only app, and we will not describe it as one.

We cannot see your photos. We cannot recover them. We do not know how many you have, and we do not know what they show.

Uninstalling the app deletes that local database, and with it your sorting progress. The counters in section 6 are held separately and outlive the uninstall — that is what they are for, and section 16 explains how to have them erased.

4. Deletion goes through your operating system, not through us

When you confirm a batch, GigaBack asks your operating system to move the items to its own trash: "Recently Deleted" on iOS, the system trash on Android. They normally stay recoverable there for 30 days. That handover is done by the system, on the device. We are not a party to it, and we receive nothing from it.

5. No account, but an anonymous identifier

GigaBack has no sign-up. There is no user account, no password, no profile to fill in and no email collection to use the app. Your purchase is attached to your Apple or Google store account, not to an identity we hold.

To store the counters in section 6, the app still needs to know which document is yours. Two mechanisms give it that, and neither one tells us who you are:

Firebase Anonymous Authentication (Google). Your installation is issued a random identifier — a UID. It is not linked to your name, your email address, your Apple ID or your Google account, and we cannot resolve it to a person. It does not survive uninstalling the app.
A device attestation. Because that identifier disappears when the app is uninstalled, the free quota is additionally anchored to the device itself. On iOS we use Apple DeviceCheck, which gives us two persistent bits per device and a token our server checks with Apple; on Android we use Google Play Integrity, whose token our server checks with Google. Both tell us only whether this device has been seen before. Neither returns a name, an account or a hardware serial number to us, and the private key used for verification stays on the server — it is never shipped inside the app. Play Integrity is the weaker of the two, and we would rather say so than imply an anchor we do not have.

If you write to us at hello@gigaback.app, we obviously receive your email address and whatever you put in the message. We use it only to answer you, and we keep the exchange only as long as necessary for that (see section 13).

6. What we store with Firebase

One document per anonymous identifier, in Cloud Firestore (Google). It exists for one reason: the free daily quota has to survive someone clearing the app's data, and without it, emptying the app's storage would hand out fifty more swipes every time.

The document contains, in full:

the date of the current quota day and the number of swipe decisions used on it;
the total bytes freed and the total number of items deleted — the lifetime figure the app shows you, kept so a new phone does not reset it to zero;
the streak count and the date of your last session;
a mirror of the store's answer about your purchase, used only to avoid showing a banner to someone who has paid while the store is still replying on a cold start. It is written by a server function, never by the app, and it can never grant the entitlement — only the store does that;
a reference to the device attestation described in section 5.

What is never in it: no photo identifier, no thumbnail, no hash, no capture date, no month name, no file name, no location, no count of the photos in your library. The local database is the only thing that knows your library, and it does not leave the device.

Firestore security rules allow an identifier to read and write only its own document.

7. Purchases

GigaBack sells one thing, once: a single non-consumable purchase. There is no subscription, no renewal and no trial. If — and only if — you buy it, a transaction occurs. It involves three parties, and we are the least informed of them.

Apple or Google. They take the payment, act as merchant of record and issue your receipt. We never see your payment card, your bank details or your billing address. They process your data under their own privacy policies: Apple and Google.

RevenueCat, Inc. We use RevenueCat to check with the store whether your purchase is valid and whether the entitlement is active. RevenueCat acts as our processor under a data processing agreement. What is processed for this purpose:

a pseudonymous app user identifier generated at random for your installation, which is not linked to your name, your email address or your photos;
the store purchase receipt / transaction token and its status (active, expired, refunded, revoked);
the product bought, the currency, the price, the country of the store account;
basic technical data inherent to any network request: app version, operating system version, device model, and IP address (the IP address is used to transport the request and for anti-fraud, not to profile you).

RevenueCat's privacy policy: revenuecat.com/privacy. No photo, thumbnail, hash or photo metadata is ever sent to RevenueCat.

If you never make a purchase, none of this happens — but the banner in section 8 does.

8. Advertising

The free version of GigaBack shows an advertising banner at the bottom of the screen, on every screen, including while you are swiping. Buying the app removes it, in the same instant the store confirms the purchase, and it does not come back unless the purchase is refunded or revoked.

The banner is served by Google AdMob — operated by Google Ireland Limited for users in the European Economic Area, the United Kingdom and Switzerland, and by Google LLC elsewhere.

What the ad network receives. The data any ad request carries: your device's advertising identifier (the advertising ID on Android; on iOS no App Tracking Transparency permission is requested, so the IDFA is not available to the app or to the ad network), your IP address and the coarse location it implies, the device model, the operating system version, the app version and language, and what happened to the ad (requested, filled, empty, seen, tapped). Google processes it under its own advertising privacy terms.

What the ad network never receives. No photo. No thumbnail. No hash. No photo identifier, file name or capture date. No count of your library, no size estimate, no month you have sorted, nothing at all out of the local database. The only thing the app passes to the ad slot is which screen it is on, and there is no other parameter it could pass — the interface is built that way so it cannot leak by accident.

How the banner behaves. Its height is reserved before any ad is requested, so it never pushes the interface around and never jumps under your thumb. It is kept physically clear of the keep and discard controls, so an accidental tap is not the business model. There are no interstitials and no advertisement laid over one of your photos. There is one other format, described next, and you are the one who starts it. Tapping the banner never opens our own purchase screen: it belongs to the ad network, and it is not a disguised trigger.

The rewarded video. When the fifty free swipes for the day are gone, you can watch a video advertisement through to the end and get ten more. Nothing plays unless you ask for it. The offer appears in two places and nowhere else — the screen that tells you the day's swipes are gone, and one row on the dashboard — and the ten swipes are credited only when the ad network confirms you watched it to the end. Closing it early costs you nothing and gives you nothing. Buying the app removes the offer along with the banner: there is no daily limit left to raise.

The advertising is not personalised. Non-personalised serving is requested on every single ad the app asks for, and configured on the ad network's side as well. No advertising profile of you is built, and iOS therefore shows no App Tracking Transparency prompt — the app does not ask to track you across other companies' apps and websites, and is not built to. Non-personalised advertising still has to reach your device and be counted, so the technical data listed above is still sent.

Where the law requires your consent before information is stored on or read from your device, that consent is collected by Google's own consent form, which the app shows before it requests a single advertisement. You can reopen it at any time: Settings → Ad privacy options.

9. Anonymous usage statistics

To understand whether the app is understandable — where people get stuck, whether a scan finishes, whether an ad slot ever fills — we use Firebase Analytics (Google). We use it rather than a second, separate tool because Firebase is already in the app for section 6, and running two providers for one job would mean more data leaving the device, not less.

The provider is therefore not what protects you here. These rules are:

A fixed list of events, and nothing else. No free-form user properties, and automatic screen collection is off. Anything not on the list below is not sent.
Anonymous. No name, no email address, no account you created. The events are attached to the anonymous identifier in section 5, not to an identity.
Buckets, never exact values. We record a gigabyte bucket such as "5-10", never "8.24 GB". We record a photo-count bucket, never your photo count.
Never any photo content, thumbnail, hash, file name, date or photo identifier. Ever.

The events are, in full: onboarding completed; scan completed (with a photo-count bucket and a gigabyte bucket); session started; free swipe quota reached; paywall shown (with which screen triggered it); purchase made; purchases restored; trash committed (with a megabyte bucket); a month finished; the rating prompt shown; an ad slot filled (with which screen); an ad slot left empty (with which screen). Alongside them, coarse technical context: app version, operating system, language, and country derived from the IP address, which is not stored in a form that identifies you.

You can turn this off. Settings → Share anonymous statistics. One switch, immediate effect, no argument, no consequence for any feature. Turning it off does not remove the banner, which is separate and is covered by section 8. [PLACEHOLDER — the switch ships on, as an opt-out, but the analytics destination in the build is NoAnalytics: nothing is sent at all. Decide before publication — integrate a provider and describe it here, or say plainly that no usage statistics are collected yet and cut this section to match.]

[PLACEHOLDER — no Firebase project is wired: the build ships UnconfiguredProfileService, so nothing described in sections 5 and 6 leaves the device. Decide before publication — configure the project and state its region, its Analytics retention window and whether Google signals are enabled, or cut these sections down to what the build does.]

10. Notifications

Local reminders are opt-in. We ask during onboarding, a refusal costs you nothing, and you can change your mind at any time in Settings or in your system settings.

These notifications are local: they are scheduled and fired by your device, from data that is on your device. There is no push server, no device token sent to us, and no notification content passing through a network. We never send a notification to sell you something.

11. Website

This section is about the website only; the app is covered by sections 3 to 9.

The site at gigaback.app is a set of static pages. It sets no cookie, runs no third-party script, carries no advertising and has no comment system. Our hosting provider keeps standard server logs (IP address, timestamp, page requested, user agent) for a short period, for security and to keep the service running. The site is served from a machine rented from OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France, and operated by the publisher. Its web server logs hold the IP address, the page requested and the user agent for 14 days, and are deleted after that.

The contact form. The contact page carries a form: your name, your email address and your message. They are used to answer you and for nothing else, and the legal basis is our legitimate interest in replying to someone who wrote to us. None of it goes through a third party — the form posts to a script on our own server, which sends the message to our mailbox over an authenticated connection and keeps a copy in a file so that a failed delivery loses nothing. That file holds your IP address too. We keep messages, our answers and that file for up to three years after the last exchange. No cookie, no tracker and no script on that page.

Reading and analysing your photo library on the device — to provide the function you asked for. This is not a transfer of data to us; the processing is local. Access rests on the explicit operating-system permission you grant, and which you can withdraw at any time in your system settings.
Verifying your purchase and your entitlement — to perform the contract, that is, to give you what you paid for. Article 6(1)(b) GDPR.
Anchoring the free quota to an anonymous identifier and a device attestation — our legitimate interest in making a free allowance mean something, Article 6(1)(f). Without it, the daily limit could be reset indefinitely by clearing the app's storage, and the free tier could not exist in the form it does.
Carrying your totals, your streak and your last session across devices — to provide a feature you use, Article 6(1)(b), and our legitimate interest in not losing them, Article 6(1)(f).
Advertising in the free version — where the law requires consent for storing or reading information on your device and for personalised advertising, your consent, Article 6(1)(a), collected through the consent flow the ad network presents; otherwise our legitimate interest in funding a free tier, Article 6(1)(f). On iOS, tracking across apps additionally requires the App Tracking Transparency permission. See the placeholder in section 8.
Anonymous usage statistics — to improve the app. Your consent, Article 6(1)(a), which you can withdraw at any time in Settings.
Local notifications — to send the reminder you asked for. Your consent, Article 6(1)(a).
Answering your emails — our legitimate interest in replying to you, Article 6(1)(f), or performance of the contract.
Anti-fraud on purchases and security logs — our legitimate interest in preventing abuse and keeping the service safe, Article 6(1)(f).

We take no automated decision producing legal effects concerning you. We do not profile you ourselves; whether the advertising you are shown is personalised by the ad network is the subject of section 8.

13. How long data is kept

Photo data: on your device, under your control, for as long as you keep the app. Uninstalling erases it.
The Firebase profile (section 6): for as long as you use the app, and afterwards until you ask us to delete it or 24 months pass without a session, whichever comes first. It deliberately survives uninstalling — that is its purpose — so it is the one thing on this page you may want to ask us to erase.
Purchase data: for the duration of the entitlement and afterwards for the periods required by accounting and tax law, which are typically several years, held by the stores and by RevenueCat.
Advertising data: held by Google under its own retention rules, which we do not set.
Usage statistics: kept for the retention window configured on the Firebase project, in bucketed form, and not tied to you.
Emails you send us: the time needed to handle your request, and up to 3 years afterwards if it concerns a contractual or legal matter.

14. Who your data is shared with

We do not sell your data and we do not rent it. Your photo library is shared with nobody, because it never reaches us in the first place.

We will not, however, tell you that nothing is shared with advertisers. Advertising involves an advertising company: the data listed in section 8 goes to Google AdMob, and that is the price of the free tier.

The recipients are: Apple and Google as the stores; Google again as the provider of Firebase Authentication, Cloud Firestore, Firebase Analytics, AdMob and Play Integrity; Apple again for DeviceCheck; RevenueCat for purchase verification; and our website host. Each acts as our processor or as an independent controller for its own part, under a contract. We may also disclose data if a law or a valid court order compels us to.

15. Transfers outside the EU

Several of these providers — Google LLC and RevenueCat, Inc. in particular — are established in the United States and may process data there. Such transfers are covered by the appropriate safeguards under Chapter V of the GDPR: Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. The region in which the Firebase data in section 6 is stored is named in the placeholder in section 9. You can ask us for details.

16. Your rights

If you are in the EU or the EEA, the GDPR gives you the right to access your data, to have it rectified, to have it erased, to restrict or object to its processing, to portability, and to withdraw your consent at any time without affecting processing already carried out.

Three honest practical remarks:

For everything that lives on your device, you exercise these rights directly and instantly, without asking us: your data is in your hands. Turning off the statistics switch withdraws that consent. Revoking the photo permission cuts off access. Uninstalling erases the local database.
Uninstalling does not erase the profile in section 6, and we are not going to pretend otherwise: it is designed to outlive the app's storage. Write to us and we will delete it, which resets your quota, your totals and your streak along with it.
For purchases we hold a pseudonymous identifier and a receipt status; to find that record we usually need the store transaction identifier from your receipt. To find your Firebase document we need the anonymous identifier your installation uses. Without one of them we may be unable to identify you, and Article 11 of the GDPR allows us to say so rather than collect more data about you just to be able to look you up.

To exercise a right, write to hello@gigaback.app. We reply within one month, extendable by two months for complex requests, in which case we will tell you.

If you believe your rights have not been respected, you may lodge a complaint with your national supervisory authority — in France the CNIL, and each EU/EEA country has an equivalent. We would rather you wrote to us first.

17. Children

GigaBack is not directed at children under 13 and we do not knowingly collect data from them. The app has no social feature and no user-generated content. It does show advertising in its free version, and ad requests are marked as not directed to children so that the ad network applies its restricted treatment. If you believe a child has provided personal data to us, contact us and we will delete it.

18. Security

The app's local database is stored in the app's private storage, protected by your device's isolation and, where the platform provides it, by full-device encryption. All network communication — advertising, the profile in section 6, purchases, statistics — uses TLS. Firestore rules restrict each anonymous identifier to its own document, and the field that mirrors your purchase can only be written by a server function, never by an app pretending to have paid. We keep what we hold small for the simplest possible reason: the fewer things we store, the fewer there are to lose. Keep your device updated and locked with a passcode or biometrics; that is the single most effective protection for your photos.

19. Changes to this policy

If this policy changes, we update the date at the top of the page. For a change that materially affects your rights — a new provider, a new category of data — we will inform you in the app before it takes effect and, where the law requires it, ask for your consent again.

20. Contact

Questions, requests, doubts, or a sentence on this page that reads as vague:

hello@gigaback.app

Postal address: 564 Rua Carvalhal de Cima, 4990-610 Fontão - Ponte de Lima, Portugal.