Gallery Care Privacy Policy

Photos and local storage

Gallery Care analyses photos on your device to suggest items for review. Cleaner does not require an account. You decide what to keep or remove; photos are never automatically deleted.

Gallery analysis and Vault features do not upload readable photo content, thumbnails, filenames, folder names, photo hashes, photo identifiers or photo-level classification results to Gallery Care services. Scan state, settings and gallery caches are stored locally.

Vault originals, previews and catalogue are encrypted at rest on your phone. During import, the app may create a temporary unencrypted copy inside its private, backup-excluded storage so it can prepare and encrypt the photo; it removes that temporary copy after processing and checks for interrupted leftovers on the next process start. This is not a cloud upload or a permanent plaintext photo cache.

Normal Vault access uses local biometric protection. Our account services do not receive usable Vault decryption keys. A registered Vault is not cloud photo backup, key escrow or phone-to-phone photo sync.

Account and Vault registration

Vault uses Google sign-in on Android and Google or Apple sign-in on iOS. Firebase Authentication processes your account user ID and the email address, display name and provider information returned during sign-in. A managed Email/Password route is provided for authorised review accounts; there is no public email registration flow. Do not send us your Google or Apple password.

Our Google Cloud service stores account user ID, Vault ID, an app-generated device-binding ID, Vault name, phone label, account/setup/deletion status and operational timestamps needed to manage ownership. The binding ID is not a hardware identifier. Account actions use an internet connection; ordinary local biometric entry does not require a fresh online ownership or subscription check.

Subscriptions and RevenueCat

Google Play or Apple processes checkout and payment information. RevenueCat supplies the paywall, purchase verification and subscription-management interface. It processes purchase and subscription records, product and transaction identifiers, entitlement status, renewal/expiry information and required app, platform, locale and currency information.

Before sign-in, RevenueCat can use a generated anonymous billing identifier to load offers. Before checkout or Restore, the app identifies the signed-in customer to RevenueCat using their Firebase account user ID. This links subscription records to the Gallery Care account so the subscription can work across that account’s phones.

Gallery Care’s backend keeps an account-scoped subscription-status record and updates it using RevenueCat notifications and provider verification. The app also stores subscription status locally. Gallery Care and RevenueCat do not receive your payment-card details through this integration. Optional RevenueCat diagnostics and automatic device-identifier collection are disabled.

This account-linked billing service is separate from aggregate GA4 app analytics. We do not connect RevenueCat customer identities to GA4. See RevenueCat’s app-data disclosure for its subscription-processing categories.

Aggregate app analytics

Gallery Care uses Google Analytics for Firebase (GA4) to understand, in aggregate, where workflows lose users, whether operations succeed, and how often people return through reminders or open the app themselves.

Analytics includes app/workflow events, bounded success/failure categories, app/device information and a coarse indication of whether a local Vault exists. It does not include Vault photo or album counts. GA4 uses pseudonymous app-installation identifiers that can link events from the same installation; this is not fully anonymous or identifier-free collection.

We do not attach your Gallery Care account ID, RevenueCat customer ID, name, email, photo content, photo identifiers, Vault names or free-form user text to analytics. We do not collect your app preferences for profiling or use analytics to study individual users. The reporting purpose is aggregate funnels, reliability and return rates.

Gallery Care has no in-app advertising. Advertising identifiers, Google signals, ads personalisation and remarketing are disabled. Authentication and billing identities are not joined to GA4 reports.

Crash reporting and other technical data

Firebase Crashlytics collects crash and non-fatal error reports, including stack traces, app/device state and installation/session identifiers, to help diagnose problems. Android abnormal-process-exit reports may also support diagnosis. We do not add your name, email, Firebase account ID, photo content or usable Vault keys as Crashlytics custom fields.

App-owned error reporting sanitises its error/stack inputs. This does not mean the app rewrites every automatically generated native or SDK crash payload. Crash reporting is separate from GA4 and does not require linking analytics to your account.

Google ML Kit performs QR/barcode recognition on-device and separately collects technical diagnostics and usage information. Google lists device/app details, per-installation identifiers, latency, image format/resolution and feature/error events; Android also reports input/output sizes. This SDK flow is separate from the GA4 and Crashlytics controls. See Google’s Android and iOS disclosures.

Firebase, Google Cloud, RevenueCat and our website host process network/service information needed to deliver and secure requests, such as IP addresses, app or user-agent information, request times and status records. Provider sign-in and store payments are also subject to the respective Google or Apple practices. Service providers may process information outside Singapore.

This website and support

This website serves static pages and locally hosted assets without analytics scripts, advertising pixels, third-party fonts or tracking cookies. The web server keeps access/error logs. Links to app stores and other providers take you to their services.

Emailing support shares the information you include with our support mailbox and email provider. A subscription support draft may include billing/device information; review it before sending. Do not include private photos, passwords, sign-in codes or Vault keys.

Why information is used and where it is processed

Account and ownership information lets us provide and secure the Vault service you request. Billing information verifies subscriptions and supports purchases, restoration and account-wide access. Analytics helps us understand aggregate product use; diagnostic information helps us investigate failures. Support information lets us respond to requests. Necessary records may also support legal obligations and the handling of disputes.

Google/Firebase, Google Cloud and RevenueCat process information for their respective roles described above. Google and Apple also operate sign-in and store services under their own terms. Our hosting and email providers support website delivery and correspondence. These providers can process information in Singapore and other countries, including the United States, where privacy laws may differ.

Applicable data-protection law governs the legal basis, safeguards and any consent required for processing or transfers. Contact us for information about the arrangements relevant to your data or to exercise an applicable right. This policy describes processing; it does not replace consent where consent is required.

Retention and deletion

• Local data. Photos, Vault data, scan state, subscription snapshots and settings remain on the phone until removed through the relevant app or device controls. Uninstalling can remove local data without deleting your server account.
• Account records. Registration and account-status records support your account and its Vaults. Retired Vault metadata carries a 31-day expiry, and temporary quota metadata has short-lived expiry timestamps; automated cleanup is asynchronous. Durable registration/deletion safeguards have separate retention and are not swept as active photo data.
• Completed account deletion. The app removes its account/registration data and cached backend billing status through the authenticated deletion flow, retaining an indefinite minimal audit: user ID, deletion status and audit timestamps. That audit does not contain photos, usable keys, email or device/Vault details.
• Store and billing-provider records. Deleting a Gallery Care account does not itself cancel a store subscription or erase purchase history held by Apple, Google Play or RevenueCat. Contact us about Gallery Care billing data: we assess the request and coordinate with our provider where applicable, including any lawful retention requirements. Records that Apple or Google holds for its own store purposes are also subject to that store’s privacy and request processes.
• GA4. We configure user/event retention to 14 months, with reset on new activity disabled. This setting does not limit the lifetime of standard aggregated reports. See Google’s retention explanation.
• Crashlytics and Authentication. Firebase states that Crashlytics begins removing crash traces and associated identifiers from live/backup systems after 90 days. Authentication IP logs are retained for a few weeks; other Authentication data is held until deletion is requested and then removed from live/backup systems within 180 days. See Firebase’s privacy information.
• Operational logs and support. The Production account service’s default Cloud Logging bucket retains logs for 30 days. Website logs rotate daily when non-empty and retain 14 compressed rotations; this is not a guarantee of removal after 14 calendar days. Support emails stay until manually deleted, with no fixed retention period.

Your choices and privacy rights

You choose the folders and photos to review, which originals to remove, and which photos to protect in Vault. Manage photo access and optional notifications in your phone’s settings. Those permission controls do not switch off analytics or technical diagnostics. Functional choices are not used for preference profiling.

Depending on the law that applies to you, you may have rights to access, correct or delete personal information, receive a portable copy, restrict or object to processing, withdraw consent where processing relies on it, or complain to a privacy regulator. Conditions and exceptions may apply. Exercising a right does not waive other rights available under local law.

Email support@deepforestlab.com with your request and enough information to identify the relevant Gallery Care account or interaction. We may ask for information needed to verify the request, and will explain any applicable limits or lawful retention. Never send passwords, sign-in codes or Vault keys.

Use account deletion to remove your Gallery Care account. Email alone does not authorise destructive action. Account deletion does not identify GA4 installation history because we do not link it to your account. We cannot recover local photos using a server-held Vault key because our services do not hold usable keys.

Changes to this policy

We publish revisions here with an updated date. If a change requires additional notice or consent under applicable law, publication of a revised policy alone does not replace that requirement. Contact support@deepforestlab.com with questions about a revision or the handling of your data.