Privacy Policy

1. The short version

Softbox is a gallery and photo editor. Browsing, searching and editing your photos and videos happen on your phone and nothing is uploaded for them. This includes the AI masks (subject, sky, background, people): the model runs on your phone, only the model file is downloaded once (from Google Play or our CDN), and no photo leaves the device for it.

Your library originals never reach our servers in readable form; device-to-device transfers are end-to-end encrypted; only the photo you send to AI is readable, for that generation. We do not scan your photos. No photo of yours is analysed by us or by anyone on our behalf unless you send it to an AI feature yourself, and that one photo is checked for safety for that request only.

A photo leaves your phone only when you choose it for an online action: AI generation (Studio), Auto-describe, or a profile picture. The first time, the app asks you for consent and names the providers; you can withdraw it in Settings, Privacy. An account is optional; you only need one for those online actions and for buying a plan. We do not run ads, we do not sell data, we never use your content to train AI models, and the app contains no analytics or advertising SDK. The AI features (Studio, Enhance, Auto-describe) are AI systems and are labelled as such in the app.

2. Who is responsible (controller)

Tincograph DOOEL, North Macedonia (registration in progress):

• Name: [DOOEL]
• Seat address: [DOOEL]
• Company number (ЕМБС): [DOOEL]
• Tax number (ЕДБ): [DOOEL]
• Managing director: [DOOEL]

Privacy contact: [email protected]. We have not appointed a data protection officer; privacy questions go to this address. Representative in the EU under Art. 27 GDPR: [EU-REP] (to be appointed; until then, account features are not offered in the EU/EEA, the United Kingdom or Switzerland).

3. What we process, why, and on what legal basis

Data	Purpose	Legal basis (GDPR)
Email address, display name, username, password hash, 2FA material, account id	create and secure your account, sign you in, send account and security mail	Art. 6(1)(b) contract
Sign-up human check (Cloudflare Turnstile: browser signals and IP address)	stop bots at sign-up, email code and password reset	Art. 6(1)(f) legitimate interest (security)
Device record: label, OS version, app name, a public key generated on your phone, last-seen time	show and revoke your devices, security	Art. 6(1)(b), (f)
Library index you publish (media ids, fingerprints, sizes, dimensions, dates, file names; never the pictures) — on by default when signed in, off in Settings, Privacy	show your other devices what this device holds, so a photo can be fetched from it	Art. 6(1)(b)
Device-to-device transfer records (which file goes to which of your devices, its hash, file name) and, when a direct connection is impossible, the encrypted file in transit; delete-everywhere lists	move or copy originals between your own devices, delete them everywhere you ask	Art. 6(1)(b)
Plan, subscription status, purchase token, order id (from Google Play or Paddle)	grant the plan you bought, restore it, handle renewals and refunds	Art. 6(1)(b); invoices: Art. 6(1)(c) legal obligation
One credit pool: grants, holds, charges, refunds, pack purchases, expiry dates	keep your balance accurate and auditable across apps and stores	Art. 6(1)(b), (f)
Your AI consent (the date you allowed uploads to AI providers, and a withdrawal)	prove that you agreed before the first upload	Art. 6(1)(c), (f)
A photo you choose for AI generation, your prompt (up to 1000 characters) and settings, and the results	make the image you asked for, store it in your account, check it for safety	Art. 6(1)(b)
A photo you choose for Auto-describe	suggest a description or prompt for it; the photo is not stored	Art. 6(1)(b)
Profile picture (optional, public)	show it on your profile	Art. 6(1)(a) consent (you set it)
Prompt text sent by Enhance	rewrite your prompt	Art. 6(1)(b)
Prompts the filter refused (text, category, time)	let a person look at an account with repeated severe refusals; nothing is generated and nothing is charged	Art. 6(1)(f)
Reports you file on a result; reports anyone files at tincograph.com/report (reason, contact details, statement of good faith); safety-check verdicts	moderation, notice and action, the statement of reasons	Art. 6(1)(c), (f)
Moderation records: strikes, restrictions, statements of reasons, your appeal (up to 1 000 characters) and the decision	apply the rules in section 7 of the Terms, let you appeal, show you the outcome	Art. 6(1)(c), (f)
Support messages	answer you	Art. 6(1)(b), (f)
Crash and error reports: redacted message and stack, app version, screen, user agent, IP address as a rate-limit key, and your account id only if you are signed in. Emails, tokens and file paths are redacted before storage; never photos, prompts or file names	find and fix crashes, protect the endpoint from floods	Art. 6(1)(f)
Rate-limit counters	brute-force and abuse protection	Art. 6(1)(f)
Account-deletion requests (email, hashed code)	carry out your deletion request	Art. 6(1)(b), (c)

Never collected: your location (GPS in your photos is read on the device for the info sheet only and is removed before any upload to us or to an AI provider; originals you move between your own devices travel encrypted and unchanged), your contacts, your library in bulk, advertising identifiers. Photos sent to AI are uploaded without EXIF, GPS or other metadata (removed on the phone, removed again on our server). Softbox never scans your library, for any purpose.

A full table per data item (where stored, processor, retention) is in our internal data map; the retention periods are listed in section 7.

4. Who processes data for us (processors and recipients)

Processor	What it does	Where	Transfer mechanism
Supabase	database, sign-in, server functions	EU (Frankfurt)	stays in the EEA; data processing agreement
Cloudflare	website hosting (Pages), file storage (R2), CDN, Turnstile bot check, Email Routing	global edge network; storage in the EU	data processing agreement with Standard Contractual Clauses, EU-US Data Privacy Framework
fal.ai	runs the AI generation model (Google’s Nano Banana Pro) on the photo and prompt you send	United States	Standard Contractual Clauses / Data Privacy Framework
OpenRouter and the model providers it routes to (the safety check runs on Z.ai’s GLM)	safety check of photos, prompts and results; the prompt Enhance; Auto-describe	United States and others	Standard Contractual Clauses / Data Privacy Framework; the safety check is routed only to providers that do not collect the data (data_collection: deny)
Google Play (Asset Delivery)	delivers the on-device AI model files to the app	worldwide	Google is an independent controller for store data
Resend	sends account, receipt, moderation and deletion emails	United States / EU	Standard Contractual Clauses / Data Privacy Framework
Paddle	merchant of record for purchases on tincograph.com: takes payment, issues invoices, handles tax and refunds	United Kingdom / EU	Paddle is an independent controller for payment data; we receive customer id, plan and status
Google Play	processes purchases made in the app and sends us a purchase token	worldwide	Google is an independent controller for store data
Google (Sign-In)	only if you choose “Continue with Google”; we receive your email and name	worldwide	Google is an independent controller for your Google account

We do not sell personal data and we do not share it with third parties for their own use. The processors above act on our instructions. Card and bank details never reach us.

Transfers outside the EEA rely on the mechanisms in the table (Standard Contractual Clauses and/or the EU-US Data Privacy Framework). You can ask [email protected] for a copy of the safeguards. [EU-REP: the sentence naming the safeguard for access to EU-stored data from North Macedonia, where Tincograph itself is established, is added once the representative is appointed and counsel has confirmed the mechanism.]

5. AI generation, Enhance and Auto-describe

Nothing is uploaded until you tap Generate, and never before you have given your consent once (Settings, Privacy, AI uploads; you can withdraw it there). Three checks run on every request:

1. On your phone, before upload: the prompt goes through a word filter, and the photo is checked on the device for a person combined with nudity. A photo that fails is never sent anywhere.
2. On our server: the photo is stripped of EXIF/GPS on the phone and re-encoded on our server (at most 2048 px, all metadata dropped), then the photo and the prompt are checked by an automated safety service.
3. The result: every result is checked before you see it. A result that fails is discarded, never stored or shown, and your credits are released.

The checks refuse nude or sexual content of anyone, anything sexualising a minor, gore, intimate images of a real person without consent, and real public figures in sexual, violent or deceptive scenes. Generation runs at fal.ai. Results are stored in your account for you and you can delete each one at any time; every result can be reported, by you in the app and by anyone at tincograph.com/report.

Enhance sends only your prompt text to our server, which forwards it to a model provider. We log one line per request (account id, model, provider, token counts) but not the text. Auto-describe sends the photo you chose (stripped the same way) to a vision model to suggest a description; the photo is not stored.

We never use your photos, prompts or results to train AI models, and our providers are not permitted to.

6. Labelling of AI content

Generated results carry a content credential (C2PA) where the format allows it and are shown with a visible AI label inside Softbox. Exports from the editor record which edits were made, including AI ones. Studio, Enhance and Auto-describe are labelled as AI where you use them.

7. How long we keep data

Data	Kept until
Account, profile, devices, plan, credit records, Studio uploads and results, profile picture, library index, transfer records	the account is deleted: 14 days after your request, rows removed within the hour, files within about one further hour
A single Studio result	you delete it (file removed at once) or the account is deleted
The prompt of a generation	with the generation, and 90 days after you delete the generation (it is needed to review a report about it); gone with the account
Prompts the filter refused	90 days
Unconfirmed sign-ups	7 days
Crash and error reports	30 days (reports linked to an account are also removed with it)
Rate-limit counters	minutes to one hour
Support messages	with the account (or on request for non-account senders)
Reports, moderation records and appeals	3 years after the decision; the link to your account is removed with the account. Evidence of sexual content involving a minor is preserved as the law requires, with restricted access
Invoices and payment records	held by Paddle / Google as tax law requires (commonly 6 to 10 years); we keep none ourselves beyond the plan state
An anonymous deletion receipt and an anonymous running total of our provider costs	no limit, contains no personal data
Anonymous yearly counts of reports, decisions and appeals for the transparency page	no limit, contains no personal data
Email suppression list (bounced or unsubscribed addresses)	as long as needed so we do not mail the address again

Data on your phone stays there until you delete it or uninstall. The copies of generations in DCIM/Softbox/Generations stay after uninstall; delete them in your gallery app. Photos you delete in Softbox go to the app’s trash first and are removed for good after 30 days, or earlier if you empty it.

8. Your rights

You have the right to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interest, and to withdraw consent at any time. Two you can use yourself: export (account page, a JSON copy of everything keyed to your account, including download links for your files) and deletion (in the app: Profile, Delete account; or without the app at tincograph.com/account-deletion). For anything else write to [email protected]; we answer within one month. You can complain to a supervisory authority, for example in your country of residence.

You are not subject to decisions based solely on automated processing that significantly affect you. The automated checks can refuse a single upload, prompt or result; nothing is charged when they do. A decision to restrict your account is always taken by a person, comes with a statement of reasons, and can be appealed in the app (Terms, section 7); a person decides the appeal.

9. Children

Softbox is not directed at children. You must be at least 18 years old to create an account. Where Google Play tells us that an account belongs to a minor, AI generation and purchases are off. We do not knowingly collect data from children; if you think we did, write to [email protected] and we will delete it.

10. Security

Your library originals never reach our servers in readable form; device-to-device transfers are end-to-end encrypted; only the photo you send to AI is readable, for that generation. A transfer between your devices is sealed on the sending phone with a key that only the receiving phone can open; when it has to be staged on our servers it is stored encrypted and we cannot read it.

All traffic uses HTTPS. Access to your rows is enforced in the database (row-level security), not only in application code. The private keys of your device never leave the phone’s secure storage. Two-factor authentication is available. No system is perfectly safe; if a breach affects you we will tell you as the law requires (our incident plan commits us to notifying the supervisory authority within 72 hours).

11. Google user data

If you sign in with Google, Softbox receives your Google account email address and name through Google Sign-In, with the email scope only. We use them only to create and secure your Tincograph account and to send you account mail. We do not share Google user data with anyone for their own use, we do not use it for advertising and we do not transfer it except to our processors listed above to provide the service. Softbox’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove the Google link by deleting your account.

12. Cookies and the website

tincograph.com sets no cookies and loads no third-party trackers. The language selector stores your choice in your browser’s local storage; this is strictly functional and needs no consent. If we enable the cookieless Cloudflare Web Analytics, it does not fingerprint or track individuals across sites.

13. Changes

If this policy changes materially we tell you in the app or by email before the change takes effect. The date above is the current version.

Draft, legal review pending. [DOOEL] fields are filled when the company is registered; [EU-REP] fields when the EU representative is appointed.