Privacy Policy

2. In short

• The app works entirely offline. There is no server, no user account, no tracking, no analytics and no advertising.
• The app accesses your photo and video library read-only. Your photos and videos never leave the device; nothing is modified, deleted or shared.
• The website sets no cookies and embeds no third-party services. That is why there is no cookie banner.
• We only receive personal data if you actively write to us using the feedback form.

3. The “Picture Book” app

3.1 Access to the media library

To display pictures and videos, the app asks for photo library permission on first launch. Access goes through the operating system’s interface (PhotoKit on iOS, MediaStore on Android) and is strictly read-only: the app displays media, creates thumbnails in memory and plays videos. It never writes to, deletes from or uploads anything out of the library.

On Android, for motion photos the app temporarily copies the embedded video part into its own cache, which other apps cannot read, so that it can be played. This cache is cleared every time the app starts and is excluded from backups.

All processing happens on your device alone. As the provider we never learn anything about your media or which albums you selected. No GDPR legal basis is required on our side because no processing takes place in relation to us; you grant the permission to your device and can revoke it at any time in the system settings.

3.2 Settings stored locally

The app stores only its own settings locally on the device:

• the selected album, media filter and slideshow settings,
• the parental lock options (e.g. time lock, use of Face ID / Touch ID or biometric unlock on Android),
• the purchase status of the one-time unlock.

These entries live in the app’s own storage area (UserDefaults) and are never transmitted. The parental lock PIN is stored in the device Keychain, bound to the device and readable only while the device is unlocked. The app’s privacy manifest declares this as access to app-owned data only (reason code CA92.1).

On Android the settings live in the app’s private storage (SharedPreferences), which other apps cannot read. The PIN is not stored in plain text there, only as a salted hash (PBKDF2). The app is excluded from Android backups, so its data does not end up in a cloud backup either.

3.3 Face ID / Touch ID or biometric unlock on Android

You may optionally unlock the parental lock biometrically (on Android with the system’s strongest class of fingerprint or face unlock). The check is performed entirely by the operating system; the app only receives a “success” or “failure” result. Biometric data is never processed, stored or transmitted by the app. The app PIN you set yourself always remains available as the fallback.

3.4 No tracking

The app contains no analytics, advertising or tracking components; Apple’s App Tracking Transparency requirements therefore do not apply. Its privacy manifest declares accordingly: no tracking, no tracking domains, no collected data types. The app does not initiate network connections on its own; it merely checks whether an internet connection exists in order to offer or disable the feedback function. The Android app does not even hold the permission for internet access.

3.5 One-time in-app purchase

Premium features are unlocked with a single in-app purchase handled entirely through Apple’s infrastructure (StoreKit). Payment and billing data goes to Apple only; we receive no name, no payment details and no identifier that would make you identifiable. Apple is the controller for that processing; Apple’s privacy policy applies: https://www.apple.com/legal/privacy/

Apple provides us only with aggregated, anonymous statistics about downloads and sales, which cannot be related to individual people.

On Android the purchase is handled entirely through Google Play (Google Play Billing) in the same way. Payment and billing data goes to Google only; the controller for that processing is Google Ireland Limited, and Google’s privacy policy applies (https://policies.google.com/privacy). Besides statistics, Google provides us with an order record for each purchase (order number, product, price, date and country). We do not receive your name, address or payment details. We use the order records only to process refunds and to meet our accounting obligations (Art. 6(1)(b) and (c) GDPR).

3.6 Crash reports via Apple and Google

If you have allowed your device to share analytics or diagnostic data with app developers, Apple or Google provides us with crash reports and technical performance data for the app (such as the device model, operating system version and the place in the code where an error occurred). This data is collected by the operating system, not by the app; Apple or Google is responsible for that processing. The reports contain neither your name nor any identifier that would let us identify you. We use them solely to fix bugs. You can withdraw this permission at any time in your device settings.

4. Website: hosting and server logs

The website is hosted by Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany.

The host processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The servers are located in the European Union.

When you visit the website, server log data is processed out of technical necessity: IP address, date and time of access, the address requested, amount of data transferred, referrer address and browser/operating system identification (user agent).

• Purpose: delivering the page, operational security, defending against attacks, troubleshooting.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
• Retention: logs are kept briefly and deleted automatically, at the latest after 14 days. They are not merged with other data.

5. No cookies, no analytics, no third-party services

The website sets no cookies, uses no analytics or audience measurement and embeds no third-party content (no external fonts, maps, video embeds or social media widgets). No consent is therefore required, and for the same reason there is no cookie banner.

6. Feedback form

You can send us feedback through our feedback form.

What is processed:

• the category of your feedback and your message (required),
• name and email address (optional; without an email address we cannot reply),
• technical details passed on by the app if you open the form from within the app: app version, build number, iOS or Android version, device model (e.g. “iPhone17,1” or “Google Pixel 9”) and language code. These details are not usable to identify you — the device model identifies the model, not your individual device. They are shown to you in the form.

Purpose: handling your feedback, narrowing down reported bugs and — if you provide an email address — replying to you.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in handling enquiries and improving the app); where your message concerns an existing contract regarding the purchased unlock, also Art. 6(1)(b) GDPR.

Where it goes and how long we keep it: The entries are not stored in a database. They are sent directly by email to our mailbox hello@freshlime.de. That mailbox is operated by the same processor as the website (Hetzner Online GmbH, see section 4), and the message is read by us only. We delete it once your matter has been dealt with, at the latest after 6 months, unless statutory retention obligations apply.

Voluntary: No entry is mandatory. Without a message, however, we cannot address your request.

7. Children

The app is made for families and is used by children. That is precisely why it is built to collect and transmit no data at all — neither from children nor from adults. There are no user accounts, no chat or sharing features, no advertising and no links to external services. The feedback form is addressed to adults only.

8. Recipients and transfers to third countries

Apart from the processor named in this policy (Hetzner Online GmbH — website hosting and email mailbox) we do not pass on any data. We never sell data.

We do not transfer data to third countries. For in-app purchases, Apple or Google processes payment data under its own responsibility, possibly outside the EU; Apple and Google describe the details and safeguards in their privacy policies.

9. Your rights

You have the right to

• access the data we process about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• withdraw consent with future effect, where consent was given.

An informal email to hello@freshlime.de is enough.

Right to lodge a complaint: You may complain to a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstrasse 20, 70173 Stuttgart, Germany.

10. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

11. Changes to this policy

We will update this policy when the app, the website or the legal situation changes. The version published here applies; the date above shows its status.