Privacy Policy

Last updated: 5 October 2026. This is a translation; if the two versions differ, the German version applies.

1. Controller

More details are in the imprint.

2. What data we process and why

2.1 Your account

When you create an account, we store your email address, a display name if you choose one and your password only as a hash (scrypt, never in plain text). We also store when you registered and confirmed your email address and when you last used the app. If you sign in with Google, Google sends us your email address, your name and an identifier of your Google account; we do not store the address of your profile picture that Google includes.

To confirm your email address and to reset your password, we email you a code; it is valid for 15 minutes and we store it only as a hash. To keep you signed in, we store a sign-in key, also only as a hash; it is valid for at most 90 days.

Purpose: providing your account, sign-in, communication about your account. Legal basis: Art. 6(1)(b) GDPR (contract).

2.2 Photos and videos

The app reads the photos and videos on your phone after you allow access. It never uploads your originals. For the analysis it sends a newly computed, downsized preview of each photo (currently at most 512 pixels on the longest side, without location or camera data) and, for videos, one preview made of three frames. The following details come with it: file name, folder name, file type, dimensions, file size, the length of videos, an identifier of the photo on your phone and the device identifier described in section 2.5.

On our server we store the previews, the analysis results and the album and cleanup suggestions made from them, plus which suggestions you applied or dismissed. The analysis results include a short description of the image content, keywords, album ideas, a quality rating, notes on duplicates, screenshots, documents, receipts and explicit content, the number of people shown, a short summary of text visible in the image and a guess where the photo was taken, as far as the image itself suggests it.

The app creates albums only on your phone, and it deletes photos only there, after you have agreed in the app and in the Android delete dialog. Your previews are not shown automatically in our admin area. We open them only when needed to fix a problem, for example after you asked us for help; every access is logged.

Purpose: the core function of the app, that is, suggesting albums and cleaning up. Legal basis: Art. 6(1)(b) GDPR (contract).

2.3 AI analysis

The analysis runs in two steps. In the first step we send each preview together with your settings (album style, what should be cleaned up), for videos also the length, to an AI service that describes the image content. In the second step we send text only, no images: the analysis results, file names, folder names, file type, size, dimensions and upload time of your photos and, if you use “Recognize people”, which photos belong to which group of people and the names you gave these groups. This produces the album and cleanup suggestions.

We use OpenAI and Google Gemini as AI services. Which service handles a request is set in our server configuration. Both process the data as our processors under their business terms: they do not use the content to train their models and may keep it only for a limited time to detect abuse. Details on location and transfers are in section 3.

If you turn on saver mode in the app, we send your preview images to the AI service as a collected batch instead of one by one. The service then keeps the previews and the results until it has processed them and we have picked up the results, at most about 50 hours; after that we delete everything belonging to that batch there. Which service receives the images and what it returns is the same as without saver mode.

The suggestions are suggestions. There is no automated decision with legal effect within the meaning of Art. 22 GDPR; nothing changes in your photos without your confirmation.

2.4 Recognize people (optional)

“Recognize people” is switched off until you explicitly switch it on in the app. Only then does our server look for faces in your previews during a scan, compute face features (a mathematical description) for each face and assign faces of the same person to one person. This happens on our own server in Germany with openly licensed models from the OpenCV project (YuNet finds faces, SFace compares them); no other service receives your images for this. We do not store the face features: they exist only in memory during the scan, never leave the server and are not matched against other accounts or external databases. So that a person is recognized again in the next scan, we recompute the features of a few of their faces each time, from your previews or from the face crops (next paragraph).

Faces in the previews are often only a few pixels wide. To still assign them reliably to the same person, the app cuts a crop from the original photo on your phone for small faces (only the face with some surroundings, at most 640 pixels per side, without location or camera data) and uploads it. We still do not receive the whole original photo. We use the crops only for recognizing people and for the face pictures the app shows you.

We store: for each face found, the photo, its position and size in the image, three quality numbers (how certainly the face was detected, how sharp and how frontal it is), the person it belongs to and the face crop, if there is one; the people with the names you give them and whether you have hidden them; your decisions (“same person”, “not this person”, “not the same”) and the steps you can undo; open questions “Is this the same person?” with one number for how similar the two people are; which photos have already been searched. Only you see your people. The names you give are sent as text to the AI service so that a people album is named like the person (see 2.3).

Face features are biometric data and therefore specially protected. The legal basis is your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), which you give with the switch. You can withdraw it at any time by switching “Recognize people” off. We then immediately delete everything listed in the two previous paragraphs, including the face crops, and future scans skip face recognition. The withdrawal applies to the future; processing until then remains lawful.

Photos often show other people too. Please use this feature only if that is fine for the people shown.

2.5 Device identifier

So that we can assign previews to the right phone and apply the device limit of your package, the app sends a pseudonymous device identifier with uploads and some requests. From app version 1.13, a new installation derives this identifier from the Android ID, an identifier that Android assigns to each app on each phone separately. Only a hash of it (SHA-256) reaches our server, never the Android ID itself. This lets us recognize when you reinstall the app on the same phone, so it does not count as another device. You also use it to manage your device slots, for example when you release an old phone.

Installations that already had an identifier before version 1.13 keep their previous, randomly generated one; if the app cannot read the Android ID, it also generates a random one. If you reset your phone to factory settings, a new identifier is created. We do not use advertising IDs.

Legal basis: Art. 6(1)(b) GDPR (device limit as part of the contract). Reading the Android ID on your phone is technically necessary for this service (Section 25(2) no. 2 TDDDG).

2.6 Usage events

The app reports simple events to our server, for example which screen was opened and whether a sign-in, a scan or a purchase worked, was cancelled or failed. Before a scan it reports how many photos are in which folder (folder name and count), after applying suggestions how many albums were created and photos deleted, after a move from OneDrive (section 2.10) how many photos were downloaded, recognized and removed, after each run of an import from Google Photos or iCloud (section 2.11) which of these sources it came from, how many photos were brought over, already present or unreadable and how the run ended. If something that concerns your account fails on our server, for example a scan, sending an email or booking a purchase, we note this together with your account. We use this information to find bugs and to help you with support requests. We do not use any third-party analytics or tracking services for this.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a stable, bug-free app). You can object to this (section 7).

2.7 Purchases

You buy photo credits and subscriptions through Google Play. We do not receive payment details. For each purchase Google sends us the product, the quantity, price and currency, the order number, a purchase token and the status, for subscriptions also the term and renewal. We add the photo credits to your account and store the bookings in your credit account.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (retention duties under tax and commercial law).

2.8 Website and server

The website equipora.de sets no cookies, stores nothing on your device and loads no content from other servers; even the font is hosted on our server. Our server keeps your IP address only briefly in memory to fend off too many requests (for example repeated sign-in attempts) and does not store it. Cloudflare processes IP addresses and connection data when it forwards requests to our server (see section 3).

So that we can detect and fix faults, our server writes an operations log: the time, which function was called (as a general pattern, without your album or file names), error messages and internal identifiers, for example of scans, photos or devices. It contains no IP addresses, email addresses or names. The log stays on our server in Germany and is deleted automatically after 13 months at the latest.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in secure and stable operation).

2.9 Contact by email

When you write to us, we process your message and your email address to answer you. Cloudflare forwards emails sent to our addresses to our mailbox. Legal basis: Art. 6(1)(b) GDPR if it concerns your account or a purchase, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering requests).

2.10 Photos in Microsoft OneDrive (optional)

You can connect your Microsoft OneDrive in the app (Settings › OneDrive) to clean up photos stored there and bring them to your phone. You sign in directly with Microsoft; we never see your password. The app asks Microsoft for three permissions: to read and change files in your OneDrive (needed to download, sort and delete), to read the name of your Microsoft account (for the “Connected as” line) and to stay signed in, so you do not have to sign in again for every sync. The access key Microsoft then issues to the app is stored encrypted on your phone only. Our server does not receive it and therefore has no access to your OneDrive itself. The app reads the list of your files from Microsoft and keeps on your phone only photos, videos and folders: file name, folder, file type, size, capture time, dimensions, the length of videos, checksum and Microsoft’s identifiers, plus the name of your Microsoft account for the “Connected as” line. When you bring photos to your phone, it also keeps which file on your phone belongs to which file in OneDrive.

None of this reaches our server unless you switch on “Include in scans”. If you do, the app downloads one preview per photo that OneDrive provides (at most 512 pixels on the longest side, without location or camera data) and sends it to our server. The following details come with it: file name, folder name, file type, dimensions, file size, capture time, the length of videos, the checksum of the file and two pseudonymous identifiers for your OneDrive and for the photo. The app computes these identifiers as hashes from your Equipora account number and Microsoft’s identifiers; we do not receive Microsoft’s identifiers themselves. The app also reports the identifiers of all photos and videos currently in your OneDrive, so that we can drop suggestions for photos that are gone. We analyze and store the previews as described in sections 2.2 and 2.3.

We never receive your originals from OneDrive. When you bring photos to your phone, the app downloads them directly from Microsoft to your phone and compares every file with OneDrive’s checksum. Our server only learns that a OneDrive photo is now on your phone (identifier of the photo on the phone, folder name, checksum), so that its analysis stays valid for the phone photo and the next scan does not charge for it again. This only happens for photos whose preview we already have. Photos you bring over are stored in Pictures/OneDrive and, like the camera and downloads, belong to the folders that scans include on their own; you can deselect the folder in the settings.

For the move to your phone, the app checks which OneDrive photos are already on your phone. To do so it computes the checksum of the unmodified file on your phone. This requires permission to read photos including their location details; the app requests it when you start the move, and with full photo access Android usually grants it without asking separately. Without it Android delivers other apps’ photos with the location details removed, and a reliable comparison with OneDrive is not possible. The app does not evaluate the location details, and they do not leave your phone.

The app changes something in OneDrive only after you have confirmed it in the app: it moves photos into an album folder or puts photos into the OneDrive recycle bin (cleanup and “Remove from OneDrive”).

With “Disconnect OneDrive” we immediately delete all previews, analyses and suggestions for your OneDrive photos, including file names, identifiers and the other details about these photos, and the app deletes the access key and the list on your phone. You can additionally revoke the app’s access in your Microsoft account. Purpose: including photos from OneDrive in the core function of the app. Legal basis: Art. 6(1)(b) GDPR (contract).

2.11 Bringing over photos from Google Photos and iCloud (optional)

You can request an export of your Google Photos from Google (Google Takeout) or a copy of your data with your iCloud Photos from Apple (privacy.apple.com) and choose the ZIP files in the app (Settings › Photos from Google Photos and iCloud). The app reads these files on your phone only and puts the photos and videos from them into your gallery. If a file lacks the capture time, it adds it from Google’s accompanying files or Apple’s photo lists, and for Google also the location; what the file itself says stays. Albums become folders under Pictures, all other photos go to Pictures/Google Photos or Pictures/iCloud Photos. Photos that are already on your phone are not created again. Photos from the trash or from Recently Deleted, photos hidden in iCloud and shared albums are not brought over; the plan before the start shows how many there are.

We do not receive the archives, the photos or their accompanying data. After each run the app only reports numbers: which source the import came from, how many photos were brought over, already present or unreadable and how the run ended (section 2.6). Only when you scan afterwards does the app treat the photos it brought over like all others (sections 2.2 and 2.3). The app changes or deletes nothing at Google or Apple. So that an import can continue where it stopped after an interruption, the app keeps on your phone the chosen files with read access, until you remove the selection or sign out, and for each photo brought over its path in the archive, its size, for Apple the checksum from Apple’s list, and its identifier in the gallery. Purpose: bringing your photos from Google Photos and iCloud to your phone. Legal basis: Art. 6(1)(b) GDPR (contract).

3. Recipients

We do not sell data and do not pass it on for advertising. The following service providers process data on our behalf (Art. 28 GDPR) or, where stated, under their own responsibility:

For Sign in with Google and for purchases, Google’s privacy policy also applies: policies.google.com/privacy. For OneDrive, the Microsoft Privacy Statement applies: microsoft.com/en-us/privacy/privacystatement.

App fonts: the app gets its fonts (Inter and JetBrains Mono) through Google Play services on your phone. If they are not there yet, the service downloads them once from Google; Google then learns your phone’s IP address and the name of the font, but no data from Equipora. Without Google Play services the app uses your phone’s font.

4. How long we keep data

5. App permissions

• Read photos and videos: so the app can analyze your gallery, create albums and, with your consent, delete photos. Only the previews from section 2.2 are uploaded and, if you have switched on “Recognize people”, the face crops from section 2.4.
• Notifications: so we can tell you when a scan, a move from OneDrive or an import from Google Photos or iCloud is finished.
• Foreground service: so a scan, a move from OneDrive or an import from Google Photos or iCloud can finish while the screen is off. While it runs, you see a notification.
• Internet: for the connection to our server and, if you connect OneDrive, to Microsoft.
• Read location details in photos: only for the move from OneDrive (section 2.10). The app requests it only when you start the move (with full photo access Android usually grants it without asking separately) and uses it to compute checksums of the unmodified files on your phone. It does not evaluate the location details and does not transmit them.

The app does not use your phone’s location, contacts, camera or microphone.

6. Storage on your device

The app stores on your phone what it needs to work: your sign-in, your settings, the device identifier and which photos have already been uploaded or moved into albums. If you connect OneDrive, the encrypted access key from Microsoft and the list of your OneDrive photos are added; if you bring over photos from Google Photos or iCloud, the chosen archive files and the photos brought over (section 2.11). This is technically necessary (Section 25(2) no. 2 TDDDG). Android includes this data neither in backups nor when you move to a new phone; after switching phones you simply sign in again.

The website stores nothing on your device. Only if Cloudflare suspects an attack may it temporarily set a technically necessary security cookie. The admin area of our website uses the browser’s password prompt, not cookies.

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)); for “Recognize people” simply with the switch. Write to us at [email protected].

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

8. Deleting your account

You can delete your account at any time in the app: Settings › Delete account. Your account and the related data from section 2 are deleted immediately. We keep purchase records and the bookings of your credit account without any link to your account, as long as the law requires. Our record of what the AI analysis cost is likewise kept without any link to your account. Please cancel a running subscription separately in Google Play. Without the app, email [email protected]. All details are on the account deletion page.

9. Security

• App and website talk to our server only over encrypted connections (HTTPS).
• We store passwords, confirmation codes and sign-in keys only as hashes.
• Access keys to services such as the AI providers are stored encrypted in our database (AES-256-GCM).
• The admin area is protected by a password and locks after repeated failed attempts.

10. Changes

We update this policy when features or service providers change. We announce significant changes in the app. The current version is always available at equipora.de/privacy.

11. Contact

Privacy: [email protected]
General questions: [email protected]