Last updated: 21 July 2026 (rev. on-device metadata & referral status check)

Privacy Policy

Short version: Picstreak is an on-device app. Your photos never leave your iPhone. We do not run a server that stores your photos, do not require an account, and do not ask for your name, email, or login. The data that reaches a server is limited to what purchases and crash diagnostics need — purchase status via Apple and RevenueCat, and anonymous crash reports via Sentry — plus, only if you opt in by sharing or redeeming an invite, the minimal referral data described in §3-bis. Separately, this website (picstreak.app) uses Google Analytics to measure visits — but only if you accept the cookie banner; decline and no analytics cookies are set. That is a website measurement tool and is unrelated to the app, your photos, or advertising (see §4-ter). This page explains exactly what we do receive and your rights under GDPR, CCPA, and other applicable law.

1. Who we are

The data controller responsible for this Privacy Policy is:

• Natalia Skoblik (sole trader / autónoma)
• NIF: Z2120827W
• Carrer de Vicente Raga, 1, Camins al Grau, 46023 València, Spain
• Email: privacy@picstreak.app

"Picstreak", "we", "us", or "our" refers to the above. "You" means the person using the Picstreak iOS app or visiting picstreak.app.

2. Plain-English summary

• No account. Picstreak has no sign-up, no login, no email field.
• Your photos stay on your device. Picstreak reads and manages your Photos library through Apple's PhotoKit. As a photo-cleaning app it can delete the photos you choose (through your device's own Recently Deleted) and, when you clean a burst (a rapid-fire sequence the camera captures as one group), extract the frames you keep into new standalone photos — each preserving that frame's original date and location — while moving the rest of the burst to Trash. These are on-device library changes made with your Photos permission; nothing about them, and no photo file or thumbnail, is ever sent anywhere. It never uploads, copies, or transmits your photo files or thumbnails to us or to anyone. The one narrow exception is location metadata: when a photo you are reviewing carries coordinates, those coordinates (never the photo itself) are sent to Apple's geocoding service to show a place name, as described in the next bullet and §4 — and never to a Picstreak server.
• No facial recognition. Location is used only to name a place and to group similar photos on your device. We do not run facial recognition or build a profile of you. Picstreak never asks iOS for your live location and does not use CLLocationManager; it reads only the coordinates the camera already saved into a photo. Those coordinates are used in two ways. First, when a photo you are reviewing has location metadata, Picstreak passes the coordinates to Apple's geocoding service (CLGeocoder) so it can show a place name — for example the city — on the card. That lookup is handled by Apple under Apple's Privacy Policy; we never receive or store your coordinates, they are not written to iCloud and never reach a Picstreak server, the place name is held briefly in memory and then discarded, and a photo with no location metadata triggers no lookup at all. Second, when Picstreak groups near-identical shots into a series so you can review them together, it compares the coordinates of neighbouring photos on your device and splits the group where the distance between them is too large — so shots taken in different places are not merged into one series. That comparison is arithmetic performed entirely on your device; nothing is sent anywhere. Apple's geocoding lookup remains the only case in which coordinates leave your device, and they never reach a Picstreak server. Separately, once on first use, the app may read the author fields of EXIF/IPTC metadata (Artist, By-line, Camera Owner Name) from up to 30 of your most recent photos to optionally pre-fill the display-name field in Settings. Those author fields never leave your device; only the derived name string is stored on your device (and, for Pro subscribers, in iCloud Key-Value Storage — see §3). Picstreak also reads the camera-model fields of EXIF metadata (TIFF Make and Model — for example "Apple iPhone 15 Pro") from the photos it considers for a duplicate group, so that images taken on a different device — a picture a friend sent you, for example — are not merged into a series with your own shots. The result is kept in a small cache file on your device; it never leaves the device. See §3.
• iCloud Key-Value Storage (Pro only). For Pro subscribers, your streak, settings, trash, and leftover snapshots are restored after a reinstall on the same Apple ID. The free tier does not use iCloud sync. Details in §3.
• Three external services touch limited data: Apple (App Store purchase receipt), RevenueCat (purchase status under an anonymous ID), and Sentry (crash and performance reports). Details in §4.
• Optional referral programme. If you share or redeem a Picstreak invite link, both parties receive 7 days of Promo access (a free, time-limited grant — not a subscription and not the Pro product; see Terms §5-bis). A small amount of opt-in data (a salted device-identifier hash, an EC P-256 device public key, a salted short-lived IP hash, an anonymous RevenueCat ID, timestamps, and a one-way anti-fraud device hash we keep indefinitely to enforce one redemption per device) is processed by a Picstreak-operated server. The same applies if you redeem a promotional campaign code we publish. Once you have taken part, the app also asks that server on every launch for the current expiry date of your Promo access — that is the only way a reward reaches you when someone redeems your invite. If you never use the feature, no data ever reaches that server. Details in §3-bis.
• In-app support is user-initiated. If you tap "Help & feedback" inside the app, iOS opens a pre-filled email to support@picstreak.app. You decide whether to send it, and what to keep — including a diagnostics summary and an attached app-log file. Details in §4-bis.
• No advertising. No cross-app tracking. We don't sell your data and we don't share it for ads. The app ships no analytics or advertising SDK. This website uses Google Analytics for visit statistics only, and only after you accept the cookie banner — it sets no advertising cookies and is not used for ad targeting (see §4-ter).

3. Data stored on your device

Picstreak stores the following on your iPhone using Apple's SwiftData and UserDefaults, protected by iOS file-level encryption:

• Swipe decisions (which photos you marked keep or delete).
• Streak state (current streak, longest streak, daily activity).
• Trash queue (photos pending deletion until you confirm).
• App preferences (settings, onboarding state).
• Camera-model cache — a file (camera-info-cache.json, in the app's Application Support directory) that records, for each photo Picstreak has considered for a duplicate group, the camera model read from its EXIF metadata (for example "Apple iPhone 15 Pro"), or a note that the image carries no camera information at all (a saved or downloaded picture). When the metadata cannot be read, nothing is written to the cache. It exists so that photos taken on a different device are not merged into a series with your own, and it is kept rather than recomputed each time to avoid re-reading metadata on every launch. The cache holds photo identifiers and camera-model strings only — no photo content, no coordinates, no author fields. It stays in the app's own storage on your device, is never sent to us or to anyone else, and is not written to iCloud Key-Value Storage.

This data never leaves your device unless your iCloud backup is enabled, in which case Apple may include it in your encrypted backup. We do not have access to your iCloud backup.

Uninstalling the app removes all of this data.

iCloud Key-Value Storage (reinstall recovery — Pro only)

iCloud Key-Value Storage sync is a Pro feature. On the free tier nothing is written to or read from iCloud, and a reinstall starts from a clean slate. For Pro subscribers, Picstreak uses Apple's iCloud Key-Value Storage (NSUbiquitousKeyValueStore) to preserve a small slice of state across reinstalls of the app on the same device under the same Apple ID. This is not cross-device sync: we do not maintain a server-side copy of your data, and we do not push your library between devices. The store is provided by Apple, tied to your Apple ID, and accessible only to Picstreak on your devices.

For Pro subscribers, the following items are written to iCloud KVS:

• Streak statistics and the last 28 days of daily activity; app settings (daily goal, display name, theme, language, swipe direction, video sound).
• A trash snapshot (deleted-photo identifiers, deletion date, file size, media type); a leftover-photos snapshot (identifiers and decision date).

No photo content, raw EXIF, or location data is written to iCloud KVS — only photo identifiers, your display name, and small settings. Pro subscribers can disable iCloud sync for Picstreak in the app's settings; doing so prevents further writes and reads from the KVS store.

3-bis. Referral programme

If you choose to share a Picstreak invite link, redeem one you received, or redeem a promotional code we publish as part of a campaign (see Terms §5-bis), a small amount of data is processed by a Picstreak-operated server (the "Referral Service"). Campaign codes are redeemed through the same endpoint and involve exactly the same data described below — the only difference is that no other user stands behind the code. Once you have taken part, the app also checks in with that server automatically on later launches to keep your Promo access up to date — see "Automatic status check" below. The Referral Service is the only Picstreak-operated server that processes any data about you; outside of this opt-in flow, no Picstreak-operated server processes data about you.

Clipboard (one-time, on-device)

When you first reach the invite screen during onboarding, Picstreak checks your clipboard once to see whether you have copied a Picstreak invite code (an 8-character string matching the pattern [A-Z0-9]{8}). iOS may show a system paste notification when this happens. If a matching code is found it is saved locally on your device so you can redeem it with one tap; no other clipboard content is read or retained, and nothing from your clipboard is sent to the Referral Service unless you explicitly tap "Redeem".

Automatic status check (after you participate)

Once your device has taken part in the referral programme — you created an invite code, or you redeemed one — Picstreak asks the Referral Service for the current expiry date of your Promo access each time the app starts. This happens quietly, without any action from you. It is how a reward reaches the person who sent an invite: that person does nothing at the moment their friend redeems, so without this check the app would never learn that their Promo access had been extended.

The check sends the same data as any other referral request — the signed request from your device (its salted device-identifier hash, key identifier, and anonymous RevenueCat ID) — and receives back only the current expiry date of your Promo access together with the number of people who have redeemed your invite (the counter shown on the invite screen). No new categories of data are collected, and nothing about your photos, library, or app usage is included. The check runs only on devices that have already participated: if you have never shared or redeemed an invite, the app makes no request to the Referral Service at all. If the device is offline or the request fails, it is skipped silently and the app keeps using the expiry date it already stored locally.

What we receive

• Referral code — an opaque short string generated by the app. It does not encode anything about you.
• Salted hash of the device identifier — a one-way SHA-256 hash of Apple's identifierForVendor (IDFV) combined with a server-side secret salt. The IDFV is a per-vendor device identifier provided by iOS that resets when all of a vendor's apps are uninstalled from the device. We never receive the raw IDFV, only the salted hash. It authenticates your device's requests and is part of the redemption record (deleted with that record — see Retention).
• Anti-fraud device hash (retained indefinitely) — to enforce the rule of one referral redemption per device, we store a single one-way hash derived from your IDFV combined with a fixed value built into the app and a server-side secret salt. It contains no name, email, Apple ID, or contact information and is not linked to any other record. This is the one piece of data we keep even after you delete everything else: without it, deleting your data and redeeming again would defeat the one-per-device limit. We retain it indefinitely and do not delete it on request. A full app uninstall resets the underlying IDFV, so a later reinstall is treated as a new device and could redeem again — but the earlier hash is not deleted from our records. See "Your rights" and "Retention" below.
• Device public key — an EC P-256 public key (in JWK form) generated on your device the first time you use the referral feature, together with a key identifier ("kid"). The matching private key never leaves your device. The public key is used to verify that requests to the Referral Service genuinely originate from your device (we verify the JWT each request signs); it is not used to identify you outside the referral flow and is not linked to your Apple ID, name, or email.
• RevenueCat anonymous app user ID (described in §4) — used solely to grant the 7-day Promo access entitlement once redemption succeeds.
• Salted hash of your IP address (short-lived) — when you call the Referral Service, we compute a one-way SHA-256 hash of your IP address combined with a server-side secret salt and store the hash in a rate-limiting table to throttle abusive request patterns. The raw IP is not persisted. The hashed entry is automatically deleted within approximately 24 hours of its creation.
• Timestamps — code creation, redemption, and rate-limit window times.
• Redemption attempts that do not complete — a redemption is recorded the moment you tap "Redeem", before the reward is granted, so that the same code cannot be redeemed twice at once. If the attempt then fails — the network drops, the code turns out to be expired, the grant does not go through — the record stays behind marked as failed. It holds the same data as a successful redemption (the salted device hash, the anonymous RevenueCat ID, the code, and timestamps) and nothing about why the attempt failed. Failed records are deleted 365 days after the attempt.

What we do not receive

The Referral Service does not receive your name, email address, Apple ID, phone number, raw device identifier (we receive only the salted hash), raw IP address (we receive only a short-lived salted hash), private key material, photos, photo metadata, location, contacts, or any data about how you use the app outside of the referral flow itself. Beyond the rate-limit hash described above, we do not retain Vercel edge request logs containing your IP address beyond 72 hours; after that window, request logs are deleted by Vercel.

Legal basis (GDPR Art. 6)

Processing the referral code, the salted device hash, the device public key, the RevenueCat app user ID, and the related timestamps is necessary for the performance of a contract you initiate by sharing or redeeming an invite — Art. 6(1)(b). The 7-day Promo access grant is the consideration; we cannot deliver it without verifying that the request comes from your device and that you have not already redeemed. The same basis covers the automatic status check described above: it is the only channel through which the Promo access you earn when someone redeems your invite can reach your device. Processing the salted, short-lived hash of your IP address for rate-limiting rests on our legitimate interest in preventing abuse and protecting the Referral Service — Art. 6(1)(f). The interest is narrow (throttling) and the data is short-lived (~24 hours) and not linked to any identifier we can use to contact you. The indefinitely-retained anti-fraud device hash likewise rests on our legitimate interest in fraud prevention — Art. 6(1)(f) and Recital 47, which names fraud prevention as a legitimate interest. We keep it after a deletion request under the erasure exception in Art. 17(1)(c)/(3): it is the minimum data needed (a single one-way hash, no contact identifier) to enforce the one-redemption-per-device limit, and that interest overrides erasure for this one value. We treat this hash as pseudonymous (Art. 4(5)) rather than anonymous — because we hold the salt it is not irreversibly anonymous — but it is never linked to your name, email, Apple ID, or any contact identifier.

Retention

• Unused referral codes: deleted 365 days after creation.
• Redeemed referral records (including the salted device-hash and timestamps): deleted 365 days after the redemption they record. An invite code can be redeemed by several people, so the record of the code itself — which carries the salted device-hash and anonymous RevenueCat ID of the person who created it — is erased 365 days after the last redemption made through it.
• Device public keys (the EC P-256 JWK and its kid): erased immediately when you delete your data in the app (Settings → Delete all data), which wipes this device, your iCloud sync data, and your codes, redemptions, and device key from the Referral Service together. Any key that is no longer referenced by a code or redemption is also swept automatically within 90 days.
• Redemption attempts that failed: deleted 365 days after the attempt.
• Rate-limit IP-hashes: deleted automatically within approximately 24 hours of creation by the rate-limit window expiry.
• Anti-fraud device hash: retained indefinitely (the single exception above) and not erased by a deletion request — it exists only to enforce one redemption per device. A full app uninstall resets the underlying device identifier (a reinstall then counts as a new device), but the stored hash itself is never deleted.
• Apart from that one anti-fraud hash, after deletion no further trace of your participation remains on the Referral Service.

Subprocessors

The Referral Service runs on Vercel (serverless functions, US/EU edge regions) and stores data in Vercel Postgres (operated by Neon, EU region — eu-central-1 / Frankfurt). Both are configured as data processors under written agreements; you can request a copy of the safeguards by emailing privacy@picstreak.app.

Russian Federation (ФЗ-152)

Все идентификаторы, которые Picstreak Referral Service сохраняет в собственной базе данных (хеш идентификатора устройства, бессрочный анти-фрод-хеш устройства, хеш IP-адреса для rate-limit), вычисляются как одностороннее SHA-256 от исходного значения и серверной "соли", которая хранится отдельно как секрет и не может быть восстановлена из базы. Публичный ключ устройства (EC P-256), используемый для проверки JWT-подписи запросов, не содержит сведений, позволяющих идентифицировать субъекта персональных данных без обращения к самому устройству. На этом основании мы рассматриваем перечисленные данные как обезличенные в значении ст. 3 ФЗ-152. Если вы являетесь резидентом Российской Федерации и не согласны с этой квалификацией, не используйте функцию рефералов; альтернативно вы можете запросить удаление вашей записи по адресу privacy@picstreak.app. Исключение — анти-фрод-хеш устройства: он хранится бессрочно исключительно для предотвращения повторной активации промокода и не удаляется по запросу (в отличие от остальных записей). Полная переустановка приложения сбрасывает идентификатор устройства для будущих установок, но не удаляет уже сохранённый хеш.

Your rights and how to opt out

Using the referral feature is optional — if you don't share or redeem an invite, and don't redeem a campaign code, no data ever reaches the Referral Service. If you have participated, you can erase your referral data at any time directly in the app: Settings → Delete all data. This wipes everything on your device and your iCloud sync data, and removes your invite codes, redemptions, and device public key from the Referral Service; the request is authenticated by your device, so no account or manual identification is needed. You are then returned to the start of onboarding. You can also email privacy@picstreak.app and we will delete your record within one month (GDPR Art. 12(3)). The one exception is the anti-fraud device hash described above, which we retain indefinitely to enforce the one-redemption-per-device limit and do not delete on request — a full app uninstall only resets your device identity for future installs, it does not delete the stored hash; everything else is deleted. Deleting your data also clears the referral state held on your device, so the automatic status check described above stops as well: from that point the app makes no further requests to the Referral Service unless you choose to share or redeem an invite again. Deleting the app has the same effect.

4. Data processed by third parties

This section covers third-party services that process data on our behalf. The Picstreak-operated Referral Service is described separately in §3-bis (it is first-party, opt-in, and the only Picstreak-operated server). Picstreak relies on three external services in addition; each has its own privacy practices:

Apple — App Store & StoreKit

When you start a subscription (Picstreak Pro Monthly or Yearly) or buy the one-time Picstreak Lifetime purchase, Apple processes payment through the App Store and manages renewals where applicable. We receive a purchase receipt from StoreKit to unlock paid features. We do not receive your name, billing address, or card details.

Place-name lookup. When a photo you are reviewing carries location metadata, the app uses Apple's geocoding service (CLGeocoder) to turn those coordinates into a place name shown on the card. The request goes to Apple and is governed by Apple's Privacy Policy. We do not receive, store, or transmit the coordinates or the place name ourselves, and nothing about your location reaches a Picstreak server (see also §2).

See Apple's Privacy Policy.

RevenueCat — purchase management

We use RevenueCat to verify your purchase status and manage entitlements across re-installs. RevenueCat assigns an anonymous app user ID generated on your device. It is not linked to your name, email, Apple ID, or any other identifier we hold. RevenueCat receives the purchase receipt from Apple and basic device/OS data needed to validate purchases.

Purchase history is processed solely to determine your subscription tier (Free or Pro). It is not linked to your real-world identity and is not used for tracking, profiling, or advertising.

See RevenueCat's Privacy Policy.

Sentry — crash & performance reports

We use Sentry as a data processor to capture anonymous crash, performance, and diagnostic data so we can fix bugs and improve stability. Reports may include: device model, iOS version, app version, a stack trace, a non-identifying installation identifier, your IP address (used by Sentry to identify network errors and discarded after processing), and "breadcrumbs" / transaction spans (a short trail of in-app technical events such as screens visited, API calls, and errors, with no photo content or personal identifiers). Sentry is configured as a diagnostic tool, not as an advertising or analytics product, and the data is not linked to your real-world identity and is not used for tracking.

See Sentry's Privacy Policy and Data Processing Addendum.

What we do not use

The Picstreak iOS app does not use Google Analytics, Meta Pixel, Firebase, advertising SDKs, attribution SDKs, or any cross-app tracking technology. We do not run an AI/ML backend; classification (if any) happens on-device. (This website, picstreak.app, uses Google Analytics for visit statistics on a consent basis — that is a separate, opt-in website tool described in §4-ter, and it never touches the app or your photos.)

4-bis. In-app support requests

The app has a Profile → "Help & feedback" option. Tapping it opens your device's standard mail composer (Apple's MFMailComposeViewController) with a message addressed to support@picstreak.app, pre-filled with the diagnostics described below. Nothing is sent automatically. You choose whether to send the email; you can edit the body, remove the attachment, or cancel entirely before sending. There is no background collection or silent transmission — the data only reaches us if you tap Send in your own mail app.

What the email is pre-filled with

To help us diagnose your issue, the draft includes:

• In the message body — the app version and build, your iOS version, your device model (the hardware identifier, e.g. iPhone17,2), your language/locale (e.g. ru_RU), your access status (Free / Pro / Promo), your current streak count, and your RevenueCat anonymous app user ID (the same identifier described in §4 and §3-bis — pseudonymous in GDPR terms, since we can link it to your purchase and referral records but not to your real-world identity). We use that ID to correlate your request with your purchase and any referral records; it is not linked to your name, email, or Apple ID.
• As an attachment — a picstreak-logs.txt file containing the app's technical logs (Apple OSLog) for the current session. These logs record operational events and may include your album names (text you have typed) and opaque internal photo identifiers (localIdentifier strings, which reference photos in your own library but do not contain the photos themselves). The logs do not contain passwords, tokens, keys, the device identifier for vendors (IDFV), or location data. You can delete this attachment in the mail composer before sending.

How we use it and who receives it

Recipient: the diagnostics you send reach support@picstreak.app, a mailbox operated by the controller named in §1. We use this data solely to handle and respond to your support request — we do not use it for tracking, profiling, or advertising, and we do not share it with third parties beyond our email provider acting as a processor. Because you compose and send the email yourself through your own mail account, the transmission is initiated by you. We retain support correspondence only as long as needed to resolve your request and any follow-up, then delete it.

4-ter. Website analytics (picstreak.app)

This section is about the website at picstreak.app — not the iOS app. The app ships no analytics SDK (see §4). On the website we use Google Analytics 4 (provided by Google Ireland Limited) to understand, in aggregate, how many people visit, which pages they read, and roughly where visits come from, so we can improve the site.

Consent first — nothing runs until you accept

Google Analytics is off by default for every visitor. When you first arrive, a banner asks whether you accept analytics cookies. Until you tap Accept, the Google Analytics script is not loaded at all: no cookie is written, no identifier is created, and no request — not even a cookieless one — is sent to Google. If you tap Decline, analytics stays off and we remember that choice so you are not asked again. This is your legal basis under GDPR Art. 6(1)(a) (consent), and it is the only processing on this site that relies on consent. You can change your mind at any time (see "How to withdraw" below).

What Google Analytics receives if you accept

• Two first-party cookies (_ga and _ga_<id>) holding a randomly generated, pseudonymous client identifier, so returning visits in the same browser can be recognised. They are set on the picstreak.app domain and expire after up to two years.
• Usage data: pages viewed, time on page, referring URL, approximate (city-level) location derived from your IP address, and technical details such as device type, browser, operating system, and screen size.
• IP address handling. Google Analytics 4 uses your IP address only transiently to derive coarse location and then does not log or store it. We do not receive your IP address through Analytics.

What it is not used for

We run Analytics in an analytics-only configuration: Google Signals and ad-personalisation signals are disabled, no advertising cookies are set, and the data is not used for advertising, ad targeting, or building a cross-site profile of you. We do not sell this data and do not combine it with the app data described elsewhere in this policy. The pseudonymous analytics identifier is not linked to your name, email, Apple ID, the RevenueCat ID, or any referral record.

Google as processor, and international transfer

Google acts as our data processor for Analytics under Google's Ads Data Processing Terms. Data may be transferred to Google LLC in the United States; Google relies on the European Commission's Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework for those transfers. See Google's Privacy Policy and how Google Analytics safeguards data.

Retention

We set the Google Analytics data-retention control to its shortest option — 2 months — for user- and event-level data; Google deletes that data automatically after the window. Aggregated, non-identifying reports may persist longer within Google Analytics. The _ga cookies stored in your browser expire after up to two years, or immediately when you clear them (see below).

How to withdraw or opt out

• Decline the banner — analytics never starts.
• Change your mind after accepting — clear this site's cookies and site data for picstreak.app in your browser settings; the banner will reappear on your next visit so you can choose again. (Clearing the stored choice re-shows the banner; declining then stops analytics.)
• Browser-wide opt-out — install Google's Analytics Opt-out Add-on, or use your browser's tracking-protection / cookie controls.

Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew (GDPR Art. 7(3)).

5. Legal basis (GDPR)

For users in the European Economic Area, UK, and Switzerland, we process the limited data described above under the following legal bases (Article 6 GDPR):

• Performance of a contract (Art. 6(1)(b)) — to deliver the app, your purchases, and your participation in the referral programme (Apple, RevenueCat, Referral Service).
• Legitimate interests (Art. 6(1)(f), and Recital 47 for fraud prevention) — to diagnose crashes and improve stability (Sentry); to throttle abusive request patterns to the Referral Service via a salted, short-lived hash of your IP address; and to prevent referral fraud by retaining a one-way anti-fraud device hash that enforces one redemption per device (both described in §3-bis). Our interest is keeping the app working, preventing abuse, and keeping the Referral Service available; this data is technical and is not linked to any identifier we can use to contact you.
• Legitimate interests (Art. 6(1)(f)) — to handle and respond to a support request you initiate from the app, using the diagnostics you choose to send (see §4-bis). Our interest is resolving the issue you reported; you control what is sent.
• Consent (Art. 6(1)(a)) — to run Google Analytics on the picstreak.app website, only after you accept the cookie banner (see §4-ter). You can withdraw at any time.
• Legal obligation (Art. 6(1)(c)) — to retain purchase records as required by Spanish tax law.

You can object to processing based on legitimate interests at any time, and withdraw analytics consent at any time (see §8 and §4-ter).

6. Retention

• On-device data: kept until you delete it or uninstall the app.
• iCloud Key-Value Storage entries (Pro): stored by Apple under your Apple ID. They persist across reinstalls of the app on the same Apple ID. They are cleared when you disable iCloud sync for Picstreak in the app, sign out of iCloud, remove the app's iCloud data from iOS Settings, or when Apple reclaims the quota under its own retention rules. Uninstalling the app alone does not delete them.
• RevenueCat purchase records: retained for as long as you may exercise rights related to the purchase, plus the legal accounting period required under Spanish law (currently 6 years).
• Sentry crash & performance reports: retained for up to 90 days, then deleted by Sentry per its default retention policy.
• Google Analytics (website): user- and event-level data retained 2 months, then deleted automatically by Google; the _ga browser cookies expire after up to two years or when you clear them (see §4-ter). Only set if you accept the cookie banner.
• Referral records (including the Promo access grant record): unused codes deleted 365 days after creation; redeemed records (including the salted device-hash and timestamps) deleted 365 days after the redemption they record, and the record of a code itself 365 days after the last redemption made through it; device public keys erased when you delete your data in the app (Settings → Delete all data) and otherwise swept automatically within 90 days once no code or redemption references them; redemption attempts that failed deleted 365 days after the attempt; rate-limit IP-hashes deleted automatically within ~24 hours. The single anti-fraud device hash (one-way, no contact identifier) is retained indefinitely to enforce one redemption per device and is not erased by a deletion request; a full app uninstall resets the device identifier for future installs but does not delete the stored hash (see §3-bis).

7. International transfers

RevenueCat and Sentry are U.S.-based providers; Google (Analytics, website only, if you accept the cookie banner) may transfer data to the U.S. as well. When data is transferred outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and the EU–U.S. Data Privacy Framework where applicable. You can request a copy of the safeguards by emailing privacy@picstreak.app.

8. Your rights

Under GDPR (and equivalent laws), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure ("right to be forgotten").
• Restrict or object to processing.
• Data portability where applicable.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with a supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD).

Because we do not collect direct identifiers, in practice the data we can match to you is limited to (a) the anonymous RevenueCat ID tied to your purchase and (b) crash reports linked to a non-identifying installation ID.

How to exercise your rights. Email privacy@picstreak.app and include either:

• your Apple original transaction ID from your App Store purchase receipt (Apple ID → Purchase History → Picstreak → View Receipt), or
• your RevenueCat App User ID from the app's About / Settings screen.

Either identifier lets us locate the relevant records without you sharing your Apple email. We respond within one month of receiving a verifiable request (GDPR Art. 12(3)), free of charge in normal circumstances (Art. 12(5)). We have not appointed a Data Protection Officer: our processing does not meet the thresholds in GDPR Art. 37 (no large-scale systematic monitoring, no large-scale special-category data). For all data protection matters, contact the controller directly at the address above.

9. California residents (CCPA / CPRA)

This section is the "Notice at Collection" required under the California Consumer Privacy Act, as amended by the CPRA.

Categories of personal information we collect

• Identifiers: the anonymous RevenueCat App User ID, the non-identifying Sentry installation ID, and (if you participate in the referral programme) a salted SHA-256 hash of Apple's identifierForVendor, an EC P-256 device public key (JWK plus kid) used to verify request signatures, a salted SHA-256 hash of your IP address retained for approximately 24 hours for rate-limiting, and a one-way anti-fraud device hash retained indefinitely to enforce one redemption per device (see §3-bis). For Pro subscribers, Apple PhotoKit local identifiers (per-device opaque strings that refer to photos in your own Photos library on your own Apple ID) are written to iCloud Key-Value Storage as part of the trash and leftover-photo snapshots described in §3; these identifiers do not identify you to us and we never resolve them to photo content. On the picstreak.app website only, and only if you accept the cookie banner, a random Google Analytics cookie identifier (see §4-ter). We do not collect your name, email, phone number, government ID, raw device identifier, raw IP address, or any private key material.
• Commercial information: your Picstreak Pro purchase status and the Apple-issued purchase receipt.
• Internet or other electronic network activity: technical diagnostics in crash and performance reports (stack traces, in-app event breadcrumbs, IP address used by Sentry to identify network errors and then discarded); if you initiate an in-app support request (§4-bis), the diagnostics summary and app-log file you choose to send, which may include your album names and opaque internal photo identifiers; and, on the picstreak.app website only and only if you accept the cookie banner, pseudonymous Google Analytics usage data (pages viewed, referrer, approximate city-level location, device/browser type) tied to a random analytics cookie ID — see §4-ter.
• Geolocation: we do not collect, store, retain, or sell your location. When a photo you are reviewing contains location metadata, the app sends those coordinates to Apple's geocoding service to display a place name on the card (see §4). Apple processes that request; we never receive or keep the coordinates, and we hold no location record about you.
• Sensitive personal information (as defined in Cal. Civ. Code §1798.140(ae)): not collected.

Sources, purposes, recipients, retention

• Sources: directly from your device.
• Business purposes: providing and securing the app, validating purchases, diagnosing crashes, complying with legal and tax obligations.
• Recipients: Apple (purchase processing), RevenueCat (entitlement management), Sentry (diagnostic processing), and — for the website only, if you accept the cookie banner — Google (Analytics). Each acts as a service provider / data processor under written contract; none are authorised to use the data for their own commercial purposes.
• Retention: see §6.

Sale, sharing, and behavioral advertising

We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we have not done so in the preceding twelve months. We do not use personal information for cross-context behavioral advertising, profiling that produces legal or similarly significant effects, or automated decision-making. Google Analytics on the website is configured as a service provider under Google's Ads Data Processing Terms, with Google Signals and ad-personalisation disabled; it is used only for our own analytics and not for cross-context behavioral advertising, so it does not constitute a "sale" or "share" (see §4-ter).

Your California rights

You have the right to: know the categories and specific pieces of personal information we hold about you; request deletion; request correction of inaccurate information; opt out of any future sale or sharing; and limit the use of sensitive personal information (not applicable here, since we don't collect any).

To exercise these rights, email privacy@picstreak.app using the verification process described in §8. You may also designate an authorised agent in writing. We will not discriminate against you for exercising any of these rights.

10. Children

Picstreak is rated 4+ in the App Store as a general-audience utility. It is not directed at children, does not collect a name, email, or any account information, and does not contain in-app messaging, social features, or behavioural advertising. We do not knowingly collect personal information from a child. If you are a parent or guardian and believe a child has provided personal information through the app, contact privacy@picstreak.app and we will delete it. Apple Media Services Terms and your device's parental controls also apply.

11. Security

On-device data is protected by iOS file-level encryption tied to your device passcode/Face ID/Touch ID. Network traffic to RevenueCat, Sentry, and Apple uses TLS. No system is perfectly secure; we cannot guarantee absolute security but we use industry-standard safeguards.

12. Changes

If we update this policy, we'll change the "Last updated" date at the top. Material changes will also be announced in the app on next launch. Continued use of Picstreak after a change means you accept the updated policy.

13. Contact