PicProof Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how FlashSoft OÜ, a private limited company (osaühing) incorporated under the laws of the Republic of Estonia ("Company", "we", "us" or "our"), processes information in connection with the mobile application PicProof for iOS and Android, including its Apple Watch and Wear OS companions (the "App"). Where a feature works differently on iOS and on Android, this Privacy Policy says so.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the Company is the controller of Personal Data processed through the App, except where a Third-Party Service or an App Store Provider acts as an independent controller, as described in this Privacy Policy.

This Privacy Policy applies only to the App. It does not apply to any Third-Party Services, websites or apps, even if they are accessible through the App.

By downloading, installing, accessing or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you must not use the App and must delete it from your Device.

This Privacy Policy forms part of, and should be read together with, our End User License Agreement (Terms of Use) available at https://flashsoftapps.com/picproof-eula.html.

2. Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data, such as collection, storage, use, disclosure or deletion.
• "Device" means the smartphone, tablet or other device on which the App is installed.
• "Third-Party Services" means services, software development kits (SDKs), platforms and content provided by persons other than the Company.
• "App Store Provider" means Apple Inc. (App Store) or Google LLC (Google Play), as applicable.

3. Information We Collect

3.1 Information You Provide to Us

We do not require you to create an account or to provide your name, email address or other contact details to use the core features of the App, unless stated otherwise below.

If you contact us, for example by email, we process the information you choose to provide, such as your email address, name and the content of your message, in order to respond to you.

Sync via Your iCloud Account (iOS). If you are signed in to iCloud, the App may use Apple's iCloud service to sync the capture details, notes, projects, site visits with their routes and settings of your photos and videos and, if you turn on photo and video sync, the photos and videos themselves across your own Devices. This information is stored in your private iCloud account, governed by Apple's privacy policy, and is not transmitted to our servers and not accessible to us. You can control this at any time in your Device's iCloud settings, including by disabling iCloud for the App or deleting the data from iCloud.

Backup to Your Google Account (Android). If backup is turned on for your Device, Android includes the App's capture details, notes, projects, site visits with their routes and settings in the backup of your Device to your Google Account, so that they can be restored on a new Device. Photos and videos are not included in this backup; they are moved only if you transfer data directly from one Device to another. The backup is stored in your Google Account, governed by Google's privacy policy, and is not transmitted to our servers and not accessible to us. You can turn backup off at any time in your Device settings.

Photos, Videos and Capture Details. The App lets you take photos and videos and adds a stamp with capture details that you choose, such as the date, time, time zone, coordinates, street address, altitude, direction, speed, location accuracy, a project name, notes and your own text. The App also writes the date and location into the metadata of saved copies. Your photos, videos and capture details are stored on your Device and are not transmitted to us or to the Third-Party Services listed in Section 4, except as described in this Privacy Policy, such as sync through your own iCloud account or the backup of your Device to your own Google Account, or when you choose to save, share or export them. A photo or video you share, and a report or file you export, may reveal where and when it was taken through its stamp and its metadata, and anyone who receives it can see this information. The usage events recorded by our analytics services do not contain your photos, videos, coordinates, addresses or notes.

Photo Seal and Verification. When you take a photo, the App adds a seal to the photo file: a record of the capture time and time zone, the location and how it was obtained (for example, measured by GPS, set by hand on the map or simulated by software), the result of the Device clock check and a fingerprint of the image, signed with a key created by the App on your Device. The private part of the key stays in the secure hardware of your Device (the Secure Enclave on iOS, the Android Keystore on Android) and never leaves it. The seal also contains the public part of the key, which is the same for all photos taken with the App on that Device. Anyone who receives a sealed photo can read these details and may be able to recognize other photos sealed on the same Device. The App can check whether a photo you choose still matches its seal; the check runs on your Device and the photo is not transmitted to us. If you edit a photo in the App, for example crop or rotate it or adjust its colors, the App keeps the original photo on your Device, seals the edited photo again and lists the edits in its seal.

Site Visits. If you start a site visit, the App records the start and end time of the visit and the route you move along, as a series of location points, until you finish the visit. While a visit is in progress, the route keeps recording when the App is in the background, and your Device shows that the App is using your location. Visits and routes are stored on your Device and, if iCloud sync (iOS) or backup (Android) is on, in your private iCloud account or Google Account backup, and are not transmitted to us. During a visit, the visit name, duration, number of photos and distance may be shown in a Live Activity on your Lock Screen and in the Dynamic Island (iOS) or in a notification (Android), where anyone who sees your Device can read it.

Photos Taken From the Lock Screen. If you take a photo from the Lock Screen (on Android, also from the Quick Settings tile while your Device is locked), the photo and its capture time and, if available, location are kept in a private storage area of the App on your Device until you next open the App, which then adds the stamp and seal and moves the photo to your gallery. These photos are not transmitted to us.

Watch Remote. If you use the App on Apple Watch or on a Wear OS watch, your watch and phone exchange commands (such as taking a photo) and the camera status, including a small preview of your latest photo, between your own devices through the system services of Apple or Google (the Wearable Data Layer of Google Play services). This information is not transmitted to us.

Photos Shared to the App. If you share photos to the App from another app, the App copies them into its private storage on your Device and adds the stamp the next time you open it. These photos are not transmitted to us.

Text Recognition and Report Summaries. The App may recognize text that appears in your photos, such as meter readings, serial numbers or signs, so that you can add it to a note and search for it. Text recognition uses Apple's Vision framework on iOS and Google ML Kit on Android. If you choose to write a report summary, the App asks the language model on your Device (Apple Intelligence on iOS, Gemini Nano on Android, where your Device supports it) to write a short summary from the places, dates and notes of the photos in the report; on Android, the model is downloaded to your Device by the operating system the first time it is needed. Both features run on your Device; the photos, recognized text and summaries are not transmitted to us or to the Third-Party Services listed in Section 4.

3.2 Information Collected Automatically

When you use the App, certain information is collected automatically by the App and by the Third-Party Services integrated into it, including:

• Device information: Device model, manufacturer, operating system and version, language, time zone, screen parameters, and technical information about the Device such as memory and storage.
• Identifiers: app instance identifiers, installation identifiers, app user identifiers, the vendor identifier (IDFV) on iOS, the app set ID on Android and, only where you have permitted access, the advertising identifier (IDFA on iOS or Android Advertising ID on Android).
• Usage data: the date and time of your use of the App, first launch, sessions, screens viewed, features used, taps and other in-app events.
• Diagnostic data: crash reports, error logs, performance data and related technical information.
• Approximate location: country, region and city derived from your IP address. We do not collect your precise GPS location unless stated in Section 3.4.
• Purchase information: information about Subscriptions and in-app purchases, such as product identifier, transaction identifier, purchase date, renewal status, price and currency, and trial status.

3.3 Information from App Store Providers

When you make a purchase in the App, the App Store Provider processes your payment and provides us, directly or through Apphud, with transaction information necessary to validate and manage the purchase. We do not receive or store your payment card details, billing address or App Store Provider account password.

3.4 Device Permissions

The App may request permission to access certain features of your Device. You decide whether to grant each permission and can change your decision at any time in your Device settings. If you decline or revoke a permission, some features of the App may not be available or may not work properly, and the Company is not responsible for any resulting limitation.

Camera. The App may request access to your Device camera to take photos and record videos with a stamp of the date, time and location. Camera access is used only when you actively use the related feature. Unless stated otherwise in this Privacy Policy, images and video captured through the App are processed on your Device and are not transmitted to us. You can grant or revoke camera access at any time in your Device settings.

Photo Library. The App may request access to your photo library to save your stamped photos and videos to your photo library and, if you choose, import photos from your library to add a stamp to them. On Android, the App saves copies to the Pictures/PicProof and Movies/PicProof folders of your Device and may ask for access to the location information in photos you select, so that their location is kept when you stamp or verify them. The App accesses only the photos and videos you select or, where applicable, the items you allow in your Device settings. Unless stated otherwise in this Privacy Policy, selected media is processed on your Device and is not transmitted to us. The App may save content you create to your photo library when you instruct it to do so.

Microphone. The App may request access to your Device microphone to record sound with your videos. The microphone is used only while you actively use the related feature. Unless stated otherwise in this Privacy Policy, audio is processed on your Device and is not transmitted to us.

Location. The App may request access to your Device's location to stamp the coordinates, address, altitude, direction and speed of the place where you take a photo or video, and show your photos on a map. Location is used only for this purpose and only while you use the related feature, unless you grant a broader permission in your Device settings. Unless stated otherwise in this Privacy Policy, your precise location is processed on your Device and is not transmitted to us. You can revoke location access at any time in your Device settings; some features may then be unavailable.

Notifications. The App may ask for permission to send you notifications, such as reminders, a weekly summary of your photos and information about features or offers, and, on Android, the notification shown while a site visit is in progress. You can disable notifications at any time in your Device settings.

Files and Documents. The App may access files and documents that you select to add a stamp to images that you share to the App from other apps and create exports such as PDF reports and CSV, KML and GPX files. The App accesses only the files you choose. Unless stated otherwise in this Privacy Policy, files are processed on your Device and are not transmitted to us.

Location During Site Visits. While a site visit you started is in progress, the App uses your location in the background to record the route, under the permission you granted to use your location while using the App (on Android, as a foreground service with a visible notification). Recording stops when you finish the visit.

3.5 Information We Do Not Intentionally Collect

Unless expressly stated in this Privacy Policy, we do not intentionally collect your name, postal address, phone number, precise location, contacts, photos, files, or any special categories of Personal Data (such as data concerning health, biometric data, racial or ethnic origin, political opinions, religious beliefs or sexual orientation). Please do not send us such information.

4. Third-Party Services We Use

The App uses the Third-Party Services listed below. These providers collect and process information directly from your Device in accordance with their own privacy policies. Some of them process data on our behalf as processors, and some act as independent controllers. We do not control, and are not responsible for, the data practices of Third-Party Services. We encourage you to read their privacy policies.

Apphud. We use Apphud, provided by Apphud Inc. (USA), to manage Subscriptions and in-app purchases, validate purchase receipts, restore purchases and analyze subscription performance. Apphud processes purchase and transaction history, device identifiers (such as IDFV, and IDFA or Android Advertising ID where you have permitted access), an app user identifier, country, language, locale, time zone, IP address, device model, operating system version, app version and the date of your last activity in the App. Apphud does not receive your payment card details. Apphud's privacy policy is available at https://legal.apphud.com/privacy.

Firebase Analytics. We use Google Analytics for Firebase, provided by Google, to understand how the App is used and to improve it. Firebase Analytics automatically collects an app instance identifier, the advertising identifier where you have permitted access, device model, operating system and app version, language, country and approximate region, first launch, session information, screens viewed, and in-app events and purchases. Your approximate location is derived from your IP address; according to Google, IP addresses are not logged or stored in Google Analytics. More information is available at https://firebase.google.com/support/privacy and in Google's Privacy Policy at https://policies.google.com/privacy.

Firebase Crashlytics. We use Firebase Crashlytics, provided by Google, to receive crash reports and diagnose errors. When the App crashes or experiences an error, Crashlytics may collect a crash installation identifier, a Firebase installation ID, crash stack traces and logs, device model, processor architecture, memory and disk space, operating system name and version, app version, device state (such as orientation and jailbreak or root status) and timestamps. According to Google, this data is retained for ninety (90) days. More information is available at https://firebase.google.com/support/privacy.

Amplitude. We use Amplitude, provided by Amplitude, Inc. (USA), for product analytics, to understand how users interact with the App and to improve its features, onboarding and purchase flows. Amplitude may collect a device identifier, an app user identifier, the advertising identifier where you have permitted access, in-app events and interactions, session data, device model, operating system and app version, mobile carrier, language, and country, region and city derived from your IP address. Amplitude's privacy notice is available at https://amplitude.com/privacy.

AppsFlyer. We use AppsFlyer, provided by AppsFlyer Ltd. (Israel), for mobile attribution and marketing analytics: to understand which campaign or channel led you to install the App, to measure the performance of our marketing and to detect advertising fraud. AppsFlyer may collect your IP address (which may indicate your general location), user agent, the advertising identifier (IDFA on iOS or Android Advertising ID on Android) where you have permitted access, device type, operating system version and system language, and engagement data such as clicks, impressions, installations and in-app events. AppsFlyer's services privacy policy is available at https://www.appsflyer.com/legal/services-privacy-policy/.

Firebase Remote Config. We use Firebase Remote Config, provided by Google, to deliver configuration values to the App, such as settings for features and in-app screens, without requiring an App update. Remote Config uses a Firebase installation ID to select the configuration values returned to your Device. According to Google, Firebase installation IDs are retained until we request their deletion and are then removed from Google's systems within 180 days. More information is available at https://firebase.google.com/support/privacy.

Apple Maps (iOS). To show maps, to draw map images and to look up the street address of a location, the App uses Apple's map service, provided by Apple Inc. For this purpose, your Device sends Apple the coordinates of the location or the boundaries of the visible map area, together with the language of your Device and technical information such as your IP address. We do not receive this information from Apple. Apple processes it in accordance with its privacy policy, available at https://www.apple.com/legal/privacy/.

Apple WeatherKit (iOS). If you turn on the weather feature, the App sends your Device's location to WeatherKit, a weather service provided by Apple Inc., to retrieve the forecast for that location. We do not receive this location from WeatherKit. According to Apple, location information sent to WeatherKit is used only to provide weather forecasts, is not associated with any personally identifiable information and is not tracked between requests. Apple processes this information in accordance with its privacy policy, available at https://www.apple.com/legal/privacy/.

Apple (time check, iOS). To check whether your Device clock is correct, the App sends a request without any content to Apple's public website and reads the current time from the response. Apple receives the IP address of your Device and standard technical request information, as with any visit to a website. No photos, locations or other User Content are sent, and we do not receive this information. Apple processes it in accordance with its privacy policy, available at https://www.apple.com/legal/privacy/.

Google Maps Platform and Geocoding (Android). To show maps, to draw map images and to look up the street address of a location, the App on Android uses Google Maps Platform and the geocoding service of Google Play services, provided by Google. For this purpose, your Device sends Google the coordinates of the location or the boundaries of the visible map area, together with the language of your Device and technical information such as your IP address. We do not receive this information from Google. Google processes it in accordance with its privacy policy, available at https://policies.google.com/privacy.

MET Norway Weather (Android). If you turn on the weather feature, the App on Android requests the forecast from the public weather service of the Norwegian Meteorological Institute (MET Norway), sending your location rounded to about one kilometer. MET Norway receives your IP address and standard technical request information, as with any visit to a website. We do not receive this information. Weather data is provided by MET Norway under the Creative Commons Attribution 4.0 license. MET Norway's privacy information is available at https://www.met.no/en/about-us/privacy.

Google (time check, Android). To check whether your Device clock is correct, the App on Android sends a request without any content to Google's public website and reads the current time from the response. Google receives the IP address of your Device and standard technical request information. No photos, locations or other User Content are sent, and we do not receive this information.

Google ML Kit (Android). Text recognition on Android uses Google ML Kit, which runs on your Device. Your photos and the recognized text are not sent to Google or to us. Google may collect technical information about the use and performance of ML Kit, as described in the ML Kit terms at https://developers.google.com/ml-kit/terms.

Apple and Google. Purchases and Subscriptions are processed by the App Store Provider through which you downloaded the App: Apple Inc. (https://www.apple.com/legal/privacy/) or Google LLC (https://policies.google.com/privacy). The App Store Provider acts as an independent controller of your account and payment information. We do not receive or store your payment card details, billing address or App Store account password.

5. How We Use Information

We and our Third-Party Services use the information described in this Privacy Policy for the following purposes:

• to provide, operate and maintain the App and its features;
• to process, validate, manage and restore Subscriptions and in-app purchases;
• to monitor the stability and performance of the App and to diagnose and fix errors and crashes;
• to analyze how the App is used and to develop, test and improve the App, its features, content and user experience;
• to measure the effectiveness of our marketing and promotional activities;
• to sync your settings and content across your own Devices through your iCloud account, or to let Android back them up to your Google Account;
• to record the route and time of site visits you start;
• to detect, prevent and address fraud, abuse, security incidents and technical issues;
• to respond to your requests and communicate with you;
• to comply with legal obligations and to establish, exercise or defend legal claims;
• for any other purpose with your consent.

6. Legal Bases for Processing (EEA, UK and Switzerland)

If you are located in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR): to provide the App and to process and manage your Subscriptions and purchases.
• Legitimate interests (Art. 6(1)(f) GDPR): to keep the App secure and stable, to diagnose errors, to analyze and improve the App, to prevent fraud, and to establish, exercise or defend legal claims. Our legitimate interests are not overridden by your interests or fundamental rights, taking into account the pseudonymous nature of most of the data.
• Consent (Art. 6(1)(a) GDPR): where required by applicable law, including for personalized advertising, for access to the advertising identifier and for storing or accessing information on your Device. You may withdraw your consent at any time as described in Section 13. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Legal obligation (Art. 6(1)(c) GDPR): where processing is necessary to comply with the law, such as accounting and tax obligations.

7. Advertising and Tracking

The App does not currently display third-party advertisements and does not use your advertising identifier to display personalized advertisements. If we introduce advertising, we will update this Privacy Policy and, where required by law, request your consent. On iOS, you can control tracking permissions at any time in Settings > Privacy & Security > Tracking. On Android, you can reset or delete your advertising ID in your Device settings (for example, Settings > Google > Ads or Settings > Privacy > Ads).

8. How We Share Information

We do not sell your Personal Data for money. We may share information only as follows:

• Third-Party Services listed in Section 4, which process data to provide their services to us or as independent controllers.
• App Store Providers, which process purchases and Subscriptions.
• Legal requirements: where we believe in good faith that disclosure is required by law, regulation, legal process or a governmental request, or is necessary to protect the rights, property or safety of the Company, our users or others.
• Business transfers: in connection with a merger, acquisition, reorganization, financing, sale of assets or similar transaction, in which case information may be transferred to the acquirer or successor.
• With your consent or at your direction.
• Aggregated or de-identified information that cannot reasonably be used to identify you may be shared for any lawful purpose.

9. International Data Transfers

The Company is established in the European Union. Our Third-Party Services are located in, or transfer data to, countries outside the European Economic Area, including the United States, which may not provide the same level of data protection as your country. Where required, such transfers are based on the European Commission's adequacy decisions (including the EU-U.S. Data Privacy Framework, for certified recipients), Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms. By using the App, you acknowledge that your information will be transferred to and processed in such countries.

10. Data Retention

We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Information processed by Third-Party Services is retained in accordance with their retention policies, as summarized in Section 4. Correspondence with us is retained for as long as needed to handle your request and for a reasonable period afterwards to defend potential claims. When information is no longer needed, it is deleted or anonymized.

11. Data Security

We and our Third-Party Services use technical and organizational measures designed to protect information against unauthorized access, loss, misuse or alteration, including encryption in transit. However, no method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your Device secure, including using a passcode, installing operating system updates and not using the App on a jailbroken or rooted Device. Where required by applicable law, we will notify you and/or the competent authorities of a personal data breach.

12. Your Rights

12.1 EEA, UK and Switzerland

Subject to the conditions and exceptions set out in applicable law, you have the right to:

• request access to your Personal Data;
• request rectification of inaccurate Personal Data;
• request erasure of your Personal Data;
• request restriction of processing;
• receive your Personal Data in a portable format;
• object to processing based on legitimate interests, including profiling;
• withdraw your consent at any time;
• lodge a complaint with a supervisory authority. The lead supervisory authority for the Company is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), https://www.aki.ee. You may also contact the authority in your country of residence.

12.2 United States

Depending on your state of residence (for example, California, Virginia, Colorado, Connecticut, Utah, Texas or Oregon), you may have the right to know what Personal Data we process, to access and receive a copy of it, to correct it, to delete it, and to opt out of "targeted advertising", "sale" or "sharing" of Personal Data as defined by applicable state law. We do not sell Personal Data for money. The use of advertising and analytics Third-Party Services may be considered "sharing" or "targeted advertising" under some state laws; you can opt out as described in Section 7 and Section 13. We will not discriminate against you for exercising your rights. You may designate an authorized agent to make a request on your behalf, subject to verification.

12.3 How to Exercise Your Rights

To exercise your rights, contact us at contact@flashsoftapps.com. We may need to verify your identity before responding. We respond within the time limits required by applicable law.

Most information processed through the App is pseudonymous and linked to Device or app identifiers rather than to your name or email address. To help us locate your data, please include in your request the App name, your Device platform and, if available, the identifiers shown in the App's settings or the transaction ID of your purchase. If we cannot reasonably identify the data relating to you, we may be unable to fulfill your request, as permitted by applicable law. Some requests may also be exercised directly with the relevant Third-Party Service or App Store Provider.

13. Your Choices and Controls

• Device permissions: manage or revoke permissions at any time in your Device settings.
• Advertising identifier and tracking: control as described in Section 7.
• Consent choices: where the App displays a consent message, you may review or change your choices in the App's settings, where available.
• Subscriptions: manage or cancel through your App Store Provider account settings.
• Stop all collection: you can stop all collection of information by the App at any time by uninstalling the App from your Device.

14. Children's Privacy

The App is not directed to children under the age of 13, or under the higher minimum age required for consent to data processing in your country (for example, 16 in some EEA countries). We do not knowingly collect Personal Data from such children. If you are a parent or guardian and believe that your child has provided Personal Data through the App, contact us at contact@flashsoftapps.com, and we will take steps to delete such information. Parents and guardians are responsible for supervising their children's use of Devices and apps.

15. Third-Party Links and Content

The App may contain links to, or content from, third-party websites, apps and services, including advertisements. We are not responsible for the content, privacy practices or security of any third party. Your interactions with third parties are governed by their own terms and privacy policies.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time at our sole discretion. The updated version will be published at https://flashsoftapps.com/picproof-privacy-policy.html and will be effective from the "Last Updated" date shown above. Where required by applicable law, we will inform you of material changes through the App or by other appropriate means. Your continued use of the App after the "Last Updated" date means that you acknowledge the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

17. Language

This Privacy Policy is written in English. If it is translated into another language, the English version prevails in the event of any inconsistency, to the extent permitted by applicable law.

18. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us:

• Company: FlashSoft OÜ
• Email: contact@flashsoftapps.com
• Website: https://flashsoftapps.com