Privacy Policy

1. Scope and status

Bokeria Studio provides Photo Metadata Cleaner. This policy covers the current Android and iOS apps. Sections 2–5 describe Android photo processing, collection choices and file lifecycle; section 8 describes iOS. Sections 6–7 explain shared provider and support practices. The production Android application ID is com.bokeriastudio.photometadatacleaner; test and demo builds use separate IDs.

The Android demo build has no Firebase SDK or internet permission. Android liveDebug, production liveRelease and the current iOS live build use the same approved Firebase project. The Android test and production packages are registered as separate apps in that project; test and production measurements may coexist. Public Play distribution is being prepared. Registering a service does not establish that it has received actual measurements. Changing service configuration or data practices requires an updated policy.

2. Photos and metadata

With your permission, the Android in-app gallery lists accessible photo identifiers, folders and system thumbnails on your device. Photo-library read permissions can cover all photos or the photos you permit, depending on the system. The app reads photo bytes and metadata only for photos you confirm, or files and shared photos you select, and processes working copies without overwriting originals. The optional photo media location permission lets the app read stored photo locations; it does not obtain your current device location. Camera, microphone, contacts and device-location permissions are not required. Gallery lists and photo locations are not sent to us.

Photo contents, cleaned copies, EXIF/GPS values, file names, content URIs and inspection report values are not inputs to the app’s Firebase event or trace interfaces. We do not operate a photo-upload server. Automatic technical diagnostics can include exception messages or network URL paths. The app’s explicit exclusion of photo values is not a guarantee about every automatically captured diagnostic field.

The system or a cloud provider may download or change the representation it delivers. The app can inspect only that delivered representation. Cleaning depends on each file’s verified preservation checks; supported static JPEG, PNG and WebP files may be cleaned, while HEIC, HDR and unverified representations can be refused. A cleaned copy can retain information needed for display, such as dimensions and orientation, and does not hide objects, faces, text or clues visible in the image. Review the result and the app’s retained-information notice before sharing.

3. Local storage, saving and sharing

The app stores temporary input and result copies, sharing copies, collection choices, and limited recovery records on your device. An unfinished save record can include the destination URI or file name. The app excludes its private files and preferences from Android cloud backup and device transfer through its backup configuration.

Working copies are removed when the session is discarded or during startup recovery. Sharing copies become eligible for cleanup after 24 hours and are removed on a later startup or return to the foreground, not at an exact deadline. If cleanup or destination deletion fails, the app can ask you to remove an incomplete file manually.

Saving creates a new copy in the gallery or location you choose. The default is to keep the original. On Android 11 or later, for a single photo confirmed in the in-app gallery, the app can offer “Move original to trash” only after saving and reopening the gallery copy to verify it. The original and copy are checked again before a system confirmation is opened. Only your explicit choice and approval in that system dialog move the identified original to system trash. Cancelling, failed verification or unsupported trash environments do not trigger an app deletion fallback. Android 9–10, file/picker/shared inputs and batch processing do not offer this action. The app does not permanently delete originals or move them to trash automatically. Gallery or cloud sync services may propagate removal to backups; do not assume a separate device or cloud copy will remain. Check your service’s policy before proceeding. Restore methods and retention vary and the system may empty its trash. Sharing grants temporary read access to a copy to the receiving app. Opening a sharing window does not confirm delivery. Cloud-backed input or save locations and receiving apps may download, sync, store or forward your photo under their own policies. Copies saved or received elsewhere remain until you or that provider delete them. Clearing app storage or uninstalling removes private app data; it does not erase originals, exported files or data already sent to providers.

4. Optional usage statistics and diagnostics

In the live build, saved choices take priority for Usage statistics and Error and performance diagnostics. Without a saved choice, both stay off and the app asks first if any device signal indicates the EEA, UK, Switzerland or an associated territory included in the app policy, or if the region is unknown. Otherwise, the app saves both as on. It checks system language/region country codes, SIM/network countries and time zone on device, without obtaining precise device location. These signals do not establish residence or travel location. “Choose later” or not answering the choice screen leaves collection off. You can allow or decline each option in Settings without losing photo features. Failure to save a choice does not automatically enable collection.

• Usage statistics — Google Analytics for Firebase: predefined screen names and actions for cleaning, saving, preparing a share and export failure, without photo values or custom event parameters. The SDK can also process automatic events, app/device/OS information, app-instance and session identifiers and approximate region derived from network information.
• Diagnostics — Firebase Crashlytics and Performance Monitoring: crash stacks and session/device/OS information, installation identifiers, app-start/screen/CPU/memory/network performance, and the duration of cleaning and saving. Network measurements can include URL paths, response codes, byte counts and timing. Crash action breadcrumbs can be included when Analytics is also used.

There are no ads, accounts or purchases in this Android implementation. Advertising-ID permission and collection are removed, and advertising storage and personalization choices remain denied. Firebase installation, session and remote configuration components also support service identification, configuration and quality metrics. SDK collection switches do not guarantee that these components make no internal network requests or process no installation identifiers.

On Android, even with both measurement options off, Firebase can register an installation identifier and request service configuration when the app changes state, such as moving to the background. These configuration requests can send the installation identifier, language/region setting, time zone, and app/OS information to Google. The country code in this request comes from the language/region setting, not a measurement of your current physical location. The two measurement switches do not stop all installation and configuration communication.

For provider details, see Firebase privacy and security, Performance network traces and Google’s Privacy Policy.

5. Withdrawal and its limits

Turn either option off in Settings. Turning usage statistics off resets on-device Analytics data. Turning diagnostics off stops active app traces and requests deletion of unsent crash reports. Crashlytics automatic sending stays off even when diagnostics is allowed; the app checks current permission and the preceding session’s eligibility before requesting a send. Reports left by an off session are isolated and requested for deletion. A deletion request is not proof that deletion has finished, and new permission does not make earlier off periods eligible.

After withdrawing diagnostics, restart the app before enabling it again. If saving your choice fails, follow the retry notice and confirm it saved: otherwise a later launch can restore the previous saved choice. These controls cannot recall a request already in progress or delete information already received by Google. SDK data and requests left offline can be processed when connectivity returns; cancellation of all earlier queues is not guaranteed. The app does not provide a server-data deletion button.

6. Retention, recipients and privacy requests

Google receives enabled service measurements to help us understand usage and diagnose reliability and performance, and the installation/configuration information described in section 4. Its infrastructure may process data outside your country, including in the United States. Firebase and Analytics have separate service terms. Our email provider handles correspondence you send us.

Google documents 90 days before Crashlytics deletion begins, and Performance periods of 30 days for IP-associated events and 60 days for installation-associated or de-identified data. Analytics retention varies with data type and the property’s configuration; see Analytics retention. The current Analytics property shared by Android test and production apps and iOS retains events for 2 months and user data for 14 months, with the user period reset on new activity. Google signals and products/services sharing are off, and no Ads account is linked. Aggregated benchmarking and technical support remain enabled. These settings do not limit all aggregate reports. Support-mail handling in section 8.5 applies to both platforms. These provider periods do not promise immediate erasure.

To ask about access, correction or deletion of information, or withdrawal of permission, email appsupport@bokeriastudio.com. With no app account, your email alone may not identify a telemetry record. Do not send a sensitive photo to identify yourself. Depending on your location, you may also contact your data protection authority. We review requests and explain any identification limits or retention obligations that affect the response.

7. Email and this website

If you send support email, we receive your address, message and any attachments you choose to send, to address your request. The app’s editable email draft contains the app name, the platform you use and installed app version. It does not automatically attach photos or diagnostic logs. If no email app opens, you can copy the address and use your own mail service. Only sending your email provides its contents to us; opening a draft does not send it.

These four pages use local CSS, with no advertising or analytics scripts, external fonts or tracking cookies. Firebase Hosting serves them and processes request IP addresses; Google describes IP retention of a few months. External links and email use the destination service’s policies. We update this page and its effective date when our practices change.

8. iOS privacy information

8.1 Selected photos and permissions

The iOS in-app photo picker asks for Photos library access to show allowed thumbnails, file formats and an ordered selection of up to 50 photos. You may allow selected photos only, change that selection, or deny access and use the system PhotosPicker instead. The app reads library identifiers and resource format information locally for this interface. It downloads and copies a photo resource into private working storage only after you confirm selection. It uses a uniquely identified edited full-size photo when present, or the single original photo resource otherwise, and refuses ambiguous or changed resources. The system picker and Files remain alternatives; Files access is limited to the selected file while copying. The app does not overwrite or delete originals. Saving creates copies with Photos permission; add-only permission is requested when needed.

Cleaning supports verified static JPEG, PNG and WebP files within file, device and memory limits. The format badge and filter are preliminary guidance, not a promise that a file can be cleaned. HEIC/HEIF, Live Photos, HDR and unsupported structures can be refused. One selected photo retains individual removal choices; multiple selected photos are cleaned sequentially with the default removal mode for known descriptive metadata after confirmation. Each failure is shown separately and completed copies can be saved together. Cancelled processing keeps completed copies until the session is discarded. Save retries skip copies already reported saved in the current session; an already-started Photos save may finish after cancellation. iCloud or another provider may download or sync files under its own policies. The app inspects the selected resource or delivered representation and does not certify all metadata of the original asset. Visible faces, text and location clues remain.

Photo bytes, metadata values, file names and paths, Photos identifiers and inspection results are not arguments to the app’s Firebase event or trace interfaces. The app has no photo-upload server. Automatic technical diagnostics can include network URL paths and exception messages. Do not enter sensitive photo information in a support request; the app does not intentionally put it into measurement events.

8.2 Working storage, Photos and sharing

The app keeps temporary input and output copies and a preview on your device. Working directories use file protection and are excluded from backup. Active previews, Photos saves and shares retain access to their output while needed. Working copies are reclaimed when their session and consumers finish, or when a later app start recovers abandoned sessions. Cleanup can fail; this is not an exact deletion deadline or a promise to erase every SDK cache.

Collection choices and limited SDK-session/report eligibility markers are kept in a protected local file. This file is not sent by the app’s telemetry interface. The working-directory backup exclusion does not describe all app settings or SDK storage.

Save creates a new Photos asset; it does not replace the original. Share passes the verified output file to the system share sheet. Opening or closing that sheet does not establish that another app saved or uploaded it. Photos, iCloud, Files providers and receiving apps can sync, store or forward exported copies under their own policies. Removing an app working copy does not delete originals, Photos assets, external copies or data already sent to a service.

8.3 Two independent collection choices

The iOS live build offers Usage and performance and Crash diagnostics. Saved choices take priority and you can allow either, both or neither. Without a saved choice, both stay off and the app asks first if system region, preferred-language country codes or time zone indicate the EEA, UK, Switzerland or an associated territory included in the app policy, or if the region is unknown. Otherwise, the app saves both as on. These checks use on-device signals, not precise location or verified residence. Declining or choosing later on the choice screen leaves photo features available. The demo does not include Firebase; live builds without developer activation do not automatically enable collection. The current internal TestFlight configuration has activation enabled for the shared Firebase project, so measurements may be stored together with Android test and production data.

• Usage and performance — Analytics and Performance Monitoring: fixed screen and processing/save/failure actions without photo values or free-form event parameters, and the time taken to clean a photo. The services also handle app lifecycle events, app/device/OS and installation/session information, general region derived from network addresses, app-start/CPU/memory measurements and network request performance. Network measurements can include URL paths, response codes, byte counts and timing.
• Crash diagnostics — Crashlytics: crash stacks and app/device/session/installation information. The app does not set a user ID or pass photo paths, arbitrary error text or support messages to its diagnostics interface. Crashlytics also includes device state and, when Analytics is used, action breadcrumbs. Technical exceptions can include their messages.

This iOS implementation has no advertising SDK, accounts or purchases. Advertising storage, use and personalization remain denied. Switching collection off is not evidence that all SDK-internal network requests or previously queued transmissions have stopped. See Firebase’s iOS network measurement information for the provider’s description.

8.4 Withdrawal, restarting and stored reports

Turn either choice off in Settings. Turning Usage and performance off disables the app’s measurements, stops active app traces and requests an Analytics reset. Turning Crash diagnostics off stops the app’s diagnostics and requests deletion of unsent crash reports. A reset or deletion request does not prove that all SDK queues have been erased.

Allowing diagnostics during a session, including after withdrawal in that session, takes effect after restarting. After a normal background transition, the next launch restores saved choices. An interrupted session or choice-storage recovery record requires confirmation before reactivation, regardless of region. Crashlytics automatic report sending stays off. An enabled diagnostics session can request sending stored reports after checking the current choice and the preceding session’s eligibility. A new permission does not make previously ineligible reports eligible.

Saving a choice or initializing a service can fail; follow the app’s retry or restart notice. Withdrawal cannot recall data already received by a provider or guarantee cancellation of a send request already passed to the SDK, even if that request is waiting offline. Previously stored SDK data or requests can remain pending offline and be processed after connectivity returns. Turning an option off does not guarantee that every previous SDK request or queue is cancelled. There is no in-app button that deletes all server-side measurements.

8.5 Recipients, retention and privacy requests

Bokeria Studio uses Google Analytics for Firebase, Crashlytics and Performance Monitoring to understand app use and improve reliability. Google processes these service measurements on its global infrastructure, including outside your country. We do not use the app's data for targeted advertising, sell it or share it with data brokers. The app has no advertising SDK, does not set an account-level user ID, and disables advertising identifiers and advertising consent. The current Analytics property has Google signals off, no linked Google Ads account and Google products/services data sharing off. Aggregated benchmarking and Google technical support remain enabled.

For the current shared Firebase project, Analytics event data is retained for 2 months and user data for 14 months, with the user period reset on new activity. These settings do not limit all aggregate reports; see Google's retention explanation. Google begins deletion of Crashlytics traces and related identifiers after 90 days, Performance IP-associated events after 30 days, and installation-associated or de-identified performance data after 60 days. Deletion from live and backup systems is a process, not an immediate deadline.

If you send support email, Bokeria Studio and its email provider receive your address and the message or attachments you choose to send. We use them to answer your request. The iOS email draft includes the app name, platform and installed version, without automatic photo or diagnostic attachments. Support correspondence is retained for 90 days after your request is resolved, then deleted. You can request deletion at appsupport@bokeriastudio.com.

For access, correction, deletion or questions about your choices, use the same support address. We review requests and may ask for information needed to locate the relevant record. With no app account, an email address alone may not locate pseudonymous service measurements; do not send sensitive photos to identify yourself. Removing the app or withdrawing a choice does not itself delete previously received service data. Where applicable, you may also contact your data protection authority.

8.6 Optional recommendations for another Bokeria app

For a HEIC photo that this app cannot clean, the iOS app may show an optional link to Bokeria’s separate HEIC to JPG Converter Batch app on the App Store. The store page opens only when you choose the button. The link contains no photo, metadata, filename or tracking parameters; this app does not transfer your selected photo to the converter or check whether that app is installed. No recommendation-specific analytics or advertising identifiers are added. Supported photo cleaning remains available without installing or opening another app.

If you choose to use the App Store or the converter, their own privacy practices apply. Select and convert photos there yourself, then select the JPG again in this app if you want to attempt metadata cleaning. Conversion can change image quality or HDR appearance and does not by itself guarantee metadata removal.