Privacy Policy

What stays on your phone and what is sent

Pruna is available for iPhone and for Android phones. It helps you review and clean up the photos, videos, contacts and calendar events on your phone, and keeps private photos and contacts in an encrypted vault. It has no accounts and no advertising.

Your photos, videos, contacts, calendar events and vault never leave your device through Pruna — all analysis happens on the phone itself. This policy describes what the app stores, what it sends and to whom. Where the iPhone and Android versions differ, it says so.

What Pruna sends is limited to usage events linked to a random identifier, diagnostics and crash reports, subscription information and which of our own campaigns led to your download, as described below. We never receive your photos, videos, contacts, calendar events, vault contents or vault PIN.

Photos and videos

With your permission, Pruna reads your photo library to find duplicates, similar shots, screenshots, screen recordings, large videos, Live Photos or motion photos, and blurry or dark photos. On iPhone you can give full or limited access and change it at any time in iOS Settings. On Android you can allow access to all photos and videos or, on Android 14 and later, to selected ones, and change it in Android Settings; with photo access Android also asks whether Pruna may read the location saved in your photos and videos, which Pruna uses only to keep that location in compressed videos and in still photos it saves for you.

To do this Pruna keeps, on your device only:

• file sizes, dates and media types;
• visual fingerprints and quality scores computed on the device — by Apple’s Vision framework on iPhone, and on Android by an image model and Google’s ML Kit face detection that are built into the app, plus a compact image hash. They describe how photos resemble each other and how sharp they are or whether eyes are open; they do not recognize who is in a photo and cannot be turned back into the photos;
• your choices, such as photos you chose to keep and your swipe decisions;
• which videos you compressed with Pruna, so they are not offered again;
• a log of your cleanups (date, number of items and their size).

This cache is excluded from device backups and is removed when you delete the app.

How suggestions are made

Pruna’s suggestions, such as duplicates, similar shots and blurry or dark photos, are made automatically by software that runs on your phone: Apple’s Vision framework on iPhone, and the image model and ML Kit face detection built into the app on Android. No photo, fingerprint or score is sent to us or to any AI service for this, and your photos are not used to train any model.

Suggestions are estimates and can be wrong. They are only proposals: nothing is removed until you confirm it.

Deleting photos and videos

When you delete photos or videos, Pruna asks the system to move them, after you confirm in the system prompt:

• On iPhone to the Recently Deleted album of the Photos app. They stay there for 30 days unless you empty the album. If you use iCloud Photos, deletions apply to all your devices signed in to the same Apple Account. Showing a preview of a photo that is stored only in iCloud may make iOS download it from Apple; that transfer is between your device and Apple.
• On Android to the trash of your phone. They stay there for 30 days unless you empty the trash. Copies kept by a cloud photo service, such as Google Photos, follow that service’s own settings.

A number of deletions needs no subscription. To show how many are left, Pruna counts the photos and videos you delete without one, and keeps only that number on your phone, where it stays when you delete the app: on iPhone in the iOS Keychain, for this device only; on Android in Google Play services’ Block Store, with cloud backup turned off (Android may copy it to a new phone when you transfer your data from phone to phone). It is never sent to us or to the services below.

Compressing videos

When you compress videos, Pruna re-encodes them on your phone; they are not uploaded. On iPhone, if a video you chose is stored only in iCloud, Pruna asks first and downloads it from Apple only if you agree (and says so when you are on mobile data); otherwise it skips that video. The compressed files wait in the app’s storage on your device, excluded from backups, until you save or discard them, and are deleted after 7 days if you do neither. Saving adds the compressed copies to your photo library with the original’s date and favorite mark and its location (on Android, when you allowed Pruna to read it); unless you choose to keep the originals, they move to Recently Deleted or the trash like other deletions, after you confirm in the system prompt. On Android a notification shows the progress while videos are compressed; it names no videos.

Contacts

Pruna asks for access to your contacts only when you open the Contacts section or add contacts to the vault. It reads them on your device to find duplicates and entries without a name or number. Before every merge or deletion it writes a backup of the affected contacts (a vCard file) in the app’s storage on your device; it keeps the ten most recent backups, which you can restore or delete in Settings. These backups are part of your device backup according to your settings — iCloud Backup or a computer backup on iPhone, Google’s backup and device transfer on Android.

On iPhone, Pruna does not read or write contact notes. On Android, it reads the contact details in accounts it can edit (names, phone numbers, email and postal addresses, websites, dates, notes and photos); when you merge, the details of the other entries, notes included, move to the entry that stays, and backups include them. Android backups record which account a contact belonged to as a one-way code, not as the account’s name or address.

Calendars

Pruna asks for access to your calendars only when you open the Calendar section. It reads past events on your device to list ones you may want to remove; events that have not ended, repeating events that are still going on and calendars you cannot edit are never offered. On Android it reads invitee addresses only to tell meetings apart from your own events; meetings are never selected for you. Before every deletion Pruna writes a backup of the affected events (an .ics file) in the app’s storage on your device, kept like contact backups. Depending on your calendar provider, deleting an event you organized may send a cancellation to its invitees; that is done by your calendar service, not by Pruna.

Vault

Items you add to the vault are encrypted on your device (AES-GCM) before they are stored.

• On iPhone the key is protected by your PIN and by the iOS Keychain; if you turn on Face ID, iOS performs the check. Encrypted vault files are included in your device backups; without your PIN (or your iPhone passcode for recovery) they cannot be opened.
• On Android the key is protected by your PIN and by the Android Keystore; if you turn on fingerprint or face unlock, Android performs the check, and your screen lock lets you set a new PIN. The vault’s screens cannot be captured in screenshots or recordings. The vault is not included in Google’s backup or device transfer: to move it to another phone you export it to a file protected by a separate passphrase that you choose.

Pruna never receives your biometric data. We cannot open, recover or reset your vault. Deleting the app or erasing the vault deletes its contents.

Storage information

Pruna reads your phone’s total and available storage to check there is enough space before adding items to the vault or compressing videos (on Android also before saving still photos), and tells you if there is not. These values are never sent anywhere.

Analytics

To understand which features are used and where the app fails, release versions of Pruna send usage events to Mixpanel, linked to a random identifier of your installation, with data stored in the European Union. An event names an action (for example “scan finished” or “paywall viewed”) and carries only coarse ranges and options — such as “100–999 photos” or “1–5 GB” — never exact counts or sizes, photo or file names, identifiers of your photos, contacts or events, or your storage capacity. Each event also includes the app version and build, the app language and technical details that Mixpanel’s library adds: on iPhone your device model, iOS version and screen size; on Android your device’s manufacturer, brand and model, Android version, screen size and density, mobile carrier name, and whether Wi-Fi, Bluetooth, NFC and telephony are available.

Mixpanel identifies an installation by a random identifier created on your device; it is not linked to your name, Apple Account, Google Account or advertising identifier. Mixpanel’s servers receive your IP address when events are sent; the app asks Mixpanel not to use it to determine your location. The app also gives this random identifier to RevenueCat, so that the subscription events RevenueCat records — such as a trial starting or ending, a renewal, a cancellation or a refund, with the plan and its price — are added to the same installation’s identifier in Mixpanel.

On Android, Google’s ML Kit, which scores faces on the phone, sends Google diagnostic information about its own operation — device and app information, a per-installation identifier, performance measurements, settings such as image size and format, and error codes. It contains no photos and no analysis results. See Google’s ML Kit data disclosure at https://developers.google.com/ml-kit/android-data-disclosure.

Crash reports

Release versions send crash reports, error reports and a sample of performance measurements to Sentry. They contain technical information — the app version, device model, operating system version and the state of the app code when the problem occurred. Pruna turns off Sentry’s collection of personal information and does not attach screenshots or screen contents. On iPhone, diagnostics that iOS provides to the app (MetricKit) are added to these reports; on Android, reports also cover the app not responding.

Sentry stores these reports in its European Union region.

Subscriptions and campaign information

Apple (on the App Store) or Google (on Google Play) handles payments. RevenueCat processes an app-specific random customer identifier, your purchase and subscription history, device and app technical information and paywall interactions to verify access, restore purchases and provide subscription reporting. These services require internet access and may receive your public IP address. We do not receive payment-card details. RevenueCat acts as our service provider; removing the app does not delete its purchase records.

On iPhone, if you installed Pruna after tapping an Apple Search Ads ad in the App Store, RevenueCat receives from Apple which of our ad campaigns, ad groups and search keywords led to the download (Apple’s AdServices attribution). Pruna sends RevenueCat a token from iOS for this; it does not use your advertising identifier and does not ask for permission to track, because Apple provides this attribution without tracking. We use it only to see which of our own ads work.

On Android, if you reached Google Play through a link from one of our campaigns, Pruna reads once, from Google Play’s install referrer, the campaign’s source, medium and name (the link’s utm_source, utm_medium and utm_campaign values) and passes them to RevenueCat and Mixpanel with the random identifiers above. It reads nothing else from the referrer — no ad click identifier and no install time — and does not use your advertising identifier. We use it only to see which of our own campaigns work.

Pruna does not track you across apps or websites, does not show advertising, does not use your advertising identifier and does not sell or share personal information. The Apple Search Ads attribution and the Google Play campaign information described above tell us only which of our own ads or campaign links led to a download.

Support

If you email info@odbs.tech, your email address and the information you provide are used only to answer you. Do not send photos, contact details or vault PINs in support messages.

Service providers and where data is processed

• Apple — App Store purchases, iCloud Photos, device backups (iPhone).
• Google — Google Play purchases and install referrer, Android backups and device transfer, Block Store, ML Kit diagnostics (Android).
• RevenueCat — subscription verification and reporting, Apple Search Ads attribution (iPhone), install campaign information (Android).
• Mixpanel — usage analytics linked to a random identifier (EU data residency), install campaign information (Android).
• Sentry — crash and error reports, in its European Union region.

Apple, Google and RevenueCat may process this data in the United States and other countries. Apple and Google provide their stores, backups and photo services to you under their own privacy policies.

How long data is kept

• Scan results, fingerprints, scores, your choices and the log of your cleanups: on your phone until you delete the app; they are not part of device backups.
• Compressed videos you have neither saved nor discarded: deleted after 7 days.
• Contact and calendar backups: the ten most recent of each, on your phone until you delete them in Settings or delete the app; they are part of your device backup according to your settings.
• Vault: until you erase it or delete the app; on iPhone, the encrypted vault files are also part of your device backups.
• The count of deletions made without a subscription: on your phone, also after you delete the app, as described under Deleting photos and videos.
• Analytics events, diagnostics and crash reports: kept by Mixpanel, Sentry and Google only as long as needed to understand and improve the app, under their retention settings.
• Subscription and purchase records: kept by Apple, Google and RevenueCat for as long as needed for billing, tax and accounting obligations; removing the app does not delete them.

Your choices in Pruna

• Photos, contacts, calendars, Face ID, fingerprint or face unlock: you can give or revoke access at any time in iOS Settings or Android Settings.
• Contact and calendar backups: restore or delete them in Settings › Contact backups and Settings › Calendar backups.
• Vault: change your PIN or how you unlock it, or erase the vault and its keys for good, in Vault settings; on Android you can also export it there to a file protected by a passphrase.
• Subscription: Settings › Manage subscription and Restore purchases; you can also cancel in your Apple Account or Google Play settings.
• Analytics and crash reports: Pruna has no switch to turn them off; you can stop them from being sent by deleting the app.
• Pruna has no account, so there is no account to delete. Because the data we receive is not tied to your identity, if you contact us, we will help as far as your request can be matched to data we hold.

Legal bases for Pruna

• Analysing your library, contacts and calendars, the vault, compression and backups: performance of our contract with you. This happens on your phone, and we do not receive the data.
• Checking your subscription, restoring purchases and counting deletions made without a subscription: contract.
• Usage events, subscription reporting and the campaign that led to your download: our legitimate interests in understanding how Pruna is used and which of our own campaigns work.
• Crash reports and diagnostics, including ML Kit’s: our legitimate interests in keeping Pruna working and secure.
• Answering your e-mails: our legitimate interests in helping you, or contract where your request concerns your purchase.
• Keeping purchase records: legal obligation.