Privacy Policy

uncover is an iPhone app that finds the photos your friends have never seen. It is built so that your photos, and the faces in them, never leave your phone. This policy explains what that means, which small amount of technical data does leave your device, why it does, and what your rights are. It covers the uncover app for iOS and the website getuncover.app.

In short

• Your photos, the faces found in them and your contacts are processed only on your iPhone. We never receive them.
• There are no accounts. We never ask for your name, email address or phone number.
• The app sends pseudonymous technical data: crash reports, error diagnostics, overall usage statistics and, for uncover Pro, the status of your purchase. None of it contains your photos, your contacts or the names you give people.
• We show no ads and don't use the advertising identifier (IDFA). We don't track you across other companies' apps or websites, and we never sell data.
• We make no automated decisions about you within the meaning of Art. 22 GDPR, and we don't build profiles of you.

Who is responsible

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:

Fabian Geistert
Adalbert-Stifter-Str. 11
1200 Vienna, Austria
Email:

We are not required to appoint a data protection officer. Please send any privacy question or request to the address above.

What stays on your device

uncover's core runs entirely on your iPhone. It uses machine-learning models that ship inside the app, and it works with the network switched off. The following is processed only on your device and is never sent to us or to any of our service providers:

• Photos. With your permission, which can be full or limited access, uncover reads your photo library to find faces. No photo, thumbnail or photo metadata, such as location or date, is ever uploaded.
• Faces. For each face, uncover calculates a numerical representation (a face embedding) and stores it, together with where the face is in the photo, in a database on your device. It uses these to group photos of the same person. This data can count as biometric data under Art. 9 GDPR. It is created on your device, it stays there, and we have no access to it.
• Contacts. If you allow access to your contacts, uncover reads names, phone numbers and contact photos. It uses them to suggest names for the people it finds and to address photos when you send them. Contact photos are compared with faces on your device. uncover never uploads your contacts and never changes them.
• Your choices. The names you give people, cover photos, which photos you have already sent, and your settings.
• Notifications. uncover schedules its notifications locally on your device. No push token is sent to us.

uncover never changes or deletes anything in your photo library or your contacts. You can withdraw access to Photos, Contacts or Notifications in the iOS Settings app at any time. Deleting the app deletes its database, its cache and its settings. Because this data never exists anywhere else, nothing is left behind.

Your photos show your friends and family. uncover uses their faces only on your device, to help you share photos with them, which is a purely personal activity. Please respect their wishes about whether, and with whom, photos of them are shared.

Sending photos

Photos leave your device only when you send them yourself, through the iOS share sheet, to the people and through the app you choose, such as Messages. We are not involved in that transfer and receive nothing from it. The privacy terms of the app you send with apply to it. The message uncover prepares contains a link to getuncover.app/download (see Shared download links).

Data the app sends

The services below receive technical data from the app. It is pseudonymous: it is tied to random identifiers that are generated for each installation, never to your name, email address or phone number, and we cannot use it to find out who you are. Each section names the legal basis. Where that is our legitimate interest (Art. 6(1)(f) GDPR), the interest is keeping uncover stable and secure and understanding how the app is used as a whole, so that we can improve it.

Crash reports: Firebase Crashlytics

When the app crashes, Crashlytics sends a crash report. It contains the stack trace, the device model, the iOS and app version, free memory and disk space, the time of the crash, and a random Crashlytics installation identifier. We use it only to find and fix crashes. Provider: Google (see Recipients). Legal basis: Art. 6(1)(f) GDPR. Crash reports are deleted after 90 days.

Error and performance diagnostics: Sentry

Sentry receives errors that don't crash the app, and performance measurements, such as how long a photo scan took, for a sample of about one in five sessions. The data includes the device model, the iOS and app version, technical breadcrumbs of the last steps taken in the app (never the content you look at), and a random installation identifier. The app is configured not to send personal information, and Sentry is set not to store IP addresses. Provider: Functional Software, Inc. (Sentry). Our data is stored in Sentry's EU region in Frankfurt, Germany. Legal basis: Art. 6(1)(f) GDPR. Retention: up to 90 days.

Usage statistics: Google Analytics for Firebase

In builds from the App Store, Google Analytics for Firebase records how the app is used as a whole. It only collects what it measures by itself: the first launch, sessions, app updates and in-app purchases. uncover sends it no events of its own; those go to PostHog (see below). Versions of the app before 1.0.2 also sent Google Analytics the events now described under PostHog. Analytics records the device model, the iOS and app version, the language, and your approximate country or region. The events are tied to a random app-instance identifier. uncover does not collect the advertising identifier (IDFA) or the identifier for vendors (IDFV), and it has ad personalisation turned off. Analytics is not linked to Google advertising products. According to Google, Analytics uses your IP address only to derive your approximate location, and does not store it. We use these statistics to count how many people use uncover, never to identify anyone. Legal basis: Art. 6(1)(f) GDPR. Event data and the app-instance identifier are deleted after 14 months.

You can object to this at any time (Art. 21 GDPR) by writing to us. Because the app-instance identifier is random, deleting and reinstalling the app also resets it.

Usage statistics and error reports: PostHog

In builds from the App Store, uncover sends its usage statistics to PostHog. It receives events of uncover's own: which steps of the introduction are completed and which permissions are given, how many people and photos a scan found and how long it took, when photos are shared and through which kind of app (never to whom, and never the photos themselves), when people are starred or birthdays are added, when a notification is opened, when the Pro offer is shown, and whether a purchase was started, completed or cancelled. It also records settings such as whether notifications are allowed, whether contacts are used and whether Pro is active. PostHog also receives purchase and subscription events from RevenueCat (see Purchases below), when the app is installed, opened, updated and moved to the background, and which screens are viewed. When the app runs into an unexpected error, PostHog also receives an error report with the technical stack trace, and the app sends it a few technical log messages, such as that analytics has started. Each event carries the device model, the iOS and app version, the language, the time zone and the screen size. The events are tied to a random identifier that the app generates when it is first opened. PostHog does not store your IP address: it uses it only to derive your approximate location (country and city) and then discards it. uncover doesn't record your sessions on screen, doesn't collect taps automatically, and doesn't create a profile of you. We use PostHog to understand which parts of uncover are used, where people get stuck and which errors occur, never to identify anyone. Provider: PostHog, Inc. Our data is stored in PostHog's EU region in Frankfurt, Germany. Legal basis: Art. 6(1)(f) GDPR. Events are deleted after one year.

You can object to this at any time (Art. 21 GDPR) by writing to us. Deleting and reinstalling the app also resets the random identifier.

Remote configuration and app integrity: Firebase Remote Config and App Check

The app loads settings and feature switches from Firebase Remote Config. For this it sends a Firebase installation identifier, the app and iOS version, and the language and country setting of your device. Firebase App Check lets our server check that requests really come from an unmodified copy of uncover. For this, the app uses Apple's App Attest and DeviceCheck services, which confirm the app's integrity without telling us anything about you. Provider: Google, with Apple providing the attestation. Legal basis: Art. 6(1)(f) GDPR, in delivering the app's configuration and protecting our server from abuse. The installation identifier is kept for as long as the app is in use.

Purchases: RevenueCat

uncover can be used for free. uncover Pro is available as an in-app purchase, as a monthly or yearly subscription or as a one-time lifetime purchase. Apple handles the payment. We never see your payment details, your Apple ID, your name or your email address.

To know whether Pro is active on your device, the app uses RevenueCat. When the app starts, RevenueCat creates a random, anonymous user identifier. When you buy or restore a purchase, RevenueCat receives the transaction details from Apple: the product, the price and currency, the App Store country, purchase and expiry dates, and transaction identifiers. It also receives the device model, the iOS and app version, and the IP address the request comes from. Provider: RevenueCat, Inc. Legal basis: Art. 6(1)(b) GDPR, to provide the Pro features you bought. For checking whether Pro is active, it is Art. 6(1)(f) GDPR. The data is kept for as long as your purchase needs to be restorable, and deleted on request.

RevenueCat also passes purchase and subscription events, such as a purchase, a trial starting, a renewal or a cancellation, with the product, price, currency and App Store country, to PostHog, so that we can see them next to the usage statistics described above. They are tied to the same random identifier as the app's PostHog events. They never contain your name, email address, Apple ID or payment details. Legal basis: Art. 6(1)(f) GDPR.

Shared download links

When someone shares photos from uncover, the message includes a link to getuncover.app/download. To learn whether those links lead to installs, we measure them like this. Opening the link on an iPhone or iPad sends us your screen size, time zone, preferred language, calendar system and the shared link's source, and our server adds a keyed hash of your IP address. We never store the IP address itself. When uncover opens for the first time, the app sends the same traits once, and we check whether they match a link opened in the previous ten minutes. If they do, we keep a record that an install came from a shared link, with no IP address or device traits in it, and the app notes in its usage statistics (see PostHog) whether it was installed from a shared link. Link visits can only be matched for ten minutes and are deleted within twelve hours, whether they matched or not. We use no advertising identifier, don't combine this with data from other companies, and don't track you across apps or websites. On other devices we only count the visit.

Every visit to the link is also counted in PostHog. Our server sends an event that contains only the link's source and the kind of device (iPhone or iPad, Android, or other). It carries a random number that is new for every visit, and no cookie, IP address, location or other identifier, so visits can't be connected to each other or to you.

This runs on Google Cloud Functions and Cloud Firestore in the europe-west1 region (Belgium), with PostHog for the counts. Legal basis: Art. 6(1)(f) GDPR, in knowing whether sharing brings new users. You can object at any time (Art. 21 GDPR).

The website

getuncover.app is hosted on Firebase Hosting. When you visit, your browser sends the technical data needed to deliver the page: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. Google processes this to deliver the website and protect it from attacks, and keeps the server logs for up to 30 days. Legal basis: Art. 6(1)(f) GDPR.

The website sets no cookies and loads no analytics or tracking scripts. Fonts are served from our own server, so your browser makes no requests to third parties such as Google Fonts. The only other processing on the site is the download-link measurement described above, including the visit count our server sends to PostHog.

The App Store

Apple provides the App Store download and the payment for in-app purchases, under Apple's own privacy policy. If you have chosen to share analytics with app developers, Apple gives us aggregated statistics and crash reports that don't identify you.

When you contact us

When you email us, we process your email address, your name if you give it, and the content of your message, in order to answer you. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if your message concerns a purchase. We delete the correspondence once your request has been dealt with, unless we have to keep it longer to defend legal claims, for at most three years.

Recipients and transfers outside the EU

We use these service providers. Each acts as our processor under a data processing agreement (Art. 28 GDPR):

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for Firebase: Crashlytics, Analytics, Remote Config, App Check, Hosting, Cloud Functions and Firestore. Firebase privacy information
• Functional Software, Inc. (Sentry), San Francisco, USA, with data stored in the EU. Sentry privacy policy
• PostHog, Inc., San Francisco, USA, with data stored in the EU. PostHog privacy policy
• RevenueCat, Inc., USA. RevenueCat privacy policy

These providers or their affiliates may process data in the United States. Where the recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise it is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We don't sell or rent data, and we never pass it to advertisers or data brokers.

How long we keep data

Children

uncover is intended for people aged 16 and over, and is not directed at children. We don't knowingly process data about children.

Security

All connections between the app, the website and our services are encrypted with TLS. IP addresses are only ever stored as a keyed hash. Our database cannot be read by any app or browser, only by our own server code, and access to our cloud accounts is limited to the people who run uncover.

Your rights

Under the GDPR you have the right to:

• access your data (Art. 15)
• have it corrected (Art. 16) or deleted (Art. 17)
• restrict its processing (Art. 18)
• receive it in a portable format (Art. 20)
• object to processing based on our legitimate interests (Art. 21)

To use these rights, email . Because the app doesn't know who you are, we usually can't link pseudonymous data to you (Art. 11 GDPR). If you can give us an identifier from the app, we will look up the data tied to it.

You also have the right to lodge a complaint with a supervisory authority. In Austria that is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, [email protected], www.dsb.gv.at. You can also contact the authority in the EU country where you live or work.

Changes to this policy

We update this policy when uncover or the services behind it change. The date at the top shows the current version. We point out significant changes in the app.

Contact

Fabian Geistert, Adalbert-Stifter-Str. 11, 1200 Vienna, Austria. Email: