Effective date: 6 October 2026
Controller (Article 4(7) GDPR):
Seyedmohammad Farrahi, Einzelunternehmer, trading as
"Gleaner"
Schützenstr. 3, 35398 Gießen, Hessen, Germany
Email: kabok.company@gmail.com
Full provider details are in the Impressum.
This Policy explains how Gleaner handles information in the mobile app and on its website and help pages. Photo analysis happens on your device. Your photos are not uploaded. On iOS and Android, optional pseudonymous Firebase Analytics starts only after your explicit opt-in. Firebase Functions and App Check are required for purchase security on mobile. The free version can show an optional rewarded ad from Google AdMob only when you choose to watch one; Section 1.D explains when an ad is requested. macOS does not send remote Analytics and never loads the ads SDK. Gleaner has no account, and Gleaner itself does not track you across apps; Google's ads SDK may use advertising identifiers as described in Section 1.D.
Mandatory rights under applicable privacy and consumer law remain unaffected.
Similarity grouping and quality scoring run locally. We do not receive your photo pixels, thumbnails, filenames, file or PhotoKit/MediaStore identifiers, album names, faces, EXIF, GPS, precise location, or photo timestamps. Gallery photos are never Analytics or model-training data.
When you buy or restore Pro, and afterwards at every start of the app and, when it returns to the foreground, at most every six hours while your store account reports a Gleaner purchase, the app asks Gleaner's purchase backend (Firebase Functions in Google Cloud's Frankfurt region) to check the purchase. Firebase App Check first confirms that the request comes from the genuine app, using App Attest or DeviceCheck from Apple on iOS and Play Integrity from Google on Android. The request contains a random installation identifier created by the app, the platform, the product identifier, and the Play purchase token or the signed StoreKit transaction; Google Cloud also receives your IP address and technical connection data. The backend checks the proof with Google's Play Developer API or Apple's App Store Server API and returns a signed answer bound to the installation identifier; the installation identifier itself is not stored on the server. The backend stores one record per purchase (a hashed store key, the product, its status and expiry, the store's order or transaction number, and the time of the last change) and receives Apple's and Google's server notifications about renewals, refunds, holds, expiration, and chargebacks. It receives no photos, no name or email address, and no payment-card details. This processing is required for paid access and fraud prevention and is separate from Analytics consent.
If you opt in, Google Firebase Analytics assigns an app-instance identifier. It is pseudonymous, not anonymous: it can distinguish an app installation but Gleaner does not associate it with a name, email, account, advertising ID, IDFA, IDFV, or Analytics User-ID.
Firebase may then process:
Custom values pass through a strict allow-list and range bucketing. Analytics has no ads features: Gleaner does not use Crashlytics, Firebase Performance Monitoring, Remote Config, or an Analytics User-ID, and it never requests App Tracking Transparency or reads the IDFA. Separately from Analytics, the Google Mobile Ads SDK may process the identifiers described in Section 1.D. macOS keeps its diagnostics local and does not initialize Firebase.
The free version includes three group cleanups. Only after you have used all of them and tap to continue does the app open a separate Unlock more cleanups sheet with two choices: Gleaner Pro first, then a rewarded ad. One completed rewarded video unlocks further group cleanups, currently three. This number is an app setting and may change; the sheet shows it before you tap Watch ad. Watching an ad is never required: you can keep using the app without cleaning further groups, or upgrade to Pro. The purchase screen shows no ads. Pro shows no ads, and the ads SDK is not started for Pro users. Rewarded video is the only format; there are no interstitials, banners, or native ads. The ads SDK is never loaded on macOS.
Ads are served by Google AdMob, provided to users in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google is an independent controller for this processing under the Google Ads Controller-Controller Data Protection Terms. When an ad is requested or shown, the Google Mobile Ads SDK may process:
At each launch, the free version asks Google's User Messaging Platform (UMP) whether a consent message is required where you are. This check sends your IP address and basic device and app information to Google. Your answer to the message is stored on your device as an IAB TC string (and Google's additional consent string), is sent with each ad request, and remains until you change it in Settings → Ad privacy options or delete the app's data.
So that an ad is ready when you want it, the app may request one in the background once the list shows with one free cleanup left or none, when you use Auto-select while some groups stay locked, and again after the delete that uses your last free cleanup. It does so only when your consent choice already allows ad requests (in regions with a consent message, only after you consented to storing and accessing information on your device), when the daily ad limit is not reached, and never for Pro. Such a background request sends the data listed above to Google even if you then do not watch the ad.
Where the law requires consent (currently the EEA, the UK, and Switzerland, as set in Gleaner's AdMob consent settings), Google's UMP consent message follows the IAB Transparency and Consent Framework and appears once, at first launch after photo access, before the ads SDK starts and before any ad is requested. Your choice there decides how Google may serve ads. With consent to personalized ads, ads may be personalized. With consent to storing and accessing information on your device but not to personalization, Google serves non-personalized ads, which still use identifiers for frequency capping, fraud prevention, and aggregated reporting. Without that consent, Google may serve limited ads, which according to Google use no advertising identifiers and no local storage for ad serving; your IP address is still used to deliver the ad, and Google may use storage to detect invalid traffic. If no ad can be served under your choice, the sheet says that no ad is available and the Pro option stays. The app itself sends a plain ad request with no personalization setting attached. Outside regions with a consent message, Google may personalize ads on Android using the advertising ID unless you reset or delete it in your device settings. On iOS, Gleaner never requests tracking permission, so the IDFA is never used. Your answer to this message concerns advertising only and never switches Analytics on (Section 4).
Legal basis. Storing or reading information on your device for advertising, and the processing of identifiers that follows, is based on your consent (Section 25(1) TDDDG, Article 6(1)(a) GDPR). If you have not consented, the app requests an ad only after you open the Unlock more cleanups sheet; the transmission of your IP address and the technical request data needed to deliver a limited ad is based on Section 25(2) No. 2 TDDDG and on our legitimate interest in financing the free version with ads that users choose to watch (Article 6(1)(f) GDPR). The consent check at launch is based on our legitimate interest in asking for consent only where it is required (Article 6(1)(f) GDPR), and storing your answer is based on our duty to be able to demonstrate consent (Article 6(1)(c) together with Article 7(1) GDPR, and Section 25(2) No. 2 TDDDG). You can withdraw or change your consent at any time in Settings → Ad privacy options; withdrawing is as easy as consenting and takes effect for future ad requests. Your photos are never used for ads.
Gleaner stores only the local entries described in Section 11 and receives no ad data. Google states that it anonymizes advertising server logs by removing part of the IP address after 9 months and cookie and identifier information after 18 months; see Google's retention information. Google may process ad data in the United States under the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses as fallback (Section 6).
Google's own information: how Google uses data from apps that use its services: policies.google.com/technologies/partner-sites; Google Privacy Policy: policies.google.com/privacy; other advertising technology providers that may receive data through AdMob: Google's ad technology providers list.
The two stores use different names for required purchase security, optional Analytics, and rewarded advertising:
| Apple App Privacy | Google Play Data Safety |
|---|---|
| Coarse Location; Purchase History; Device ID; Product Interaction; Other Usage Data; Performance Data; Other Diagnostic Data | Approximate location; Purchase history; App interactions; Other actions; Diagnostics; Other app performance data; Device or other IDs |
| Required Purchase History and Device ID for App Functionality and fraud prevention | Required Purchase history and Device or other IDs for App functionality and fraud prevention |
| Device ID, Advertising Data, Product Interaction, and Coarse Location as Data Linked to You for Third-Party Advertising; Crash Data, Performance Data, and Other Diagnostic Data; Tracking: No, because there is no App Tracking Transparency prompt and the IDFA is never read | Approximate location, App interactions, Crash logs, Diagnostics, and Device or other IDs (advertising ID, app set ID), shared with Google for Advertising or marketing, Analytics, and Fraud prevention |
The first row is optional Analytics data; the second row is required purchase-security data; the third row is rewarded-advertising data processed by the Google Mobile Ads SDK. All are encrypted in transit. The Analytics and purchase-security categories are described as not linked to identity only while the technical and account safeguards in this Policy remain true. Google's SDK declares the advertising categories as linked to the user, so Apple lists them as Data Linked to You. Gleaner has no crash reporter of its own; the crash and performance diagnostics in the third row are collected by Google's ads SDK.
Apple or Google processes payment under its own terms. The app receives the purchase result and entitlement status needed to unlock Pro, but not your card details. If Analytics is enabled, the product, price, and currency may also be included in the optional purchase event described above.
If you email us, we process your address, message, attachments, and normal email metadata to answer you and, where needed, establish or defend legal claims.
The site is static and has no advertising or analytics tracker. Firebase Hosting may process IP address and request metadata in necessary server or CDN logs to deliver and secure the site.
Withdrawal of consent does not affect processing that was lawful before withdrawal.
Gleaner's local models group similar photos and suggest a quality score. They do not generate media or make decisions with legal or similarly significant effects. You review every suggestion and decide what to keep or delete. Photo content is not sent to Gleaner or a third-party AI service and is never used to train or fine-tune models. Optional coarse Analytics may inform product and model evaluation, but contains no gallery photo or file data.
Analytics is off by default in every country on iOS and Android. Firebase collection is disabled before a valid opt-in. In the EEA, the UK, and Switzerland, the only message at first launch is Google's UMP consent message for advertising (Section 1.D). It never switches Analytics on; there, Analytics stays off unless you turn on the Settings switch below. Elsewhere, Gleaner asks once, at first launch after photo access, in its own prompt: it names Firebase, describes the categories and purpose, and provides Allow and No thanks as buttons of the same size, one tap each. Closing or declining does not enable Analytics and does not limit any app or paid feature. An answer you already gave in Gleaner's own prompt stays in force; no answer to Google's message changes it.
You can withdraw or grant consent in Settings → Help improve the AI. Withdrawal disables future collection after the setting is applied; it does not automatically erase data already received by Google. The advertising consent types in Firebase Analytics stay denied because Analytics has no ads features; AdMob reads your ad choice from the UMP message instead, and you can change it in Settings → Ad privacy options. A materially changed purpose or data use requires a new choice.
We do not sell data and do not provide it to data brokers. Advertising is limited to the rewarded AdMob format described in Section 1.D, and its personalization follows your UMP consent. We may disclose information where law strictly requires it or where needed to protect legal rights and safety.
Google and other recipients may handle data outside the EEA, including in the United States. Depending on the recipient and transfer, safeguards may include an applicable adequacy decision, the EU Standard Contractual Clauses, and supplementary measures. For rewarded ads, Google Ireland Limited may transfer data to Google LLC in the United States under the EU-US Data Privacy Framework adequacy decision, with the EU Standard Contractual Clauses as fallback. See Firebase privacy and security information and Google's Privacy Policy. You may request information or a copy of applicable transfer safeguards by emailing us; legally protected content may be redacted.
GA4 user-level and event-level data is configured for a 2-month retention period, with reset on new activity disabled. Google applies expiration through a monthly deletion process, so deletion is not promised on exactly day 60. Standard aggregate reports may remain longer because the user-level or event-level record is no longer separately available there.
Turning Analytics off stops future collection, not prior processing. Support messages are kept while needed to answer the request and for applicable legal limitation or retention periods. Purchase records have no automatic end date yet; we keep them while the purchase can still renew, be refunded, or be charged back, and for the regular limitation period afterwards, and delete older records at least once a year. Hosting logs are retained as needed for site security and operation. We retain no photo data because it is never sent to us. Google's retention-control explanation is available here.
For rewarded ads, Gleaner stores only the local entries described in Section 11 and receives no ad data. Google states that it anonymizes advertising server logs by removing part of the IP address after 9 months and cookie and identifier information after 18 months; see Google's retention information.
Analytics is encrypted in transit. Collection is consent gated, app-defined parameters are allow-listed and bucketed, access is restricted, and gallery content remains on the device. No system is completely secure. Report a concern to kabok.company@gmail.com.
Subject to applicable conditions, you may request access, rectification, erasure, restriction, objection, and data portability, and may withdraw consent at any time. Analytics is not associated by Gleaner with an account or direct identity. We may be unable to locate a specific pseudonymous Analytics record from the information you provide, but will act where data can reasonably be identified and the request verified.
Right to object (Article 21 GDPR). Where we process data on the basis of legitimate interests (Article 6(1)(f) GDPR), namely for purchase fraud prevention, the consent check at launch, limited ads you chose to watch, support, site security, and legal claims, you may object at any time on grounds relating to your particular situation. Send the objection to kabok.company@gmail.com.
Depending on where you live, additional rights may apply. Gleaner does not sell personal information for money. Some US state laws treat the use of an advertising identifier for personalized ads as a sale or as sharing; you can opt out by resetting or deleting the advertising ID on Android or, where the app shows it, in Settings → Do Not Sell or Share My Personal Information, which opens Google's opt-out message. Gleaner does not discriminate against you for exercising a privacy right. Personalized advertising follows your UMP consent choice only in the EEA, the UK, and Switzerland; elsewhere, Google may personalize ads on Android using the advertising ID unless you limit it in your device settings, and on iOS the IDFA is never used because Gleaner never requests tracking permission. Send requests to kabok.company@gmail.com.
You may complain to a competent supervisory authority. A competent supervisory authority for the controller in Hessen is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Postfach 31 63, 65021 Wiesbaden, Germany · datenschutz.hessen.de
Gleaner is not designed for children. If a child has provided support data or used the app in a way that concerns you, contact us. Applicable parental-consent and child-protection rules remain unaffected.
The site sets no advertising or analytics cookies and runs no third-party tracker. Necessary server or CDN technology may be used to deliver it securely. The app uses the Google AdMob SDK only for the rewarded ads described in Section 1.D. On iOS and Android, Firebase App Check and Functions are required for purchase security; Analytics remains optional and disabled until consent. macOS does not initialize Firebase.
What the app stores on your device. Only on your device, the app stores your Analytics choice; whether onboarding is complete; the number of free cleanups used, ad credits, the number of completed ads, and the times of ads completed in the last 24 hours; whether the one-time Pro offer was shown; your reminder setting; the group count and reclaimable space of your last scan; a counter that decides when to ask for a store rating; a cache of the similarity data and quality scores computed for your photos, so that later scans are faster (on macOS, also temporary thumbnails of the selected folder); a random installation identifier and the signed purchase answer (Section 1.B); and, in the free version, Google's record of your advertising choice (Section 1.D). These entries are strictly necessary for the functions you use (Section 25(2) No. 2 TDDDG); Analytics identifiers are stored only with your consent. On iPhone, the cleanup count, ad credits and times, the Pro offer marker, the reminder setting, the last-scan summary, the installation identifier, and the purchase answer are kept in the iOS Keychain, which iOS can keep after the app is deleted. None of these entries contains photos or your name, and none is sent to us, except the installation identifier during a purchase check.
The site does not engage in targeted advertising or sale or cross-context sharing for a browser signal to stop. Legacy Do Not Track has no common standard. Where a legally binding browser signal applies to a future site activity, we will honour it as required.
Gleaner has no account to delete. You can clear local app data through your operating system and uninstall the app. On iPhone, the Keychain entries listed in Section 11 can remain after the app is deleted; they contain no photos and no name. Disable Analytics in Settings to stop future collection. You may also email a deletion request, although a specific pseudonymous record may not be identifiable without a direct identifier. Ask us to delete support data; statutory retention duties may require limited retention.
The app never sends us your photos. iOS and Android 11 or later use the operating system's Recently Deleted or Trash recovery path. Android 8 through 10 and macOS folder cleanup can delete permanently after an explicit warning.
We may update this Policy and will change the effective date. We will provide notice and request a new Analytics choice where a material change requires it.
15 September 2026: this version adds optional rewarded advertising for the free tier (Section 1.D) and the related recipient, transfer, retention, and store-category information.
21 September 2026: the ad offer moved from the purchase screen to a separate Unlock more cleanups sheet, and one completed ad now unlocks three group cleanups instead of one (Section 1.D).
25 September 2026: this version clarifies that personalized advertising follows your UMP consent choice only in the EEA, the UK, and Switzerland (Section 1.D and Section 9).
28 September 2026: the consent ask moved to first launch. In the EEA, the UK, and Switzerland, Google's UMP message is now the single consent pop-up for advertising and Analytics (Sections 1.D and 4); elsewhere the Analytics prompt is unchanged.
28 September 2026: an in-house legal review added detail on limited ads and their legal basis, the background ad preload, the UMP consent check at every launch and the stored TC string, purchase checks at every launch and on resume, purchase-record retention, the approximate region Firebase may derive, and which consent-message answers turn Analytics on (Sections 1.B, 1.C, 1.D, 2, 4, 7, and 9).
2 October 2026: this version lists what the app stores on your device, including the entries the iOS Keychain can keep after the app is deleted (Sections 11 and 13), names Google (Gmail) as our email provider (Section 5), states the right to object separately (Section 9), and requests an ad in the background only after consent to device storage where a consent message applies (Section 1.D). Google's consent message now concerns advertising only: in the EEA, the UK, and Switzerland, Analytics stays off until you turn it on in Settings (Section 4). In the United States, the Settings row for Google's opt-out message is called Do Not Sell or Share My Personal Information (Section 9).
6 October 2026: the app may also request an ad in the background when you use Auto-select while some groups stay locked (Section 1.D).
Controller: Seyedmohammad Farrahi,
Einzelunternehmer
Email:
kabok.company@gmail.com
Postal and provider details: Impressum
| Data | Purpose and basis | Recipient |
|---|---|---|
| Photos and gallery content | Local cleanup; contract | None; stays on device |
| Installation attestation and store purchase proof | Provide Pro and prevent fraud; contract or legitimate interest | Google Firebase, Apple or Google Play |
| Optional mobile Analytics categories listed in Section 1 | Product, reliability, algorithm and model evaluation; consent | Google Firebase |
| Advertising identifiers (Android advertising ID and app set ID; iOS IDFV or app-bound identifiers, never the IDFA), IP address, ad interactions, crash and performance diagnostics | Optional rewarded ads for non-Pro users, frequency capping, fraud prevention, aggregated reporting; consent via Google's UMP message | Google AdMob (Google Ireland Limited, independent controller) |
| Purchase result and entitlement | Provide Pro; contract | Apple or Google processes the store transaction |
| Support communication | Respond and handle claims; contract or legitimate interest | Google (Gmail) |
| Site request metadata | Deliver and secure the site; legitimate interest | Firebase Hosting |
| Consent-message check and your advertising consent record (TC string) | Ask for consent where required and prove it; legitimate interest and legal obligation | Google (UMP); the record stays on your device |
| Local app entries (Analytics choice, cleanup counter, ad credits and times, installation identifier, signed purchase answer) | Provide the free version, Pro, and your choices; strictly necessary (Section 25(2) No. 2 TDDDG) | None; they stay on your device (the installation identifier is sent during purchase checks) |