Effective date: [ 2026/8/16]
Photo Steward (the “App”) is built around on-device processing and user choice. This Privacy Policy explains how the App accesses, uses, stores, and deletes information and how you can manage permissions.
## 1. Scope
This Policy applies to Safe Cleaner for iOS. It does not govern Apple, your photo, contact, or calendar account providers, or third-party apps and websites you choose to use. Those parties process information under their own policies.
The App does not require you to create an account or provide your name, phone number, or email address to use its main features.
## 2. Summary of Our Data Practices
- Photos, videos, contact contents, calendar contents, recordings, files stored in Private Space, PIN data, and media-analysis results are processed primarily on your device. We do not upload these materials to our servers for content analysis.
- The App uses analytics, attribution, remote-configuration, and purchase technologies. These services may collect device or installation identifiers, app interactions, subscription information, and diagnostic information.
- The advertising identifier (IDFA) is accessed only if you authorize tracking through Apple’s App Tracking Transparency prompt. If you decline, the IDFA is not sent, although limited product analytics and privacy-preserving attribution may continue.
- We do not sell your photos, videos, contacts, calendar entries, recordings, or Private Space contents, and we do not use them to train advertising or generative-AI models.
## 3. Information Processed on Your Device
### 3.1 Photos and Videos
With your permission, the App accesses items and metadata available through Apple Photos, including media type, size, dimensions, duration, capture date, album membership, favorite status, and location metadata already attached to an item. The App uses this information to provide features such as Smart Clean, duplicate and similar photo or video review, screenshots, screen recordings, large videos, media browsing, people and place organization, and storage insights.
Photo and video comparison and grouping are performed on the device. Face-related processing, where available, is used to cluster visually similar faces and does not establish a person’s real-world identity. Face features and labels are not uploaded to us.
The App does not delete media automatically. You choose the items and confirm deletion through iOS. Deleted items are handled under Apple Photos’ Recently Deleted behavior. The App does not empty Recently Deleted for you.
If a photo contains location coordinates and you use a place-related feature, Apple’s system geocoding service may process the coordinates to return a place name. We do not receive the coordinates through our own server.
### 3.2 Contacts
The App requests Contacts access only when you open a contact-related feature or choose to import or restore a contact. Contact data may be processed on the device to identify possible duplicates or incomplete contacts, preview records, merge selected records, delete a selected record, create a local backup record, or restore a record. Changes occur only after your action or confirmation.
Contact contents and local contact backups are not uploaded to us. Contacts written to the system address book may be synchronized by Apple or an account provider according to your device and account settings.
### 3.3 Calendars
The App requests Calendar access only when you open Calendar Cleanup. It processes calendar events on the device to find older events and present them for review. Events are removed only after you select and confirm the action. Calendar data may be synchronized by Apple or your calendar provider under your account settings; we do not upload event contents to our servers.
### 3.4 Microphone and Recordings
The App requests microphone access only when you choose to record audio. Recordings are created and stored locally. Private recordings are protected using local encryption and iOS Keychain-protected keys. The App does not secretly record audio or upload the audio to us.
### 3.5 Private Space, Files, and PIN
You may import selected photos, videos, files, contacts, or recordings into Private Space. Private Space contents are encrypted locally using Apple CryptoKit and keys protected by the iOS Keychain. Your six-digit PIN, PIN-verification data, and decryption keys are not transmitted to us. We cannot read your Private Space, recover a forgotten PIN, or decrypt your files for you.
When you export or save an item outside Private Space, the selected copy is decrypted and handed to the system destination or third-party app you choose. The exported copy is no longer protected by Private Space.
### 3.6 Local Settings and Storage Information
The App may store permission states, onboarding status, feature preferences, local analysis indexes, PIN settings, and subscription-entitlement status on your device. It reads available storage and media sizes to display storage information and cleanup estimates. These estimates are informational and do not guarantee a particular amount of recoverable storage.
## 4. Information Collected by Us and Our Service Providers
### 4.1 Device and Installation Identifiers
The App creates and stores an installation-specific identifier. Depending on configuration, consent, and platform availability, the App or its providers may also process the identifier for vendor (IDFV), AppsFlyer ID, app account token used with StoreKit, IP address, and IDFA. IDFA is included only when Apple’s tracking permission is authorized.
The App sends the bundle identifier, installation identifier, AppsFlyer ID, IDFV, and, when authorized, IDFA to our secure attribution endpoint. We use this information to associate installations, paywall interactions, and attribution information; support subscription functionality; measure campaign performance; detect errors or abuse; and maintain consistent analytics identifiers.
### 4.2 Product Interaction and Analytics Data
The App may collect events such as:
- app launch, page views, and feature entry;
- permission type and permission status;
- paywall display and purchase-button interactions;
- which subscription products are displayed;
- subscription purchase success, failure category, or restoration status; and
- rating-prompt position and similar product-performance events.
These events are associated with an installation identifier. We do not intentionally include photo contents, filenames, contact contents, calendar-event contents, recording contents, Private Space contents, or your PIN in analytics events.
### 4.3 Purchase Information
Purchases are processed by Apple through StoreKit. We and our analytics providers may receive or record the product identifier, subscription plan, localized price, currency, transaction or order identifier, purchase result, trial eligibility or status, and an app account token. We do not receive your full payment-card number or Apple Account password.
### 4.4 Diagnostics
The App or its analytics providers may collect crash information, error events, app version, iOS version, device model, language, time zone, network state, timestamps, and technical performance data. We use this information to diagnose failures, improve stability, and protect the App.
### 4.5 Remote Configuration
Firebase Remote Config is used to deliver subscription-product configuration and related app settings. Google may process a Firebase installation identifier and standard technical request information to provide this service. Remote Configuration is not used to upload your photos, videos, contacts, calendars, recordings, or Private Space contents.
### 4.6 Support Communications
If you contact us, we receive the email address, message, and attachments you choose to provide. We use this information to answer the request, troubleshoot, enforce our terms, and improve support. Please do not send unnecessary sensitive content.
## 5. Purposes and Legal Bases
We process information as necessary to:
- provide requested App functionality and purchases;
- maintain and improve performance, reliability, usability, and security;
- understand feature use and subscription performance;
- measure installations and advertising attribution;
- prevent fraud, abuse, and technical failures;
- respond to support and privacy requests; and
- comply with legal obligations and resolve disputes.
Where applicable law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in operating and improving the App, compliance with law, and consent. We rely on consent for IDFA access and cross-app tracking where Apple policy or applicable law requires it. You may withdraw consent prospectively, but withdrawal does not affect processing already lawfully completed.
## 6. App Tracking Transparency and Your Choices
When the App presents Apple’s App Tracking Transparency prompt, you can choose whether to allow tracking. If you choose **Ask App Not to Track**, the App does not access or send IDFA. You may change this choice in **iOS Settings > Privacy & Security > Tracking**.
Declining tracking does not disable the App’s main cleanup features. It may not stop limited analytics, subscription processing, fraud prevention, or privacy-preserving attribution that does not use IDFA or track you across other companies’ apps and websites.
You may change Photos, Contacts, Calendars, and Microphone permissions at any time in iOS Settings. Revoking permission limits only the features that need that permission and does not reverse changes already made to Photos, Contacts, or Calendars.
## 7. Service Providers and Disclosure
We disclose information only as described in this Policy:
- **Apple:** App distribution, permissions, Photos, Contacts, Calendars, system geocoding, StoreKit purchases, subscription management, refunds, and platform security. See [Apple’s Privacy Policy](https://www.apple.com/legal/privacy/).
- **ThinkingData:** product analytics and diagnostic events. See [ThinkingData’s Privacy Policy](https://docs.thinkingdata.io/ta-manual/latest/en/user_guide/privacy_policy.html).
- **AppsFlyer:** install attribution and marketing measurement. AppsFlyer may process technical information, device identifiers, IP address, campaign engagement, and selected in-app events. See [AppsFlyer’s Services Privacy Policy](https://www.appsflyer.com/legal/services-privacy-policy/).
- **Google Firebase:** remote configuration and related technical services. See [Google’s Privacy Policy](https://policies.google.com/privacy).
- **Hosting and infrastructure providers:** secure delivery of the attribution endpoint and operational services under contractual confidentiality and security obligations.
Depending on our attribution configuration and your consent, identifiers and campaign or purchase events may be processed by AppsFlyer and relevant advertising or measurement partners. We require service providers that process personal data for us to use appropriate safeguards and protections consistent with this Policy and applicable law.
We may also disclose information when required by law, to protect users or the App, to investigate fraud or security incidents, or as part of a merger, financing, reorganization, or transfer of the App, subject to appropriate notice and safeguards.
We do not sell personal information for money. We do not disclose photos, videos, contacts, calendar-event contents, recordings, Private Space contents, or PIN data to advertising partners. Certain attribution disclosures may be considered “sharing” or “targeted advertising” under some U.S. state laws; you can opt out through Apple’s tracking control and by contacting us.
## 8. Retention and Deletion
On-device data remains until you remove the relevant item or setting, use an available deletion function, or uninstall the App, subject to iOS Keychain and system-backup behavior. Photos, Contacts, and Calendars are retained under the rules of Apple and the account providers you configured.
We retain online analytics, attribution identifiers, diagnostic information, and purchase-event records only for as long as reasonably necessary for the purposes described above, including analytics, subscription support, fraud prevention, security, dispute resolution, and legal compliance. We then delete or de-identify the information. AppsFlyer states that it ordinarily retains end-user data for no more than 24 months unless otherwise directed or permitted by law. Provider-specific retention may apply under their policies and our service settings.
Support correspondence is retained while we handle the request and for a reasonable period afterward for security, dispute-resolution, and legal purposes. Purchase records may be retained longer where required for accounting, tax, fraud-prevention, or legal obligations.
To request access, correction, deletion, restriction, portability, withdrawal of consent, or objection regarding information we control, email **support@aiphotosteward.com**. Because the App has no user account, we may need information reasonably necessary to locate and verify the relevant installation or support record. We may be unable to identify or delete records that have already been aggregated or de-identified. Deleting online data does not delete local content from your device; local items must be removed in the App or relevant Apple app.
## 9. International Transfers
Our providers may process information in countries other than where you live. Where required, we use contractual and legal safeguards for international transfers, such as standard contractual clauses or another approved transfer mechanism. Local content described in Section 3 is not transferred to us merely because you use the associated on-device feature.
## 10. Security
We use administrative, technical, and organizational safeguards appropriate to the nature of the information. These include HTTPS for network communications, on-device encryption for Private Space, iOS Keychain protection for keys and PIN-verification data, system permissions, and access controls. No method of storage or transmission is completely secure. Protect your device passcode and App PIN, keep iOS updated, and review items before deletion or export.
## 11. Children’s Privacy
Safe Cleaner is not directed to children under 13 or the minimum age required by local law. We do not knowingly request a child’s name or contact information. If you believe a child provided personal information to us, contact us so we can review and delete it where required. A minor should use the App only with permission and guidance from a parent or legal guardian.
## 12. Regional Privacy Rights
Depending on where you live, you may have rights to know, access, correct, delete, restrict, or obtain a copy of personal data; object to certain processing; withdraw consent; opt out of sale, sharing, targeted advertising, or profiling; and appeal a denied request. You may also lodge a complaint with your local data-protection authority.
We will not discriminate against you for exercising a privacy right. Authorized agents may submit requests where permitted by law, subject to verification of their authority and your identity.
## 13. Changes to This Policy
We may update this Policy when features, providers, data practices, or legal requirements change. We will post the updated effective date and provide additional notice when required. Material changes apply prospectively unless law permits otherwise.
## 14. Contact Us
For privacy questions, withdrawal of consent, support, or requests relating to data we actually hold, contact:
- Email: support@aiphotosteward.com
Because most content remains only on your device, we generally cannot access or restore it from a server.