App Privacy Policy

Pelusa is an app for calmly tidying up your photo gallery on iPhone and Android. This policy explains what data the app has, what of it leaves your phone, and what stays only with you. The pelusa.app website has its own Privacy Policy.

1. Who is responsible for the data

The controller is OSV Labs, the trading name of ORLOV, SERGEI (Sergei Orlov), an independent entrepreneur (monotributista).
Avenida Santa Fe 3681, Piso 16, Departamento G, C1425BGL, Ciudad Autonoma de Buenos Aires, Argentina
Email: contact@orlovs.dev

Full operator details are on the contact page. Below, “we” means OSV Labs, the developer of Pelusa.

2. What stays on your phone only

Everything you work with in the app is stored on your device and is never sent to us:

• the photos themselves and their thumbnails;
• internal references to photos in the gallery (identifiers and file addresses inside the phone) and a cache of file sizes;
• the stack, the containers, Pelusa’s trash history and deletion statistics;
• settings (sound, vibration, feed and others) and whether your phone has a system trash;
• session counters (how many drops, deletions and undos), kept in memory and reset;
• “first time did X” marks, install time, session count, the last time the app went to the background, the type of photo access at the previous launch and the exact library size. Only coarse ranges of these ever leave the phone, as described in section 5;
• whether you are in a region where collection is off until you turn it on (section 4);
• when the app last offered to rate it, so it doesn’t ask too often;
• a copy of your supporter status and of the purchase state, so the badge shows right away, even offline;
• reminders: the chosen days and time, when the app was last opened and how many reminders arrived since. Reminders are scheduled by the phone itself as local notifications, with no server of ours and no push service. Their text is put together on the phone.

On Android this data is not included in cloud backups and is not transferred to a new phone. On iPhone it may be included in your iCloud backup along with other apps’ data; the photos and thumbnails themselves are not. If you uninstall Pelusa, this data is deleted with the app. The photos in your gallery stay where they are.

On Android, Pelusa’s window is protected from screenshots and hides its content in the recent apps list, so your photos don’t accidentally end up in a screenshot or a screen recording.

3. Photo access and deletion

Pelusa asks for access to your photos to show them as a feed. On Android 14+ and iPhone you can grant access to selected photos only, and the app will work with those.

Pelusa never deletes photos on its own. When you delete photos from a container, the app asks the system to delete them, and the system shows its own confirmation dialog. Only after you agree do the photos go:

• on Android, to the system trash, where they can usually be restored for about 30 days, including right from Pelusa. Some Android phones have no trash, and photos are deleted right away and permanently. Pelusa can only find this out after the first deletion and then says so on the results screen;
• on iPhone, to Recently Deleted in the Photos app, where they are kept for 30 days. If iCloud Photos is on, the photo is also removed from your other devices and from iCloud. That’s standard iPhone behavior.

When that period ends, the system deletes the photos for good.

4. When collection is on

Crash reports and usage statistics are controlled by the “Help make Pelusa better” switch in Settings.

• In the EU, the EEA, the UK, Switzerland, Canada and South Korea, it is off until you turn it on. The same switch appears on the privacy step of onboarding, off by default. Until you turn it on, nothing is sent to Firebase. On iPhone, Firebase isn’t even started.
• In all other countries, it is on from the first launch, and data starts being sent during onboarding. You can turn it off at any time.

Pelusa works out the country from the phone itself. On Android, it checks the SIM card country, the mobile network country and the region of the phone’s language setting. On iPhone, it checks the region in Settings and your App Store country. If any of these points to the EU (including its outermost regions, such as the Canary Islands or Réunion), the EEA, the UK, Switzerland, Canada, South Korea, Saint Pierre and Miquelon or Saint Barthélemy, or if the country can’t be determined, the switch starts off. Once Pelusa has seen such a country, it remembers this, and the switch stays off by default even if you later travel or change the SIM card. Your own choice of the switch always takes priority.

5. What we collect

While the switch is on, the app sends the following through Firebase services:

1. Crash reports. The error type, where in the code it happened (stack trace) and the error message. Messages that Pelusa writes itself are cleaned before sending: addresses, paths, file names, identifiers and numbers of 4 or more digits are removed. If a system error message contains such data, Pelusa replaces it. Firebase adds the device model, the system and Pelusa versions, free memory and storage, and the time of the crash.
2. Launch time, as a coarse range (for example, “1 to 2 seconds”).
3. Feature usage.
   • Screens. Which screens are opened, without container numbers or names.
   • Feed and containers. How photo selection started (tap, long press or swipe across the feed); dropping a stack into a container (stack size as a range, the container’s material, how long the stack took to gather); undoing a drop and how soon; how a selection was cleared; returning photos to the feed; opening a photo full screen; “hide”; changes to the feed layout; adding and removing a container and its material; marking photos to keep and “Keep all” (on or off); how leaving a container ended.
   • Deletion and trash. The start of a deletion (how many photos and how many kept, as ranges); its outcome (done, declined in the system dialog, or failed); a failed photo operation (which operation and one of three error classes, without the error text); restoring and deleting from Pelusa’s trash, confirmed or declined; where the trash was opened from; items of the app icon menu.
   • Getting started. Onboarding steps and how long they took; the type of photo access granted and whether it changed later.
   • Sound and reminders. Answers on the “Sound” and “Reminders” steps and whether the silent mode hint was shown; opening the app from a reminder and a reminder being shown, without days, times or reminder text.
   • Hints and settings. Hints shown, dismissed, learned or reset; which setting was changed and to what. Changing the “Help make Pelusa better” switch itself is not sent.
   • Support and rating. Opening the support screen and which of the five amount buttons was tapped; tapping the line that invites you to rate the app; the app asking the system to show its rating window, and on which screen. Whether the window actually appeared and what rating you gave are not known to the app and are not sent.
   • Mini-game. Opening the game and where from; a round starting (which round of the visit, whether it continues after a pause), a pause and a round ending (score, duration, number of jumps and share of long ones, as ranges; whether the best score was beaten; which container Pelusa fell from; the speed level); the invitation to tidy up photos under the “Again” button being shown and tapped; leaving the game (number of rounds and best score as ranges, and how you left).
   • Session summary. When the app goes to the background: duration, and the number of drops, deletions, photo views and undos, as ranges.
   • First steps. The first selection, drop, deletion and restore: once per install, with how long since install and which session it was, as ranges, without dates or time of day.

   Every event uses only fixed labels and ranges from a closed list built into the app. Numbers are only ever coarse ranges: photo count, stack size, storage volume, time. Which photos they are is never sent.

4. Sound and settings state, as device properties attached to events: ringer mode (not available to apps on iPhone); media volume in four steps; audio output type (speaker, wired headphones, bluetooth, other), without device names; whether Pelusa’s sounds can be heard (yes, no, maybe); whether sound, vibration, reduced motion and reminders are on in Pelusa, and whether notifications are denied in the system; the type of photo access; feed settings; library size as one of five coarse ranges (up to 100 photos, 1,000, 5,000, 20,000, more); the best game score as a range. This helps us understand whether sounds are audible and tune speed for different libraries. These values are sent when they change and again when you turn the switch back on.
5. Events that Firebase records automatically, such as first open, session start, engagement time, app update, system update, app data cleared and app removal.
6. Service identifiers. Random installation IDs created by Firebase to tell one installation from another. They are not linked to your name, email or account.
7. General environment. Device language and country. Google may determine the country from the IP address; the IP address itself is not passed to us.

6. What we don’t collect

• photos, their thumbnails or content;
• file names, paths, albums, photo metadata (EXIF), geotags;
• your name, email, phone number, contacts;
• precise location;
• the device advertising ID (the app doesn’t have permission to read it on Android and doesn’t request it on iPhone);
• exact sizes, counts, dates and time of day, only the coarse ranges described above;
• album names, names of connected headphones and speakers, Do Not Disturb status;
• text you type, or details of photo errors, only the error class;
• the rating you give in the store;
• through Firebase, the outcome of a support purchase: only the amount button that was tapped.

Pelusa has no ads and no accounts, and it doesn’t track you across other companies’ apps or websites.

7. Firebase (Google)

Crash reports and usage statistics are processed by Firebase, a service of Google LLC (Firebase Crashlytics and Google Analytics for Firebase). Google processes this data on our behalf under its data processing terms. In the app, advertising storage and ad user data are denied, and on iPhone the vendor identifier is not collected. In the service settings we have turned off Google signals, ad personalization, granular location data and links to advertising products.

More: firebase.google.com/support/privacy and policies.google.com/privacy.

8. “Support the author” purchases

Pelusa is free. Support purchases are voluntary. Payment is processed by the store, Google Play on Android or the App Store on iPhone, under its own privacy policy. We never see your card number or other payment details. From the store we receive order details (order number, item, price, date, country or region), which we need for accounting and taxes.

RevenueCat. Purchases are verified and recorded by RevenueCat, Inc. (USA) on our behalf. It receives:

• support purchase history: which item, when, price and currency, and the store transaction data needed to verify the purchase;
• a random Customer ID (like $RCAnonymousID:…). It isn’t linked to your name, email or account. On Android a new one appears after reinstalling; on iPhone the same one may come back if you restore the phone from an iCloud backup;
• store country, language and currency, app and system versions; the IP address is visible to its server when connecting, as with any website.

RevenueCat does not receive advertising IDs, contacts, photos or usage events. We don’t send it any other attributes, and its diagnostics are turned off. The “Pelusa supporter” status is stored by RevenueCat and the store.

When the app contacts RevenueCat: when you open the “Support the author” screen, buy something or tap “Restore purchases”. At launch, only if you have already supported (at most once a day) or a purchase is pending. If you have never bought anything or opened the support screen, the app does not contact RevenueCat.

Deleting purchase data. At the bottom of the support screen there is a “Customer ID” line. Tap it to copy the ID and send it to us. We will delete the purchase data for that ID at RevenueCat. Order records held by the store, and records we must keep for accounting and taxes, are kept as long as the law requires.

RevenueCat’s policy: revenuecat.com/privacy

9. Store services in the app

• Google Play (Android). Purchases go through the Google Play Billing library, and the rating window is shown by the Google Play In-App Review library. These libraries send Google technical information about their own operation. Google does this under its own privacy policy, the switch in Pelusa doesn’t affect it, and as far as we know this information is not passed to us.
• App Store (iPhone). Purchases and the rating window go through Apple’s StoreKit, under Apple’s privacy policy. Pelusa asks StoreKit for your App Store country (see section 4).

The rating window belongs to the store. Your rating and review go directly to Google or Apple, and the store doesn’t tell the app whether you rated it. The line that invites you to rate the app opens Pelusa’s page in the store.

10. Why we need data and on what legal basis

• Crash reports and usage statistics, to find and fix bugs and crashes, and to understand which features are useful and which are confusing. Legal basis: in the EU, the EEA, the UK, Switzerland, Canada and South Korea, your consent (the switch turned on); in other countries, our legitimate interest in keeping the app working and improving it. You can withdraw consent or object at any time by turning the switch off.
• Purchases, to process your support purchase, give you the supporter status and restore it. Legal basis: performance of the contract with you.
• Order records, for accounting and taxes. Legal basis: our legal obligations.
• Emails you send us, to reply and handle your request. Legal basis: our legitimate interest in answering you, or steps you asked us to take. Mail to contact@orlovs.dev is forwarded by Cloudflare Email Routing to our mailbox on Gmail (Google).

We do not use this data for advertising, do not build profiles of people from it, and do not sell or share it, including as “selling” and “sharing” are defined in California law (CCPA/CPRA). Data is received only by the providers named in this policy, acting for us, and by authorities where the law explicitly requires it. We don’t make decisions about you based solely on automated processing.

11. How long data is kept

• Detailed usage events: 2 months. Google deletes expired events automatically about once a month, so in practice they are kept for 2 to 3 months. Aggregated reports without data about a particular person may be kept longer.
• Crash reports: 90 days, after which they are deleted automatically.
• Purchase data at RevenueCat: while the supporter status needs to be checked and restored, until you ask us to delete it.
• Order records for accounting and taxes: as long as tax law requires.
• Emails: as long as needed to handle your request.
• Data on your phone: until you uninstall Pelusa or clear its data.

12. How to turn collection off

Open Settings and turn off “Help make Pelusa better”. From then on the app stops sending crash reports and statistics to Firebase. Firebase’s local data on the phone is reset, including its installation ID, and unsent crash reports and queued events are deleted. Pelusa’s own marks from section 2 stay on the phone and are not sent. You can turn the switch back on in the same place.

The switch does not affect support purchases or the store services in section 9: purchases don’t work without that data.

Data sent before you turned it off is deleted automatically on the schedule above; you don’t need to do anything. It isn’t linked to your name or email, and turning the switch off also resets the installation ID on your phone, so neither you nor we can find your specific records in Firebase or delete them sooner on request.

13. International transfers

Google (Firebase and Gmail), Cloudflare (email forwarding), RevenueCat and the stores may process data outside your country, including in the USA. For transfers from the EU, the EEA, the UK and Switzerland, Google and Cloudflare rely on the EU-US Data Privacy Framework and its UK and Swiss extensions, and on Standard Contractual Clauses; RevenueCat relies on Standard Contractual Clauses in its data processing agreement. For transfers from Argentina, these providers rely on contractual safeguards.

14. Security

Data is sent to Firebase and RevenueCat only over an encrypted connection (HTTPS). Only the developer has access to their consoles.

15. Your rights

Depending on where you live, you may ask us to tell you what data about you we hold, to give you a copy, to correct or delete it, to restrict its processing or to object to it, and you may withdraw consent at any time (turning the switch off is enough). To do so, write to contact@orlovs.dev. For purchase data, include your Customer ID from the support screen. We reply within the time limits set by law: within one month under the GDPR and within 10 days for an access request under Argentine law.

Pelusa has no accounts, so there is no account to delete. Statistics are removed by turning the switch off and on the schedule above, purchase data is deleted on request, and everything else is deleted when you uninstall the app.

You may also complain to a data protection authority: in Argentina, the Agency for Access to Public Information (AAIP); in the EU or the EEA, the authority of your country; in the UK, the Information Commissioner’s Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

Argentine Law 25.326 on the protection of personal data applies to this processing, and for users in the EU, the EEA, the UK and Switzerland, the GDPR, the UK GDPR and the Swiss FADP apply as well. Under Law 25.326, you may access your personal data free of charge at intervals of no less than six months, unless you show a legitimate interest in doing so sooner (article 14, paragraph 3). The AAIP, as the supervisory authority under Law 25.326, handles complaints from anyone whose rights under the personal data protection rules have been breached.

16. Children

Pelusa is not intended for anyone under 16 and does not knowingly collect their data. If you believe a child used the app with collection on, write to us and we will help delete the data.

17. Changes to this policy

If this policy changes, we will publish the new version on this page and update the “Last updated” date at the top. We will tell you about significant changes in the app or in the update notes. If a change needs your consent, we will ask for it again.

18. Language versions

This policy is published in English and Spanish. Both versions say the same thing and are equally valid. If they ever differ, the meaning that is more favorable to you applies.

19. Contact

OSV Labs (ORLOV, SERGEI), Buenos Aires, Argentina
Email: contact@orlovs.dev