Privacy Policy

Preamble

With this Privacy Policy, we inform you about the processing of personal data for which René Böhres is responsible in connection with providing the Curalbum app. We also explain the app’s exclusively local functionality, through which the provider does not receive photos or information generated locally from them. The terms used are not gender-specific.

Last Update: 5. August 2026

Table of contents

• Preamble
• Controller
• Overview of processing operations
• Relevant legal bases
• General Information on Data Retention and Deletion
• Rights of Data Subjects
• How Curalbum Works Locally
• Permissions, Storage, Erasure and Security
• Changes and Updates
• Google Play, Android Vitals, Reviews and Support

Controller

René Böhres
Ludwig-Erhard-Straße 15
63512 Hainburg, Germany

E-mail address: hello@curalbum.app

Overview of processing operations

The following table summarises the types of data processed, the purposes for which they are processed and the concerned data subjects.

Relevant legal bases

Relevant legal bases according to the GDPR: In the following, you will find an overview of the legal basis of the GDPR on which we base the processing of personal data. Please note that in addition to the provisions of the GDPR, national data protection provisions of your or our country of residence or domicile may apply. If, in addition, more specific legal bases are applicable in individual cases, we will inform you of these in the data protection declaration.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations apply to data protection in Germany. This includes in particular the Law on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special provisions on the right to access, the right to erase, the right to object, the processing of special categories of personal data, processing for other purposes and transmission as well as automated individual decision-making, including profiling. Furthermore, data protection laws of the individual federal states may apply.

Relevant legal basis according to the Swiss Data Protection Act: We process your personal data in accordance with the Swiss Federal Act on Data Protection (“Swiss DPA”). Personal data must be processed lawfully, in good faith and proportionately (Art. 6 para. 1 and 2 Swiss DPA). It may only be collected for a specific purpose that is recognisable to the data subject and may only be processed in a manner compatible with that purpose (Art. 6 para. 3 FADP). Unlike the GDPR, the Swiss DPA does not generally require private controllers to base processing on a specific legal basis from a statutory list. Therefore, there is generally no obligation to state such a legal basis for each processing activity in the privacy policy.

Reference to the applicability of the GDPR and the Swiss DPA: This privacy policy is intended to provide information in accordance with both the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). Where references are made to concepts such as the processing of personal data, legitimate interests, or special categories of data, these references are to be understood in accordance with the applicable data protection laws. Within the scope of application of the Swiss FADP, the legal interpretation of these terms is determined exclusively by Swiss law.

General Information on Data Retention and Deletion

We delete personal data that we process in accordance with legal regulations as soon as the underlying consents are revoked or no further legal bases for processing exist. This applies to cases where the original purpose of processing is no longer applicable or the data is no longer needed. Exceptions to this rule exist if statutory obligations or special interests require a longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or protection of the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data specifically applicable to certain processing processes.

In cases where multiple retention periods or deletion deadlines for a date are specified, the longest period always prevails.

Data that is no longer stored for its originally intended purpose but due to legal requirements or other reasons are processed exclusively for the reasons justifying their retention.

Data Retention and Deletion: The following general deadlines apply for the retention and archiving according to German law:

• 10 Years - Fiscal Code/Commercial Code - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheet as well as the necessary work instructions and other organisational documents (Section 147 Paragraph 1 No. 1 in conjunction with Paragraph 3 of the German General Tax Code (AO), Section 14b Paragraph 1 of the German VAT Act (UStG), Section 257 Paragraph 1 No. 1 in conjunction with Paragraph 4 of the German Commercial Code (HGB)).
• 8 years - Accounting documents, such as invoices, booking and expense receipts (Section 147 Paragraph 1 No. 4 and 4a in conjunction with Paragraph 3 of the German General Tax Code (AO), Section 257 Paragraph 1 No. 4 in conjunction with Paragraph 4 of the German Commercial Code (HGB))
• 6 Years - Other business documents: received commercial or business letters, copies of dispatched commercial or business letters, and other documents to the extent that they are significant for taxation purposes, for example, hourly wage slips, operating accounting sheets, calculation documents, price tags, as well as payroll accounting documents, provided they are not already accounting vouchers and cash register tapes Section (Section 147 Paragraph 1 No. 2, 3, 5 in conjunction with Paragraph 3 of the German General Tax Code (AO), Section 257 Paragraph 1 No. 2 and 3 in conjunction with Paragraph 4 of the German Commercial Code (HGB)).
• 3 Years - Data required to consider potential warranty and compensation claims or similar contractual claims and rights, as well as to process related inquiries, based on previous business experiences and common industry practices, will be stored for the duration of the regular statutory limitation period of three years. This period begins at the end of the year in which the relevant contractual transaction took place or the contractual relationship ended in the case of ongoing contracts (Sections 195, 199 of the German Civil Code).

Data Retention and Deletion: The following general retention and archiving periods apply under Swiss law:

• 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balances, accounting vouchers and invoices, as well as all necessary working instructions and other organizational documents (Article 958f of the Swiss Code of Obligations (OR)).
• 10 years - Data necessary to consider potential claims for damages or similar contractual claims and rights, as well as for the processing of related inquiries based on previous business experiences and usual industry practices, will be stored for the statutory limitation period of ten years, unless a shorter period of five years is applicable, which is relevant in certain cases (Articles 127, 130 OR). Claims for rent, lease, and interest on capital, as well as other periodic services, for the delivery of food, for board and lodging, for innkeeper debts, as well as for craftsmanship, small-scale sales of goods, medical care, professional services by lawyers, legal agents, procurators, and notaries, and from the employment relationship of employees, expire after five years (Article 128 OR).

Rights of Data Subjects

Rights of the Data Subjects under the GDPR: As data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:

• Right to Object: You have the right, on grounds arising from your particular situation, to object at any time to the processing of your personal data which is based on letter (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for the purpose of such marketing, which includes profiling to the extent that it is related to such direct marketing.
• Right of withdrawal for consents: You have the right to revoke consents at any time.
• Right of access: You have the right to request confirmation as to whether the data in question will be processed and to be informed of this data and to receive further information and a copy of the data in accordance with the provisions of the law.
• Right to rectification: You have the right, in accordance with the law, to request the completion of the data concerning you or the rectification of the incorrect data concerning you.
• Right to Erasure and Right to Restriction of Processing: In accordance with the statutory provisions, you have the right to demand that the relevant data be erased immediately or, alternatively, to demand that the processing of the data be restricted in accordance with the statutory provisions.
• Right to data portability: You have the right to receive data concerning you which you have provided to us in a structured, common and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
• Complaint to the supervisory authority: In accordance with the law and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State where you habitually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

Rights of the data subjects under the Swiss DPA:

As the data subject, you have the following rights in accordance with the provisions of the Swiss DPA:

• Right to information: You have the right to request confirmation as to whether personal data concerning you are being processed, and to receive the information necessary for you to assert your rights under the Swiss DPA and to ensure transparent data processing.
• Right to data release or transfer: You have the right to request the release of your personal data, which you have provided to us, in a common electronic format, as well as its transfer to another data controller, provided this does not require disproportionate effort.
• Right to rectification: You have the right to request the rectification of inaccurate personal data concerning you.
• Right to object, deletion, and destruction: You have the right to object to the processing of your data, as well as to request that personal data concerning you be deleted or destroyed.

How Curalbum Works Locally

Scope of this App Privacy Policy

This Privacy Policy applies to the Curalbum Android app and the app-related operations described below, including distribution through Google Play, Android Vitals, public Google Play reviews and email support. Use of the curalbum.app website is covered by the separate Website Privacy Policy. If this App Privacy Policy is accessed through the website, only that page request constitutes use of the website; the operations of the app and its associated platform services are described exclusively here.

Local photo processing

Curalbum helps you find duplicate and similar photos in the Android photo library you have made available and then decide for yourself which photos to keep or move to the Android system trash. For this purpose, the app reads the authorised photos and necessary technical details on your device, such as file name, format, file size, dimensions and time information. It locally generates cryptographic and visual comparison values, general visual feature vectors, groups, scan and review states, and your decisions.

The app compares general visual similarity. It does not perform face or person recognition, identity matching, biometric enrolment, or the targeted detection or classification of sensitive circumstances or special categories of personal data. Photos may nevertheless depict other people or sensitive circumstances; such content is not specifically detected or classified for the app’s functionality.

You control the specific photo-library selection, the permission decision, the scan, the review and every trash action. The photo and analysis data described above is not used for the provider’s own analytics, training, advertising, publication or exploitation purposes. The provider does not obtain access to this local data through Curalbum. Curalbum has no proprietary server, cloud, account or upload path for photos or the locally generated information. The Google Play, Android Vitals, public-review and voluntary email-support operations described below are separate from this local path.

Permissions, Storage, Erasure and Security

Photo access and permissions

Curalbum requests the Android photo permission only after the app has explained the purpose of the access and you have selected “Get started”. The app accesses the authorised photos and starts the scan only after full or partial access has been granted. With partial access, it processes only the selected photos. If access is denied or withdrawn, it does not start a new scan. You can change or withdraw access at any time in the Android settings. An Android permission is a technical access decision and is not treated by us as blanket data-protection consent for other purposes.

Local storage

Original photos remain in the Android media store. Curalbum reads original or preview image data only temporarily for comparison and display and does not create an additional permanent copy of the original photos. In its app-specific database, Curalbum stores the technical metadata, cryptographic and visual comparison values, general visual feature vectors, groups, scan and cache states, trash records and your decisions that are necessary for inventory, comparison, grouping and review. Settings such as language and onboarding or scan status are also stored locally. Temporary image data may be held in memory and in app-private caches managed by Flutter, Android or the image libraries used. A small preview image may additionally be stored in the database for the local trash record.

Android system trash

Curalbum moves photos to the Android system trash only after your selection and confirmation in the Android system dialogue. The app has no path for permanently deleting a photo. Android or the gallery used on the device controls restoration and final deletion. Curalbum keeps only a local record of trash actions confirmed through the app. If a photo is restored, the corresponding record is removed during reconciliation. When full photo access is available, Curalbum may remove a record that is more than 30 days old and no longer visible as an internal cleanup rule. This does not state whether or when Android permanently deletes the photo.

Reset, Android app-data deletion and uninstallation

The “Reset data” function deletes photo entries and local derivatives, groups, decisions, MediaStore fingerprints and trash records in particular; it also resets cursor, cache and grouping states and clears runtime scan diagnostics. If photo permission remains in place, a new scan then starts immediately and recreates technical metadata and comparison values for photos that remain authorised. The reset does not withdraw the Android photo permission, alter original photos, delete locally stored language and onboarding preferences or expressly clear every app-private image cache; such cache files may remain until automatically evicted. Clearing Curalbum’s app data in the Android settings or uninstalling the app removes the app-private database, settings and cache files. Original photos and the Android system trash remain unaffected. Cloud backup and Android device-to-device transfer of Curalbum’s app-private data are disabled in the release build.

Technical safeguards

The reviewed Android release has neither the Internet permission nor the network-state permission and contains no analytics, advertising, telemetry or crash-reporting SDK. Local data is held in the Android-protected app sandbox; photo access is restricted by the Android runtime permission, and app backup and device-to-device transfer are disabled. These safeguards reduce risks but cannot guarantee absolute protection of the device or its data. System-side Android Vitals reports and any external email application you voluntarily use are separate from this local app path.

Changes and Updates

We kindly ask you to inform yourself regularly about the contents of our data protection declaration. We will adjust the privacy policy as changes in our data processing practices make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, we ask you to note that addresses may change over time and to verify the information before contacting us.

German supervisory authority responsible for the controller:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Wilhelmstraße 7
65185 Wiesbaden, Germany

Swiss data protection supervisory authority:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Berne, Switzerland

Google Play, Android Vitals, Reviews and Support

Google Play: distribution, purchase and updates

Curalbum is distributed through Google Play. For users in the European Economic Area and Switzerland, Google Play is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; under the Google Play Terms of Service, content is offered by Google Commerce Limited at the same address. In connection with store access, download, installation, updates and a paid acquisition, Google processes in its own responsibility account, device, usage, purchase and payment information in particular. Google describes details, retention periods, recipients and possible international processing in its Privacy Policy and the Google Play Terms of Service.

Curalbum has no proprietary account, backend or embedded billing SDK. In particular, the app does not receive card or bank details. If purchases occur after publication, authorised operator accounts in Google Play may be able to access information including the order number, purchased item, amount, currency, taxes and fees, order status, dates and order history, as well as financial reports; Google’s functions also allow a specific order to be searched for using the purchaser’s full email address. We process such data only where necessary to manage the offering, verify or refund a purchase, perform accounting, comply with legal obligations, or establish, exercise or defend legal claims. The legal bases, where applicable in each case, are Article 6(1)(b), (c) and (f) GDPR. Data is deleted once these purposes and applicable statutory retention or evidentiary obligations cease to apply. The data visible for an actual Curalbum purchase will be reviewed again after any test purchase; no additional customer data is assumed in advance.

Android Vitals

Android Vitals is an Android-system and Google Play function, not an analytics or crash-reporting SDK embedded in Curalbum. On supported devices whose users have enabled the automatic sharing of usage and diagnostics data in Android, Android records technical quality events. These may include crashes and application-not-responding events with clusters and stack traces, start-up and rendering performance, battery and wake-lock metrics, permission denials, and technical dimensions such as the app version, Android version, form factor and device model. Where there is sufficient data, Google Play may make aggregated or cluster-based reports available to us in Play Console or through the Play Developer Reporting API.

We use accessible Android Vitals reports solely to assess the stability, performance, compatibility and security of Curalbum and to resolve technical faults. This is based on our legitimate interest in a secure and functional product under Article 6(1)(f) GDPR. Curalbum itself does not transmit photos, image files or support attachments for this purpose. You can manage the Android setting for sharing usage and diagnostics data on your device. Google’s own processing and retention are governed by Google’s information; we do not describe the periods displayed in developer tools as Google’s complete deletion periods.

Public reviews on Google Play

If you rate or review Curalbum on Google Play, you publish that information through Google rather than through a confidential Curalbum support channel. Depending on your Google settings, your account name and account picture may appear publicly alongside the star rating and text. In Play Console, we may additionally be shown information including the time, language, app and device version, helpful votes, and changes to the review and response. We may respond publicly and with data minimisation in order to address feedback and improve the app; this is based on Article 6(1)(f) GDPR. We do not create our own permanent copies of public reviews as a standard practice. Please do not publish confidential information there. For confidential requests, use hello@curalbum.app.

Email support

Support for Curalbum is provided exclusively by email at hello@curalbum.app. The app does not transmit anything automatically for this purpose. If you write to us, we process your sender and recipient address, your name where provided, the subject, message, time information and technical email or routing information. We process photos, screenshots or diagnostic files only if you voluntarily attach them and solely to handle your specific request. The legal basis is Article 6(1)(b) GDPR where handling is necessary for a contract or pre-contractual steps requested by you, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in answering enquiries, investigating faults, and handling misuse or claims. Article 6(1)(c) GDPR applies where a specific legal obligation exists.

The mailbox is operated by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, under a data-processing agreement. ALL-INKL identifies Neue Medien Münnich GmbH at the same address as an internal service provider with necessary access. Mailbox content, email traffic data and the daily full-system backups described by the provider are processed in Germany. For people in Switzerland, Germany is a foreign processing country with adequate data protection under Annex 1 of the Swiss Data Protection Ordinance. Email providers and transmission points used by you or the recipient may also take part in transport; their processing locations depend on your address and provider choice. Ordinary email is generally not end-to-end encrypted. Deleted messages may temporarily remain in full-system backups until they are overwritten in the ordinary backup cycle; no unsupported fixed backup deletion period is promised.

Please do not send confidential details that are not required and redact screenshots or diagnostic data where possible. We promptly delete recognisably unnecessary sensitive details or information about third parties and, where necessary, ask for a redacted description. Voluntary transmission alone does not permit any further use of particularly sensitive content. The remaining support correspondence, including necessary attachments, is deleted once the request has been conclusively resolved and no follow-up is expected. It is kept for longer only where required by a specific statutory retention obligation or for the establishment, exercise or defence of legal claims. On our side, access is restricted to the operator and people directly involved in handling the request; this does not affect the mailbox provider’s technical access possibilities described above.