Criba is an iPhone app that helps you clean up your photo library by swiping photos to keep or delete them. This policy explains, in plain language, what data is processed, for what purpose, on what legal basis and what rights you have under the General Data Protection Regulation (GDPR).
The main idea: your photos never leave your iPhone. Criba has no server of its own, no user accounts, no ads, and it does not sell or share data for advertising.
1. Data controller
The controller is Criba's developer (David Miguel Reina Poyatos, an individual developer established in Spain). For any privacy question, write to hola@usecriba.app.
2. What data is processed and where
Data that stays on your device
Criba accesses your photo library through Apple's PhotoKit framework, with the permission you grant on first use. Everything it does with that access happens on your iPhone:
- Photos and videos are displayed, played and, when you confirm, moved to Recently Deleted in the Photos app or marked as favorites. They are never copied or uploaded to any server.
- Your decisions (what you kept, what is in the trash, space freed, daily streak) are stored locally so you can pick up where you left off and for the widget.
- Library analysis (documents and receipts, blurry photos, similar photos) runs with Apple's Vision framework on the device itself. The result is a list of local identifiers stored in the app.
- Settings (sort order, content type, chosen album) and the state of the free daily limit.
This data disappears if you delete the app, unless it is part of your own device backups. None of it is accessible to us.
Data that leaves the device
There are only two cases, and neither includes your photos:
- Place names. To show the location chip (“Cádiz”, “Picos de Europa”), Criba sends the photo's GPS coordinates to Apple Maps servers (reverse geocoding) and receives a name. Your device makes that request directly to Apple under Apple's own privacy guarantees; we never see it. The result is cached on the device to avoid repeat lookups.
- Purchases. If you upgrade to Criba Pro, the purchase is processed by Apple through the App Store. To validate the receipt and restore purchases across devices we use RevenueCat, which receives an anonymous identifier generated by the app, the purchase receipt and technical device data (model, iOS version, language). It does not receive your name, email or photos.
3. Purposes and legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Display and manage your library | Photos, videos, metadata (date, location, size) | Performance of a contract (Art. 6(1)(b) GDPR), on device |
| Show the place name | Photo coordinates | Performance of a contract (Art. 6(1)(b)) |
| Manage Criba Pro | Anonymous identifier, receipt, technical data | Performance of a contract (Art. 6(1)(b)) |
Criba does not use analytics or advertising SDKs, does not build profiles and makes no automated decisions with effects on you.
4. Processors and international transfers
Apple Inc. (App Store, purchases, Maps) and RevenueCat Inc. (purchase management) act as processors or independent controllers as applicable, both based in the United States. Transfers rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
5. Retention
Local data lives as long as the app is installed. Purchase data at RevenueCat is kept while the subscription or lifetime purchase exists and for the legally required billing periods. The place-name cache is cleared by deleting the app.
6. Your rights
You have the right to access, rectify, erase, object to, restrict the processing of and port your data. Since almost everything is on your device, you exercise most of them directly: by revoking the Photos permission in Settings → Privacy, or by deleting the app. For purchase data, write to hola@usecriba.app. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority.
7. Children
Criba is not directed at children under 14 and does not knowingly collect their data.
8. This website
usecriba.app is hosted on Vercel and uses Vercel Analytics, a cookieless visit measurement that does not identify individuals. There are no forms or accounts.
9. Changes
If this policy changes materially, it will be updated here with a new date and, where appropriate, announced inside the app.