Criba is an app for iPhone, iPad and Android that helps you clean up your photo library by swiping photos to keep or delete them. This policy covers both versions (App Store and Google Play) and explains, in plain language, what data is processed, for what purpose, on what legal basis and what rights you have under the General Data Protection Regulation (GDPR). Where something differs by platform, it says so.
The main idea: your photos never leave your device. Criba has no server of its own, no user accounts, no ads, and it does not sell or share data for advertising.
1. Data controller
The controller is Criba's developer (David Miguel Reina Poyatos, an individual developer established in Spain). For any privacy question, write to david@usecriba.app.
2. What data is processed and where
Data that stays on your device
Criba accesses your photos with the permission you grant on first use: on iPhone and iPad, through Apple's PhotoKit framework; on Android, through the system media library (MediaStore). Everything it does with that access happens on your device:
- Photos and videos are displayed, played and, when you confirm, moved to the system trash (Recently Deleted in the Photos app on iPhone and iPad; the gallery's trash on Android, where they stay for 30 days) or marked as favorites. They are never copied or uploaded to any server.
- Your decisions (what you kept, what is in the trash, daily streak) are stored locally so you can pick up where you left off and for the widgets.
- Library analysis (documents and receipts, blurry photos, duplicate and similar photos) runs on the device itself, with Apple's Vision framework on iPhone and iPad, and with Google's ML Kit and MediaPipe on Android. The result is a list of local identifiers stored in the app.
- Settings (sort order, content type, chosen album) and the state of the free daily limit.
This data disappears if you delete the app, unless it is part of your own device backups. None of it is accessible to us.
Data that leaves the device
These are the cases, and none of them includes your photos:
- Place names. To show the location chip (“Cádiz”, “Picos de Europa”), Criba sends the photo's GPS coordinates to the system's reverse geocoding service and receives a name: Apple Maps on iPhone and iPad, and Google's geocoder on Android. Your device makes that request directly, under Apple's or Google's privacy guarantees; we never see it. The result is cached on the device to avoid repeat lookups.
- The places map. The map in Explore is drawn by Apple Maps on iPhone and iPad, and by Google Maps on Android. To download the map, the service receives the area you are viewing and technical device data; the Google Maps SDK also collects the IP address, a pseudonymous identifier, its own errors and how you use the map. The photos shown on the map are drawn on your device and are not sent.
- Analysis diagnostics (Android only). ML Kit and MediaPipe, the Google components that run the analysis on the phone, send Google technical data about how they are working (device model, app version, response times, errors and a per-installation identifier). They never send the photos or the result of the analysis.
- Purchases. If you upgrade to Criba Pro, the purchase is processed by Apple through the App Store or by Google through Google Play. To validate the purchase and restore it across devices we use RevenueCat, which receives an anonymous identifier generated by the app, the purchase receipt or token and technical device data (model, OS version, language). It does not receive your name, email or photos. If you answer “How did you hear about Criba?”, the answer is also stored in RevenueCat with that anonymous identifier, so we can tell which channel brings people who buy. On iPhone and iPad only: if you installed Criba from an Apple ad in the App Store, RevenueCat receives from Apple, through its attribution system (AdServices), which campaign it was, without the advertising identifier (IDFA) and without tracking you across apps. The Android version does not use the advertising ID.
- Anonymous usage statistics. To learn which features are used and where to improve, Criba sends TelemetryDeck (a German company with servers in the EU) events such as “Explore opened”, “Pro screen viewed” or “11 to 50 photos reviewed”, with counts always in ranges. Each event carries technical data (model, OS and app version, language) and an identifier that is turned into an irreversible code (a hash) before sending: it cannot reveal who you are or link you across other apps. It includes nothing from your photos: no images, dates, places or sizes. You can turn it off in Criba → Settings → Anonymous usage statistics. Once, Criba asks how you heard about it (TikTok, a friend, the store…): if you answer, the answer is sent with these statistics; with them turned off, you are not asked.
- Crash reports. If Criba closes because of an error, freezes or the system closes it for lack of memory, it sends a report to Sentry (EU region, servers in Germany) so we can fix it: where in the code it happened, technical device data at that moment (model, OS and app version, free memory), the most recent usage events from the previous point and a random installation identifier that is not linked to you. It includes no screenshots and nothing from your photos. It is turned off with the same switch in Criba → Settings → Anonymous usage statistics.
3. Purposes and legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Display and manage your library | Photos, videos, metadata (date, location, size) | Performance of a contract (Art. 6(1)(b) GDPR), on device |
| Show the place name | Photo coordinates | Performance of a contract (Art. 6(1)(b)) |
| Show the places map | Map area you view, technical data, IP address (Google Maps on Android) | Performance of a contract (Art. 6(1)(b)) |
| Keep the on-device analysis working (Android) | ML Kit and MediaPipe technical diagnostics, per-installation identifier | Legitimate interest (Art. 6(1)(f)) |
| Manage Criba Pro | Anonymous identifier, purchase receipt or token, technical data | Performance of a contract (Art. 6(1)(b)) |
| Improve the app with usage statistics | Usage events, irreversible identifier, technical data | Legitimate interest (Art. 6(1)(f)), with an opt-out in the app |
| Detect and fix crashes | Crash report, installation identifier, technical data | Legitimate interest (Art. 6(1)(f)), with an opt-out in the app |
Criba does not use advertising or cross-app tracking SDKs, does not build profiles and makes no automated decisions with effects on you.
4. Processors and international transfers
Apple Inc. (App Store, purchases and Apple Maps on iPhone and iPad) and Google LLC / Google Ireland Ltd. (Google Play, purchases, Google Maps, the geocoder, ML Kit and MediaPipe on Android) act as processors or independent controllers as applicable. RevenueCat Inc. (purchase management) is based in the United States. Functional Software, Inc. (Sentry, crash reports) is a processor based in the United States, with the data stored in its EU region (Germany). TelemetryDeck GmbH (usage statistics) is a processor based in Germany, with servers in the EU. Transfers to the United States rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
5. Retention
Local data lives as long as the app is installed. Purchase data at RevenueCat is kept while the subscription or lifetime purchase exists and for the legally required billing periods. Usage statistics are kept for a maximum of 3 months and crash reports for 30 days. The place-name cache is cleared by deleting the app. What Apple and Google collect in their own services is governed by their own privacy policies.
6. Your rights
You have the right to access, rectify, erase, object to, restrict the processing of and port your data. Since almost everything is on your device, you exercise most of them directly: by revoking the photos permission (on iPhone and iPad, in Settings → Privacy; on Android, in Settings → Apps → Criba → Permissions), by clearing the app's data or by uninstalling it. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority.
7. How to ask us to delete your data
Criba has no accounts, so there is nothing to close. The only things the services we use keep are purchase data (RevenueCat), usage statistics (TelemetryDeck) and crash reports (Sentry), all linked to anonymous identifiers. To ask us to delete them:
- Open Criba → Settings → Email us. The email it prepares includes your installation's anonymous identifier, which is what we need to find your data.
- Write that you want us to delete your data and send it to david@usecriba.app. If you no longer have the app, write anyway and we will tell you how to identify yourself.
- We delete your customer record in RevenueCat and your reports in Sentry, and confirm the deletion within 30 days at most. TelemetryDeck statistics cannot be linked to you and are deleted automatically after 3 months.
The purchases themselves remain recorded in the App Store or Google Play, because Apple and Google manage them, and receipts are kept for as long as billing law requires. To stop Criba from sending statistics and crash reports right away, turn off Settings → Anonymous usage statistics.
8. Children
Criba is not directed at children under 14 and does not knowingly collect their data.
9. This website
usecriba.app is hosted on Vercel and uses Vercel Analytics and Vercel Speed Insights: cookieless measurement of visits and page speed that does not identify individuals. There are no forms or accounts.
If you arrive through a campaign link (an Instagram story, for example), your browser stores the name of that campaign for 7 days, with no identifier, so it can be added to the App Store or Google Play link if you tap to download the app.
It also uses TelemetryDeck to count visits and taps on the store buttons, without cookies: the visitor identifier is generated on its server and changes every day, and the IP address is not stored.
10. Changes
If this policy changes materially, it will be updated here with a new date and, where appropriate, announced inside the app.