Privacy Policy

1. Introduction

Picmori is a mobile application for iOS and Android that helps you review and clean up your photo and video library (the "App"). The App is operated by Aleksandrs Vozņarskis, an individual developer based in the Republic of Latvia, European Union ("we", "us", "Operator"). We are the data controller for the processing described in this policy.

This policy explains what information the App processes, what stays on your device, what is sent to third-party services, why, and how you can control it. It describes Picmori 4.0 and later. Earlier versions (3.9 and below) used additional services; they are described in Section 11. You can see your version in your device's app store or app settings.

2. What Stays on Your Device

2.1 Access to Your Photo Library

The App asks for permission to access your photos and videos, because reviewing and cleaning them is its purpose. If you give access to selected items only, the App works with those items. From your library the App reads:

• Media information: file size, dimensions, file type, video duration, capture and modification dates (including the capture date stored in the photo's EXIF data), favourite status, and whether an item is a screenshot, Live Photo or part of a burst.
• Album and folder names: to show your albums, filter reviews and move photos into albums.
• The images themselves: to display them and to run the on-device analysis described below.

The App does not read the location stored in your photos and does not ask for your device location. On Android, the App uses a file's name only when it has to copy a photo into another album on your device.

2.2 On-Device Analysis

All analysis runs on your phone, and its results stay there:

• Duplicate detection: the App finds exact duplicates by comparing file size, dimensions and type, groups burst shots by capture time, and confirms groups with fingerprints (hashes) computed from the image data. A fingerprint is a short string of numbers and cannot be turned back into your photo. In each group the App suggests one shot to keep, chosen by its resolution, file size and favourite status; you decide what stays.
• Colour analysis: for colour-themed levels the App looks at a very small thumbnail of each photo and stores its main colour and how colourful it is.
• Time-based selections: features such as "one day in the past" or time of day use the capture date and time.

The App does not use face recognition or machine-learning models, and it does not identify people, places or objects in your photos.

2.3 Changes the App Makes to Your Library

The App changes your library only when you ask it to:

• Deleting the photos and videos you marked for deletion, after you confirm (see our Terms of Service for how deletion works on each platform).
• Favourites: marking items as favourites in your system library.
• Albums: creating albums and adding or moving photos into them, including the automatic album tool when you turn it on. On Android, when the system does not let the App move a photo, the App copies it into the new folder instead; on Android 11 and later the original is then removed together with your other confirmed deletions.

2.4 Data the App Stores on Your Device

The App keeps the following in its private storage on your device. None of it is sent to us:

• Your review history: keep, delete and favourite decisions, review sessions with their counts, space freed and time spent, photos waiting for deletion, and the history of photos moved to albums.
• Analysis results: duplicate groups, image fingerprints and colour results described in Section 2.2.
• Your progress: adventure (campaign) levels, experience points, rewards, chests, cosmetic items for Mori, streaks, tutorial hints already shown, and the gallery type the App assigns to your library.
• Your onboarding answers and name: the answers you choose during onboarding and the name you may enter. The name is used only inside the App and in reminder notifications on your device.
• Settings: language, theme, reminder time, vibration, review preferences and filters, and your answer on analytics and crash reports together with when you gave it and which version of the question you answered.
• Usage limits and reminders: the number of free cleanup sessions you used today, campaign pause timers and, during a subscription's free trial, the time, end date and price used for the trial reminder (Section 2.6).

This data is protected by your device's own file protection; the App does not add its own encryption layer. It is deleted when you uninstall the App or clear its data.

2.5 Device Backups

On Android, the App's data is excluded from cloud backups and device transfers. On iOS, the App's data is included in your iCloud or computer backup, like the data of most apps, and is restored together with that backup. Those backups are handled by Apple and by you; we have no access to them.

2.6 Notifications

Reminders and other notifications are scheduled locally on your device: a daily reminder at the time you choose, a notice when a campaign pause ends and, if you start the free trial of a yearly plan, a reminder two days before the trial ends with the date and the price your store shows. The trial reminder uses the trial end date that RevenueCat reports for your purchase. It appears only if notifications are allowed, and it is removed if you cancel the trial and then open the App. We do not use push notification servers.

3. What Leaves Your Device

3.1 Usage Analytics (Google Firebase Analytics)

We use Google Firebase Analytics to understand which features are used and where people get stuck, so we can improve the App. Analytics and crash reporting run only if you allow them. The App asks once: during onboarding, right after you enter your name, or, if you updated from an earlier version, in a window the first time you open the new version. Until you answer, the App sends no analytics events or crash reports. If you updated from an earlier version in which analytics was on, Firebase may still record a standard app-update or session signal in the first moment the new version starts, before the App switches collection off. Closing that window without choosing counts as a no. If you had turned the switch off in an earlier version, the App keeps it off and does not ask.

You can change your answer at any time in Profile > Settings > General > Analytics & Crash Reports. Turning it off stops all analytics events, user properties and crash reports, and the App sends nothing to record that you turned it off.

When you allow analytics, the following is collected:

• App events: which screens you open and which features you use, recorded as named events whose details are limited to numbers, yes/no values and predefined options. They cover onboarding progress and your answers to its multiple-choice questions (why you want to clean up, when you last did, your preferred pace and time of day, your commitment choice, and whether you allowed notifications); photo access being granted or denied; review sessions (start, finish or cancel, with the number of photos reviewed, kept, deleted and skipped, the space freed and the time spent); undo, favourites, duplicate groups and filters; the results of deleting photos and moving them to albums (counts only, never album names); campaign progress (levels, maps, rewards, chests, cosmetic items, tutorial hints and the invitation flow); settings changes; paywall views and purchase, restore and trial results; interactions with notifications, the review prompt, support, update prompts and in-app announcements; photo sharing and friend invitations (the app you shared to and which preset text you chose, never the message); and technical error codes, for example when a video cannot be played. Individual swipes are not sent as events.
• Library summary: once, when the App determines your gallery type, it sends a summary computed on your device: the number of photos, screenshots, videos and duplicates, burst series, the span of years your library covers, and its estimated total and video size in MB.
• User properties: app theme and language, Premium status, total review sessions, total photos deleted, total space freed (MB), preferred review mode, current streak, the gallery type assigned to your library, your library size range (under 1,000, 1,000 to 5,000, 5,000 to 20,000, or over 20,000 photos) and your campaign level.
• Automatic Firebase data: standard events such as first open, app sessions, engagement time, app updates and in-app purchases, together with device model, operating system and app version, and language settings.
• Approximate location: the country and region Google derives from your IP address. The App never asks for your precise location.

This data is linked to a random app-instance identifier that Firebase creates for your installation, not to your name, email or any account. On Android, Firebase may also use the Android ID, a device identifier that is not an advertising identifier. The App does not collect advertising identifiers (the Android Advertising ID or Apple's IDFA) or Apple's identifier for vendors (IDFV). Events never contain your photos, file names, file paths, album names or text you type. Google signals and advertising features are turned off for our analytics.

3.2 Crash Reports (Google Firebase Crashlytics)

If you allow it, Firebase Crashlytics sends a report when the App crashes or hits a serious error, so we can fix it. It is controlled by the same answer and the same switch as analytics. Reports produced before you answer stay on your device: they are sent only if you allow, and deleted if you do not. A report may contain:

• Device model, operating system and app version, and device state recorded automatically by Crashlytics (such as free memory and storage).
• Stack traces and the error messages produced by the App or the operating system.
• Technical context: the screen and operation that failed, and where relevant technical properties of the media item involved (file type, file size, video duration, image dimensions), an internal session number and subscription status diagnostics.
• The most recent analytics events before the crash, when analytics is on.

Crash reports are linked to a random installation identifier, not to your name or any account. They do not include your photos, their content or album names. In rare cases an error message generated by the operating system may mention the media file that could not be read. Crash reports that occur while the switch is off stay on your device and may be sent if you switch it back on.

3.3 Remote Settings (Google Firebase Remote Config)

When it starts, the App downloads settings from Firebase Remote Config: in-app announcements, whether to show update prompts and which purchase screen to show (the App's own or RevenueCat's, which we can switch back to if the App's own screen stops working). To do this, Firebase uses a random installation identifier and basic device and app information. This happens even when analytics is switched off, because these settings are needed for the App to work as intended. Which announcements apply to you is decided on your device. We consider storing and reading this identifier strictly necessary to provide the App you use, including notices about updates and changes to it, so it does not require consent under Art. 5(3) of the ePrivacy Directive. Remote settings are not used for analytics or advertising.

3.4 Purchases (RevenueCat and Your App Store)

Picmori Premium is sold through the Apple App Store or Google Play. Your app store processes the payment; we never see your name, card number or billing address. We use RevenueCat to check which purchases you own, get the plans and prices your store offers, complete purchases and let you manage your subscription. RevenueCat processes:

• A random anonymous user identifier created by RevenueCat (you do not create an account);
• Your purchase history and subscription status (products, dates, renewals, trials and refunds as reported by the store);
• Events from RevenueCat's own screens. From version 4.1 the App normally shows its own purchase screen; RevenueCat's paywall is shown in version 4.0, and in later versions only if we switch back to it (Section 3.3). When RevenueCat's paywall is shown, or when you open the subscription management screen (RevenueCat's Customer Center, opened from the Premium ticket in Settings), that screen sends events: that it was shown or closed; that a purchase was started, cancelled or failed, with the product and the error details; which answer you chose if the screen asks why you are cancelling; and, on Android, which buttons, links, tabs and plans you tapped on RevenueCat's paywall. They also carry the identifiers of the paywall and offer, a random session identifier, how the screen was displayed, whether dark mode is on, your language and region settings, and the time. These events are sent with the anonymous identifier above whether or not you allow analytics, and RevenueCat uses them to show us how these screens perform;
• Technical information such as platform, operating system and app version, store country and currency, and your IP address.

The App's own purchase screen asks RevenueCat only for the plans, prices and whether a free trial is available to you, and sends it no statistics of its own. We do not give RevenueCat your name or any other details about you, and we do not connect RevenueCat with Firebase.

When the App starts for the first time after installation, it silently asks your store which purchases you already own so that Premium is restored automatically.

3.5 App Store Services

• Review prompt: the App may ask your system once to show the standard app store rating window (Apple's StoreKit or Google Play In-App Review). Whether it appears, and what you submit, is handled by Apple or Google.
• Updates: on Android, the App uses Google Play In-App Updates to offer a new version. On iOS, when update prompts are enabled, the App asks Apple's public App Store lookup service for the latest version, sending the App's identifier and your device's region.

3.6 Sharing, Invitations and Links

When you share a photo or invite a friend, the App opens your device's standard sharing sheet or the app you pick (such as Instagram, WhatsApp, Telegram, TikTok, Snapchat or Facebook). The content goes directly from your device to that app; we do not see, store or track it. An invitation contains only the text you choose and the link picmori.org/go, which carries no identifier. We never receive your contacts or your friends' details.

To show the right sharing buttons, the App checks which of these apps are installed (package visibility queries on Android, URL schemes on iOS). This check stays on your device.

Links to our website, the store, support email or an announcement open in your browser or email app, which then apply their own privacy terms.

4. What We Do Not Do

• We do not upload, store or view your photos or videos.
• We do not show ads, and from version 4.0 we do not track you across other companies' apps or websites.
• We do not collect advertising identifiers, your name, email, phone number, contacts or precise location.
• We do not sell your personal information or share it for targeted advertising.
• We do not require an account and do not run our own servers or databases for user data.

5. Purposes & Legal Basis

Under the EU General Data Protection Regulation (GDPR), we rely on the following legal bases:

For remote settings and paywall statistics we rely on our legitimate interest, which we consider balanced against your rights because the data is pseudonymous, contains no photo content and is not used for advertising. You can object to this processing (see Section 8.1). Analytics and crash reports are processed only with your consent; withdrawing it does not affect the lawfulness of processing that took place before.

Giving us data is not a legal or contractual requirement. The App cannot work without access to your photos, but every feature works the same whether or not you allow analytics and crash reporting.

The App assigns a "gallery type" to your library on your device, based on counts such as screenshots and videos, to tailor tips and messages. This has no legal or similarly significant effect on you, and every deletion decision is yours.

6. Service Providers & International Transfers

We share data only with these providers, who process it for the purposes above:

Google and RevenueCat process this data on our behalf under their data processing terms, which allow them to use it only to provide their services to us and require them to keep it secure. We work only with providers that protect your data at least as well as described in this policy. Apple and Google as app stores act under their own privacy policies.

Google and RevenueCat may process data in the United States and other countries outside the European Economic Area. Such transfers are protected by the EU-US Data Privacy Framework where the provider is certified under it, or by the European Commission's Standard Contractual Clauses.

7. Data Retention & Security

7.1 How Long Data Is Kept

• Data on your device: until you delete it in the App, clear the App's data or uninstall the App (and, on iOS, until any backup containing it is deleted).
• Analytics data: event-level data is kept for no longer than 14 months. Aggregated reports that no longer relate to an individual installation may be kept longer.
• Crash reports: kept by Firebase Crashlytics for 90 days.
• Remote settings: the installation identifier is kept by Google under its Firebase retention terms.
• Purchase data: kept by RevenueCat and the app stores for as long as needed to provide your purchases and to meet their legal obligations.
• Paywall statistics: kept by RevenueCat under its data retention terms.

7.2 How Data Is Protected

• Data the App sends to Firebase and RevenueCat travels over encrypted connections (HTTPS/TLS).
• Data kept on your device stays in the App's private storage, protected by your device's own security (Section 2.4). Your photos are never copied out of your library to any server.
• We collect only the data described in this policy, and access to our Firebase and RevenueCat accounts is limited to the Operator.
• If a personal data breach puts your rights at risk, we will notify the supervisory authority and, where the law requires it, you.

No method of transmission or storage is completely secure, but these measures keep the data we receive to a minimum and protect it.

8. Your Rights & Choices

8.1 Your Rights Under the GDPR

You have the right to access, correct and delete your personal data, to restrict or object to its processing, and to data portability. You can withdraw your consent to analytics and crash reporting at any time with the in-app switch; withdrawal does not affect processing that took place before it.

Right to object. Where we rely on our legitimate interest (remote settings, Section 3.3, and paywall statistics, Section 3.4), you can object at any time, on grounds relating to your particular situation, by writing to us. Because we cannot tell which installation is yours, the most direct way to stop this processing is to uninstall the App.

Because the App has no accounts and we do not know who you are, we usually cannot link a request to the pseudonymous data held by Google or RevenueCat. If you contact us, we will explain what we can find and act on your request as far as we can identify data relating to you. We reply within one month.

8.2 Residents of California and Other US States

You have the right to know what personal information is collected and to request its deletion. We do not sell personal information and do not share it for cross-context behavioural advertising. We will not treat you differently for exercising your rights.

8.3 Data Controller

We are not required to appoint a Data Protection Officer.

8.4 Right to Lodge a Complaint

If you believe our processing of your data breaks data protection law, you can complain to a supervisory authority. In Latvia this is:

You may also contact the supervisory authority in the country where you live or work. If you live in the United Kingdom, you have the same rights under the UK GDPR and can complain to the Information Commissioner's Office (ico.org.uk).

9. This Website

The website picmori.org does not use cookies, analytics or advertising trackers. It is hosted by Render and delivered through Cloudflare, which process your IP address and technical request data in server logs to deliver and protect the site. Fonts are served from our own site, so your browser does not connect to Google to load them. If you pick a language on the home page, your browser remembers it in its local storage; it is not sent to us. The picmori.org/go page only sends your browser to the App Store or Google Play.

10. Children's Privacy

Picmori is not directed to children under 13 (or the age of digital consent in your country, which is 13 in Latvia). We do not knowingly collect personal data from children. If you believe a child has provided personal data through the App, contact us and we will help remove it where we can.

11. Earlier App Versions (3.9 and Below)

Picmori 4.0 removed several third-party components. If your device still runs an earlier version, that version also does the following, in addition to what is described above:

In these versions the switch Settings > Data Management > Analytics & Crash Reports was on by default. Turning it off stopped Firebase Analytics, Crashlytics and most Mixpanel events. It did not stop Tenjin, RevenueCat's collection of identifiers or Mixpanel's automatic events, and after the App restarted, Mixpanel events could resume until you opened Settings again.

Where you allowed tracking in the iOS permission prompt, the IDFA was used on the basis of that permission, which you can withdraw at any time. None of the processing in this table takes place from version 4.0, and you can stop it in earlier versions as described below.

How to stop it:

• Update to Picmori 4.0 or later, which contains none of these components. On first launch it deletes the identifier and the install and tracking data these versions stored in the App, and clears the tracking-status property in Firebase.
• On iOS, go to Settings > Privacy & Security > Tracking and turn Picmori off.
• On Android, delete or reset your advertising ID in your device's Google or privacy settings (usually Settings > Google > Ads or Settings > Privacy > Ads).

The RevenueCat advertising integrations were switched off on September 17, 2026, so purchase events are no longer forwarded to Meta, TikTok or Google advertising platforms, including from earlier versions. We will delete our Mixpanel and Tenjin projects and record the date in this section. Until then, you can ask us at support@picmori.org to request deletion of data already sent to these services.

12. Changes to This Policy

We update this policy when the App changes. When we make material changes, we update the Effective Date above and may also tell you in the App. Previous versions are available on request.

13. Contact Us

If you have questions or requests about this policy or your data, contact us at: