Privacy Policy

1. The short version

Your photos never leave your phone. Not the images, not the thumbnails, not the perceptual hashes computed to find duplicates, not the capture dates, not the file names, not the identifiers your operating system gives them. Every piece of image processing — the scan, the size estimate, the screenshot detection, the duplicate detection, your keep-or-discard decisions — happens on your device, and its results are written to a database that stays there.

That promise is narrow on purpose, because the app does use the network. All of it is named on this page:

Advertising. The free version shows a banner, and offers an optional video you can watch for ten more swipes. Both are served by Google AdMob, which receives the technical data that any advertising request carries. The advertising is not personalised (section 8). Buying GigaBack once removes the banner.
A small profile stored with Firebase. A handful of counters — how many swipe decisions you have used today, how many gigabytes you have freed in total, your streak — are kept under an anonymous identifier so that clearing the app's data does not hand out a fresh daily quota (sections 5 and 6). No photo, no thumbnail, no hash and no date is ever part of it.
Your purchase, which goes through the App Store or Google Play and is verified against the store (section 7).

There is no account to create and no login. We never ask for your name, your email address or your phone number to use the app.

The rest of this page is the detailed version. It is written to be read, not to be skipped.

2. Who is responsible for your data

The controller of the limited personal data described here is WISEPEAR - LABORATÓRIO TECNOLÓGICO, UNIPESSOAL, LDA, a Portuguese single-member private limited company (sociedade unipessoal por quotas) with a share capital of €2,500, registered under NIPC 516410300, whose registered office is at 564 Rua Carvalhal de Cima, 4990-610 Fontão - Ponte de Lima, Portugal, publisher of the GigaBack app.

Contact: contact@gigaback.app

No data protection officer has been appointed: the processing described here falls into none of the cases listed in Article 37 GDPR. The publisher is established in Portugal, inside the European Union, so no representative under Article 27 is required.

3. Your photos stay on your device

GigaBack needs access to your photo library to do its job. That access is used exclusively on the device, through the operating system's own photo APIs (PhotoKit on iOS, MediaStore on Android).

Specifically:

No photo, video, thumbnail or preview is ever uploaded, transmitted, backed up or shared with us or with anyone else.
No photo metadata leaves the device either — not the capture date, not the dimensions, not the file size, not the location data, not the file name, not the identifier the operating system assigns to an asset.
No perceptual hash leaves the device. The fingerprints the app computes to group duplicates and bursts are derived from your images, so we treat them exactly like the images: they are written locally and they stay locally.
The technical data the app computes — the per-photo record, the hash, the "keep" or "discard" status, the month it belongs to — is written to a local database inside the app's private storage. Nothing from that database describing a photo is ever sent anywhere. The only values that go the other way are the plain counters listed in section 6.
The app keeps working without a network. Sorting, the internal trash and the counters never wait for a connection; the profile in section 6 catches up later and the banner in section 8 simply stays empty. It is not an offline-only app, and we will not describe it as one.

We cannot see your photos. We cannot recover them. We do not know how many you have, and we do not know what they show.

Uninstalling the app deletes that local database, and with it your sorting progress. The counters in section 6 are held separately and outlive the uninstall — that is what they are for, and section 16 explains how to have them erased.

4. Deletion goes through your operating system, not through us

When you confirm a batch, GigaBack asks your operating system to delete the items. On Android that deletion is permanent and takes effect at once. On iOS, PhotoKit offers applications no other route: the items go to "Recently Deleted" and stay there for 30 days unless you empty that album yourself. Either way the deletion is carried out by the system, on the device. We are not a party to it, and we receive nothing from it.

5. No account, but an anonymous identifier

GigaBack has no sign-up. There is no user account, no password, no profile to fill in and no email collection to use the app. Your purchase is attached to your Apple or Google store account, not to an identity we hold.

To store the counters in section 6, the app still needs to know which document is yours. Two mechanisms give it that, and neither one tells us who you are:

Firebase Anonymous Authentication (Google). Your installation is issued a random identifier — a UID. It is not linked to your name, your email address, your Apple ID or your Google account, and we cannot resolve it to a person. It does not survive uninstalling the app.
A device attestation. Because that identifier disappears when the app is uninstalled, the free quota is additionally anchored to the device itself. On iOS we use Apple DeviceCheck, which gives us two persistent bits per device and a token our server checks with Apple; on Android we use Google Play Integrity, whose token our server checks with Google. Both tell us only whether this device has been seen before. Neither returns a name, an account or a hardware serial number to us, and the private key used for verification stays on the server — it is never shipped inside the app. Play Integrity is the weaker of the two, and we would rather say so than imply an anchor we do not have.

If you write to us at contact@gigaback.app, we obviously receive your email address and whatever you put in the message. We use it only to answer you, and we keep the exchange only as long as necessary for that (see section 13).

6. What we store with Firebase

One document per anonymous identifier, in Cloud Firestore (Google). It exists for one reason: the free daily quota has to survive someone clearing the app's data, and without it, emptying the app's storage would hand out fifty more swipes every time.

The document contains, in full:

the date of the current quota day and the number of swipe decisions used on it;
the total bytes freed and the total number of items deleted — the lifetime figure the app shows you, kept so a new phone does not reset it to zero;
the streak count and the date of your last session;
a mirror of the store's answer about your purchase, used only to avoid showing a banner to someone who has paid while the store is still replying on a cold start. It is written by a server function, never by the app, and it can never grant the entitlement — only the store does that;
a reference to the device attestation described in section 5.

What is never in it: no photo identifier, no thumbnail, no hash, no capture date, no month name, no file name, no location, no count of the photos in your library. The local database is the only thing that knows your library, and it does not leave the device.

Firestore security rules allow an identifier to read and write only its own document.

7. Purchases

GigaBack sells one thing, once: a single non-consumable purchase. There is no subscription, no renewal and no trial. If — and only if — you buy it, a transaction occurs. It involves three parties, and we are the least informed of them.

Apple or Google. They take the payment, act as merchant of record and issue your receipt. We never see your payment card, your bank details or your billing address. They process your data under their own privacy policies: Apple and Google.

RevenueCat, Inc. We use RevenueCat to check with the store whether your purchase is valid and whether the entitlement is active. RevenueCat acts as our processor under a data processing agreement. What is processed for this purpose:

a pseudonymous app user identifier, which is not linked to your name, your email address or your photos. It is the same anonymous identifier as the one in section 6: we give it to RevenueCat deliberately, so that the store's answer can be matched to your profile and a banner is not shown to someone who has just paid. It does mean RevenueCat and Firebase hold records under one identifier, and we would rather say so than describe two that are separate when they are not;
the store purchase receipt / transaction token and its status (active, expired, refunded, revoked);
the product bought, the currency, the price, the country of the store account;
basic technical data inherent to any network request: app version, operating system version, device model, and IP address (the IP address is used to transport the request and for anti-fraud, not to profile you).

RevenueCat's privacy policy: revenuecat.com/privacy. No photo, thumbnail, hash or photo metadata is ever sent to RevenueCat.

If you never make a purchase, none of this happens — but the banner in section 8 does.

8. Advertising

The free version of GigaBack shows an advertising banner at the bottom of the screen, on every screen, including while you are swiping. Buying the app removes it, in the same instant the store confirms the purchase, and it does not come back unless the purchase is refunded or revoked.

The banner is served by Google AdMob — operated by Google Ireland Limited for users in the European Economic Area, the United Kingdom and Switzerland, and by Google LLC elsewhere.

What the ad network receives. The data any ad request carries: your device's advertising identifier (the advertising ID on Android; on iOS no App Tracking Transparency permission is requested, so the IDFA is not available to the app or to the ad network), your IP address and the coarse location it implies, the device model, the operating system version, the app version and language, and what happened to the ad (requested, filled, empty, seen, tapped). Google processes it under its own advertising privacy terms.

What the ad network never receives. No photo. No thumbnail. No hash. No photo identifier, file name or capture date. No count of your library, no size estimate, no month you have sorted, nothing at all out of the local database. The only thing the app passes to the ad slot is which screen it is on, and there is no other parameter it could pass — the interface is built that way so it cannot leak by accident.

How the banner behaves. Its height is reserved before any ad is requested, so it never pushes the interface around and never jumps under your thumb. It is kept physically clear of the keep and discard controls, so an accidental tap is not the business model. There are no interstitials and no advertisement laid over one of your photos. There is one other format, described next, and you are the one who starts it. Tapping the banner never opens our own purchase screen: it belongs to the ad network, and it is not a disguised trigger.

The rewarded video. When the fifty free swipes for the day are gone, you can watch a video advertisement through to the end and get ten more. Nothing plays unless you ask for it. The offer appears in two places and nowhere else — the screen that tells you the day's swipes are gone, and one row on the dashboard — and the ten swipes are credited only when the ad network confirms you watched it to the end. Closing it early costs you nothing and gives you nothing. Buying the app removes the offer along with the banner: there is no daily limit left to raise.

The advertising is not personalised. Non-personalised serving is requested on every single ad the app asks for, and configured on the ad network's side as well. No advertising profile of you is built, and iOS therefore shows no App Tracking Transparency prompt — the app does not ask to track you across other companies' apps and websites, and is not built to. Non-personalised advertising still has to reach your device and be counted, so the technical data listed above is still sent.

Where the law requires your consent before information is stored on or read from your device, that consent is collected by Google's own consent form, which the app shows before it requests a single advertisement. You can reopen it at any time: Settings → Ad privacy options.

9. We measure nothing

There are no usage statistics. The app carries no analytics tool, sends no events, and keeps no counter of what you do with it. Nothing about your use of GigaBack reaches us.

That was not always true: until 7 September 2026 this section described a fixed list of fourteen bucketed events and a switch in Settings to turn them off. All of it has been removed — the tool, the events, and the switch, which no longer has anything to switch off.

What it costs us, since a privacy notice that only lists advantages is selling rather than informing: we cannot see whether onboarding finishes, whether a scan completes, or how many rewarded videos are abandoned halfway. What the stores report about installs and purchases is all we have, and none of it says what happens in between.

Where what remains is hosted. The database described in section 6 is in Google's europe-west1 region — Belgium, inside the European Union. That was a deliberate choice and it cannot be changed afterwards.

The small API that verifies the device attestation in section 5, and that records your purchase status in section 7, runs on our own server rather than on Google's. It stores nothing of its own: it reads the attestation, writes the result to the database above, and keeps no copy. That server is in France, hosted by OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix — inside the European Union, like the database it writes to. Like any web server it keeps technical logs of the requests it receives: the same short-lived records section 11 describes for the website, kept 14 days and for the same two reasons — security, and knowing the service is working.

For users in the European Economic Area, the United Kingdom and Switzerland, the provider of the Google services named on this page is Google Ireland Limited; elsewhere it is Google LLC.

10. Notifications

Local reminders are opt-in. We ask during onboarding, a refusal costs you nothing, and you can change your mind at any time in Settings or in your system settings.

These notifications are local: they are scheduled and fired by your device, from data that is on your device. There is no push server, no device token sent to us, and no notification content passing through a network. We never send a notification to sell you something.

11. Website

This section is about the website only; the app is covered by sections 3 to 9.

The site at gigaback.app is a set of static pages. It sets no cookie, runs no third-party script, carries no advertising and has no comment system. It stores exactly one thing on your device, and only if you use the light/dark switch: your choice of appearance, kept in your browser's local storage. It never leaves the browser, and a preference you set yourself needs no consent banner — but it is still storage on your device, so it is named here rather than glossed over. Our hosting provider keeps standard server logs (IP address, timestamp, page requested, user agent) for a short period, for security and to keep the service running. The site is served from a machine rented from OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France, and operated by the publisher. Its web server logs hold the IP address, the page requested and the user agent for 14 days, and are deleted after that.

The contact form. The contact page carries a form: your name, your email address and your message. They are used to answer you and for nothing else, and the legal basis is our legitimate interest in replying to someone who wrote to us. The form posts to a script on our own server — no form service, no third-party widget — which then hands the message to our mail provider, OVH, over an authenticated connection so that it reaches our mailbox, and keeps a copy in a file so that a failed delivery loses nothing. That file holds your IP address too, which is there for abuse prevention and nothing else: it is stripped after 12 months. We keep messages and our answers for up to three years after the last exchange. No cookie, no tracker and no script on that page.

Reading and analysing your photo library on the device — to provide the function you asked for. This is not a transfer of data to us; the processing is local. Access rests on the explicit operating-system permission you grant, and which you can withdraw at any time in your system settings.
Verifying your purchase and your entitlement — to perform the contract, that is, to give you what you paid for. Article 6(1)(b) GDPR.
Anchoring the free quota to an anonymous identifier and a device attestation — our legitimate interest in making a free allowance mean something, Article 6(1)(f). Without it, the daily limit could be reset indefinitely by clearing the app's storage, and the free tier could not exist in the form it does.
Carrying your totals, your streak and your last session across devices — to provide a feature you use, Article 6(1)(b), and our legitimate interest in not losing them, Article 6(1)(f).
Advertising in the free version — where the law requires consent for storing or reading information on your device and for personalised advertising, your consent, Article 6(1)(a), collected through the consent flow the ad network presents; otherwise our legitimate interest in funding a free tier, Article 6(1)(f). On iOS, tracking across apps additionally requires the App Tracking Transparency permission.
Local notifications — to send the reminder you asked for. Your consent, Article 6(1)(a).
Answering your emails — our legitimate interest in replying to you, Article 6(1)(f), or performance of the contract.
Anti-fraud on purchases and security logs — our legitimate interest in preventing abuse and keeping the service safe, Article 6(1)(f).

We take no automated decision producing legal effects concerning you. We do not profile you ourselves; whether the advertising you are shown is personalised by the ad network is the subject of section 8.

13. How long data is kept

Photo data: on your device, under your control, for as long as you keep the app. Uninstalling erases it.
The Firebase profile (section 6): for as long as you use the app, and afterwards until you ask us to delete it or 24 months pass without a session, whichever comes first. It deliberately survives uninstalling — that is its purpose — so it is the one thing on this page you may want to ask us to erase. Neither half of that sentence is left to good intentions: Settings → Privacy → Delete my data removes it on the spot, and a job on our own server runs every month and deletes every profile that has gone 24 months without a session.
Purchase data: for the duration of the entitlement and afterwards for the periods required by accounting and tax law, which are typically several years, held by the stores and by RevenueCat.
Advertising data: held by Google under its own retention rules, which we do not set.
Emails you send us: the time needed to handle your request, and up to 3 years afterwards if it concerns a contractual or legal matter.

14. Who your data is shared with

We do not sell your data and we do not rent it. Your photo library is shared with nobody, because it never reaches us in the first place.

We will not, however, tell you that nothing is shared with advertisers. Advertising involves an advertising company: the data listed in section 8 goes to Google AdMob, and that is the price of the free tier.

The recipients are: Apple and Google as the stores; Google again as the provider of Firebase Authentication, Cloud Firestore, AdMob and Play Integrity; Apple again for DeviceCheck; RevenueCat for purchase verification; and OVH, which hosts the website, the small API and the mailbox the contact form writes to. Each acts as our processor or as an independent controller for its own part, under a contract. We may also disclose data if a law or a valid court order compels us to.

15. Transfers outside the EU

Several of these providers — Google LLC and RevenueCat, Inc. in particular — are established in the United States and may process data there. Such transfers are covered by the appropriate safeguards under Chapter V of the GDPR: Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. The region in which the Firebase data in section 6 is stored is named in section 9. You can ask us for details.

16. Your rights

If you are in the EU or the EEA, the GDPR gives you the right to access your data, to have it rectified, to have it erased, to restrict or object to its processing, to portability, and to withdraw your consent at any time without affecting processing already carried out.

Three honest practical remarks:

For everything that lives on your device, you exercise these rights directly and instantly, without asking us: your data is in your hands. Revoking the photo permission cuts off access. Uninstalling erases the local database.
Uninstalling does not erase the profile in section 6, and we are not going to pretend otherwise: it is designed to outlive the app's storage. The app deletes it for you — Settings → Privacy → Delete my data — and you may write to us instead if you would rather. Either way your totals and your streak restart at zero. What does not come back is the day's swipe budget: the memory that spends it belongs to your device's operating system, not to us.
For purchases we hold a pseudonymous identifier and a receipt status; to find that record we usually need the store transaction identifier from your receipt. To find your Firebase document we need the anonymous identifier your installation uses; the app shows it and copies it in one tap, under Settings → Privacy → Your anonymous ID. Without one of them we may be unable to identify you, and Article 11 of the GDPR allows us to say so rather than collect more data about you just to be able to look you up.

To exercise a right, write to contact@gigaback.app. We reply within one month, extendable by two months for complex requests, in which case we will tell you.

If you believe your rights have not been respected, you may lodge a complaint with your national supervisory authority — in France the CNIL, and each EU/EEA country has an equivalent. We would rather you wrote to us first.

17. Children

GigaBack is not directed at children under 13 and we do not knowingly collect data from them. The app has no social feature and no user-generated content. It does show advertising in its free version. GigaBack is built for a general audience: its ad requests are not flagged as directed at children, and we would rather say so plainly than describe a technical measure we do not take. What every request does carry is the instruction to serve non-personalised advertising, which is what stops a profile being built about anybody who uses this app, child or adult. If you believe a child has provided personal data to us, contact us and we will delete it.

18. Security

The app's local database is stored in the app's private storage, protected by your device's isolation and, where the platform provides it, by full-device encryption. All network communication — advertising, the profile in section 6, purchases — uses TLS. Firestore rules restrict each anonymous identifier to its own document, and the field that mirrors your purchase can only be written by a server function, never by an app pretending to have paid. We keep what we hold small for the simplest possible reason: the fewer things we store, the fewer there are to lose. Keep your device updated and locked with a passcode or biometrics; that is the single most effective protection for your photos.

19. Changes to this policy

If this policy changes, we update the date at the top of the page. For a change that materially affects your rights — a new provider, a new category of data — we will inform you in the app before it takes effect and, where the law requires it, ask for your consent again.

20. Contact

Questions, requests, doubts, or a sentence on this page that reads as vague:

contact@gigaback.app

Postal address: 564 Rua Carvalhal de Cima, 4990-610 Fontão - Ponte de Lima, Portugal.