Spohad App — Privacy Policy

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Maksim Pashkovskij
Birkenwaldstraße 106
70191 Stuttgart, Germany
Email: contact@spohad.app

I have not appointed a data protection officer, and I am not obliged to do so. The thresholds of Article 37 GDPR and of § 38 of the German Federal Data Protection Act (BDSG) are not reached: Spohad is a one-person project with no employees, and it carries out no processing that would trigger the appointment.

2. What this policy covers

This policy applies to the mobile application “Spohad” for iOS and iPadOS, including its extensions on the iPhone (the share sheet, the Live Activity) and the remote control for the Apple Watch (together, “the App”) — to this app and to no other. Section 17 applies additionally to the spohad.app website.

It is deliberately written so that it can be understood without any legal training (Article 12(1) GDPR). If a question remains open, you can reach me at the address in section 1.

3. The principle: the App works without a server

Spohad organises files on your device. For this App I run no server that could receive your data, and — apart from the two cases named below — the App makes no request to the internet of its own accord.

Your photos, videos, documents, descriptions, tags, ratings, and sorting decisions are processed exclusively on your device. They are neither transmitted to me nor disclosed to third parties, neither sold nor transferred to a third country. I never receive them at any point.

The App has no user accounts, no registration, and no sign-in. You therefore have to identify yourself nowhere, and there is nothing I could attribute to a person or to an account.

In two cases your device nevertheless opens a connection to the outside. Neither of them originates with me, neither concerns your content, and in neither case does any data reach me:

• If a folder you have chosen sits on a network share, on a NAS, or with a cloud provider, iOS retrieves the files for you through the Files app. That connection runs between your device and your own storage; I am not part of it and learn nothing about it. The terms and the privacy notice of the provider you have chosen apply to it.
• When the App starts, and when you open the shop, make a purchase, or restore purchases, StoreKit — a component of Apple’s, not mine — contacts Apple in order to check your existing entitlements (at launch, solely whether Spohad Pro is active — it lifts the daily allowance and includes Vault encryption) and, in the shop, to retrieve prices. That exchange takes place between your device and Apple; nothing about your files or about your use of the App is part of it, and no data from it reaches me (section 4 h).

Where the App stores information on your device or reads information from it, that happens exclusively in order to provide the function you have expressly asked for; under § 25(2) no. 2 TDDDG (the German act on data protection in telecommunications and digital services) no consent is required for it. The App does not access your device in order to advertise, to measure usage, or to recognise your device again.

4. The individual processing operations

a) Photo library (Apple PhotoKit)

If you want to sort your photo library, the App requests the iOS system permission “Photos”. The request is voluntary and never happens automatically at launch; without it you can use Spohad with folders from the Files app. If you move a photo from the library into a folder, Spohad removes the original from the library — only after “Save”, and only after iOS has asked you to confirm in a dialog of its own; the photo then sits in the folder you chose. The App does not use a camera and does not add photos to your library; it requests no such permissions. Your photos never leave your device through Spohad at any point.

b) Folders (Files, iCloud Drive, external drives, network shares)

You choose the source folders yourself, through the system document picker. Spohad reads and writes exclusively in folders you have expressly selected, using the “security-scoped” access provided by Apple. A folder you have not selected is invisible to the App.

Files you send to Spohad (“Incoming”): whatever you hand to the App with “Share”, by dragging it onto the App, with “Open in Spohad”, or by placing it in the App’s folder in the Files app is copied into the “Incoming” folder in the App’s own container on your device; in the Files app it appears under “On My iPhone › Spohad”. The share sheet hands the files over through a folder it shares with the App on your device (an App Group). The files stay only on your device and are transmitted nowhere until you move them into one of your folders or delete them. Whatever is still in “Incoming” belongs to the App’s container and is deleted with it when you uninstall the App.

c) Ratings, tags, and descriptions for your files

What you assign to a file — a rating, tags, a description — Spohad does not write into the original file. It writes it into a companion file in XMP format, which is placed beside the file under the same name with the extension “.xmp”; your original file remains unchanged. These details therefore stay with the file itself: there is no central database, neither with me nor in any cloud. Nothing is written until you have confirmed the decisions you have collected with “Save”.

Tag suggestions (only if you switch them on): if you turn on “On-device tag suggestions” in the settings — the option is off after installation — the App looks at the photo on screen with the image recognition built into iOS and suggests a few tags. This recognition takes place exclusively on your device; neither the image nor the suggested tags are transmitted. A suggested tag is saved only once you choose it, and you can switch the option off again at any time.

d) Data the App stores locally

On your device the App keeps the data it needs in order to operate: the decisions collected in Changes that have not yet been carried out, cached metadata drafts, your settings, and counters that never leave the device (such as the “spohads” you have collected and your daily allowance). This data sits in the App’s protected container, can be deleted at any time, and does not leave your device.

e) Search history

Your searches inside the App are stored locally so that you can call them up again; they stay on the device. Under “Settings → Privacy” you can clear the search history completely at any time.

f) Notifications

The App’s reminders are local notifications generated on your device through the iOS system (UNUserNotificationCenter) and never push messages from a server; the App holds no push notification entitlement. Reminders are opt-in: unless you switch them on, nothing is scheduled. Scheduling a reminder triggers no network request and sends nothing from your device.

g) Vault (private area)

The Vault keeps the files you mark in one of two places, and you choose which: “Inside the app”, where Spohad encrypts them, or a “Folder in Files” of your choice, where they are not encrypted. Access inside the App is protected by the device authentication of iOS (Face ID, Touch ID, or the device passcode); the check is carried out entirely by iOS, and the App is told only whether it succeeded, never biometric data. The “unlocked” state exists in memory alone; it ends when the App is closed and, once the App has moved to the background, after the auto-lock time set for the Vault (30 seconds unless you change it).

Inside the app (encrypted). Before a file is stored here, Spohad encrypts it on your device — its content, its thumbnail, and the details that belong to it (original name, subfolder, dates, star, companion data). What remains in the App’s container are encrypted files under random names; the Files app does not show them. Only the cryptography built into iOS is used. For display, the App decrypts in memory. While a photo from your photo library is being moved into the Vault, its unencrypted data lies briefly in a folder of the App that is protected by the device’s file encryption and excluded from backups; the folder is removed as soon as the encrypted copy has been checked.

The key that opens the encrypted Vault exists in two places, both on your side: in the keychain of this device — bound to this device, readable only after Face ID, Touch ID, or the device passcode, and never carried to another device, neither through iCloud Keychain nor through a backup — and as a copy sealed with your Vault code. That copy is needed only where the key is missing on the device: on a new iPhone, after a backup has been restored onto another device, or after you have removed the device passcode. The Vault code itself is stored nowhere. So that codes cannot be tried endlessly, the App records in the keychain of the device how many wrong codes were entered in a row; that counter does not leave the device either.

I have no access to the key, to your Vault code, or to the content of the Vault. None of them is transmitted to me or to anyone else — there is no server to which they could go — and there is no back door through which I or anyone else could open the Vault without your Vault code.

Backups: the encrypted Vault belongs to the App’s container and is therefore included in the backup of your device (iCloud Backup or a backup on your computer) — only in encrypted form, together with the copy of the key sealed with your Vault code; the key from the device keychain does not travel with it to another device. iOS makes that backup, and the provider you have chosen for it (Apple, in the case of iCloud) stores it under its own terms. Without your Vault code, nobody — neither Apple nor I — can read the Vault content in it.

Folder in Files (not encrypted). Spohad does not encrypt the files in this folder. They remain visible through the Files app of iOS to anyone who can use your unlocked device; the protection inside the App’s interface is a privacy screen, not a cryptographic safe.

h) Purchases (Apple StoreKit)

Purchases are handled exclusively by Apple via the App Store and StoreKit. I receive no payment data: no card number, no billing address, no name. All the App learns from Apple is whether an entitlement is active; that check happens when the App starts and whenever your subscription changes, so that the daily allowance and Vault encryption (section 4 g) are applied correctly. Apple is independently responsible for the purchase itself; Apple’s Privacy Policy applies to it.

i) Diagnostics and “Report a Problem”

In order to track down crashes, freezes, and errors, the App places technical records in its own container: the diagnostic reports provided by iOS (MetricKit), including the stack traces, timing measurements of the most recent launches, and a log of the most recent error codes. These records contain neither filenames nor folder paths nor the content of your files. They are overwritten on a rolling basis, stay on your device, and are deleted when you uninstall the App. No automatic crash-reporting service is used.

If you tap “Report a Problem” in the settings, the App bundles the most recent of these records together with an overview — the App’s name, version, and build, your device model (such as “iPhone16,1”, not the name you have given your device), and the iOS version — into an archive and opens the iOS share sheet. The archive leaves your device only if you send it yourself, and only to the recipient you choose. A crash report created by iOS can contain text the system captured at the time of the crash; the App does not filter it. If you send the archive to me, I process it like any email (letter j), solely in order to find and fix the error.

Independently of the App, you can allow, under iOS Settings → “Privacy & Security → Analytics & Improvements”, Apple to share crash reports and usage statistics with app developers. If you have allowed that, Apple provides me with crash reports and aggregated statistics about the App; according to Apple, without any detail that identifies you. Apple collects this data under its own responsibility; you can switch the sharing off there at any time.

j) Feedback by email

If you write an email through the “Send Feedback” button, the App opens your email program with my address in it; the message is not sent until you send it yourself. It then reaches me like any other email. What is processed is what you tell me — your email address, the content of your message, any attachments, and whatever else you write into it — and solely for the purpose of replying to you and fixing a reported problem. The legal basis is Article 6(1)(f) GDPR; my legitimate interest lies in answering your enquiry and in fixing errors. Cloudflare (Email Routing) forwards emails sent to contact@spohad.app to my mailbox, which is operated by the email provider Hostinger International Ltd. (Cyprus); both act as my processors (section 7). Apart from such emails and archives and the TestFlight data described in letter l, no personal data from your use of the App reaches me.

k) Apple Watch as a remote control

If you use the remote control on the Apple Watch, the watch and the iPhone exchange, over the connection between your own devices (Apple’s WatchConnectivity), control commands and what the watch displays: the colours of the targets, a counter of decisions collected, and the state of the button. Photos, files, filenames, and folder names are not transmitted to the watch. None of it reaches me.

l) Beta testing through TestFlight

While Spohad is tested through TestFlight, Apple makes test information available to me in App Store Connect. If you were invited by email, this includes the name entered by me and the invitation address; with a public link, your name and email address normally remain hidden. I can also see the device model, operating-system version, app version and build, and aggregated session and crash information. If you voluntarily send feedback through TestFlight, I receive your comment and, if you include it, the screenshot, as well as technical information about the device and the App’s state. I receive crash reports only to the extent that Apple makes them available for TestFlight.

Apple collects and transfers this data for TestFlight under its own responsibility. I process the information available to me on the basis of Article 6(1)(f) GDPR in order to find defects in the beta, connect feedback with the relevant test setup, and improve the App before release. My legitimate interest is to run the beta safely and reliably. I do not export tester lists. When you no longer take part or the beta ends, I remove your tester data and feedback from App Store Connect as soon as they are no longer needed for unresolved defects, and no later than six months after your last test activity. Crash reports made available by Apple remain downloadable there for no more than 120 days. Statutory retention duties remain unaffected.

5. What the App does not do

• No accounts, no registration, no sign-in
• No server of mine to which anything could be sent; beyond the two cases named in section 3, no network request by the App
• No cloud AI. No image, and no detail derived from an image, is sent to me or to an AI provider, and there is no setting with which such a transfer could be switched on
• Nothing from your pictures leaves your device: whatever the App reads out of them, it computes on your device — down to the short comparison value with which the duplicate finder holds two shots against each other. The same holds for functions that later versions add
• No automatic tagging: tags are suggested only if you switch this on yourself, and none is saved without your choice. In this version the App does not assess whether a picture was generated by AI and does not look for offensive content
• No advertising. The App displays no advertising, downloads no ad material, and measures no reach
• No tracking, no profiling, and no reach or usage analytics by the App
• No advertising identifier (the IDFA is not requested) and no App Tracking Transparency prompt
• No third-party SDKs for data collection and no third-party crash-reporting service
• No location, contact, or health data
• No sale and no disclosure of data to data brokers or to any other third party
• No transfer of your content to third countries, because it never leaves your device

The “spohads” collected in the App are purely a game award. They are neither a currency nor a balance: in this App they are neither spent nor sold, and they cannot be exchanged for money.

6. Legal bases

Processing that runs entirely on your device and under your control does not reach me; I have no access to it. To the extent that a legal basis must nevertheless be named for it, it is Article 6(1)(b) GDPR: providing the functions you call up by using the App.

Access to the photo library, folders, and Face ID rests in each case on the system permission you grant in iOS and can withdraw there at any time. A withdrawal takes effect for the future; the use made until then remains unaffected.

Article 6(1)(f) GDPR applies to answering your email, reviewing an archive you send me through “Report a Problem”, and evaluating the test data available to me through TestFlight (section 4 i, j, and l). You can object to this processing under Article 21 GDPR.

Consent under Article 6(1)(a) GDPR is required nowhere in this App, because there is no processing that would go beyond the function you have called up.

7. Recipients and transfers to third countries

Personal data reaches me only if you write to me (section 4 i and j) or send information through TestFlight during the beta (section 4 l). For my email mailbox I use Hostinger International Ltd., Larnaca, Cyprus, as a processor under Article 28 GDPR. Cloudflare, Inc. forwards emails sent to contact@spohad.app to this mailbox with its Email Routing service, likewise as a processor under Article 28 GDPR; section 17 applies to processing in the United States. Apple operates TestFlight under its own responsibility. There are no further processors for this App, and in particular no analytics or advertising service provider. The spohad.app website is delivered by Cloudflare (section 17). I do not pass your data on to anyone.

Apple receives data from the purchase (section 4 h), from a backup you create through iCloud (section 4 g), from beta testing through TestFlight (section 4 l), and — if you have allowed it in iOS — from the crash and analytics data (section 4 i); Apple is independently responsible for each of these. I transmit no data to Apple.

From the App I transfer no personal data to a third country or to an international organisation. For the website, see section 17.

8. Retention

Everything the App stores sits on your device and stays there for as long as you keep it; the duration is therefore yours to determine. You remove settings and caches through “Reset App” and by clearing the search history; everything else disappears when you uninstall. This includes the encrypted Vault (section 4 g): “Reset App” and uninstalling erase it on the device; after that it exists only in device backups made earlier, and there only in encrypted form. “Reset App” also removes the Vault’s key from the keychain; the counter of wrong code entries stays, so that a reset does not lift a waiting period. iOS may keep the App’s keychain entries on the device after uninstalling; they do not leave it. The companion files that Spohad has placed beside your files on your instruction remain: they belong to you, and uninstalling does not touch them.

I delete emails and archives you write or send to me as soon as your matter has been dealt with and no statutory retention obligation stands in the way; as a rule this happens within six months.

The periods stated in section 4 l apply to TestFlight tester data and feedback.

9. Provision of data and automated decision-making

You are under neither a statutory nor a contractual obligation to provide me with personal data, and using the App does not require it either. If you do not grant a system permission, only the functions that depend on it are unavailable to you; the App remains usable otherwise.

There is no automated decision-making, including profiling, within the meaning of Article 22(1) and (4) GDPR.

10. Data security

The App stores its data in the protected container that iOS assigns to it; that data is therefore covered by the file encryption of the device as soon as you have set up a device passcode. Files in the encrypted Vault are additionally encrypted by the App itself (section 4 g). The copy of the key sealed with your Vault code is protected by a deliberately slow derivation from the code (PBKDF2 with 600,000 iterations), and the App accepts only Vault codes of at least eight characters that include a letter: the longer the code, the harder it is to guess from a stolen backup. Because the App transmits no data to me, no transmission paths arise that I would have to secure. The most effective protection is the one you provide yourself: a device passcode, biometrics switched on, and current system updates (Article 32 GDPR).

11. Your rights

Under the GDPR you have the following rights at any time: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on Article 6(1)(f) GDPR (Art. 21).

In practice this means something unusual here: except for your emails and archives and the tester data and feedback available to me through TestFlight, I hold no data about you that I could give you access to or that I could erase. Your other data sits with you alone, and you exercise these rights directly yourself — through the Files app, through “Reset App” in the settings, by clearing the search history, and by uninstalling the App. A request to me can relate to the correspondence in section 4 i and j and to the data in section 4 l; for that you can reach me at the contact details in section 1. You exercise your rights against Apple directly with Apple. My handling of your request is free of charge and takes place within one month (Article 12(3) GDPR).

Because the App has no account, there is also no account that would have to be deleted.

12. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR. The authority competent for this is the one of your place of residence, of your place of work, or of the place of the alleged infringement. The authority competent at the controller’s place of establishment is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Postfach 10 29 32, 70025 Stuttgart, Email: poststelle@lfdi.bwl.de

13. Responsibility for your own content

You alone are responsible for the files you store, move, organise, or delete with Spohad, and for being entitled to process them. Make your own backups before you start sorting.

14. Users outside the European Union

The App is offered worldwide through the Apple App Store. I am established in Germany and hold myself to the GDPR everywhere. Because the App transmits no personal data to me, sells none, and discloses none, the rights of access, deletion, and objection under other legal systems relate here solely to the correspondence you send me yourself. For the sake of completeness:

• United Kingdom (UK GDPR) and Switzerland (revised FADP): I handle requests about your personal data according to the principles described above; any additional rights under the law of your place of residence remain unaffected.
• California (CCPA/CPRA) and other US states: I sell no personal information and share none for cross-context behavioural or targeted advertising — neither from adults nor from minors. There is therefore no “Do Not Sell or Share My Personal Information” control: there is no such processing for it to switch off. I do not ask for sensitive personal information; do not volunteer it in an email, attachment, screenshot, or TestFlight comment.
• Ukraine (Law “On Personal Data Protection”): I also handle requests from Ukraine for access, rectification, erasure, or objection according to the principles described above. Your rights under Ukrainian law remain unaffected.
• Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act), Japan (APPI), South Korea (PIPA), and others: apart from the correspondence, no personal data is collected or transferred; address any enquiry to the contact address in section 1.

15. Children

Spohad is not directed at children. The App is intended for people putting their own archive in order, and it transmits nobody’s files being handled in the App to me — children’s files included. Article 8 GDPR applies only where a service offered directly to a child relies on consent under Article 6(1)(a) GDPR. I do not rely on such consent for Spohad, so the App itself does not trigger an age threshold under Article 8. If such processing were offered in future, the threshold in Germany would be 16; below that age, the consent of the holder of parental responsibility would be required. If you are a minor, do not send an email, TestFlight feedback, or a screenshot containing personal information without your parent’s agreement. Apple’s age and family rules also apply to purchases and Apple services. In the United States, I do not knowingly collect personal information from children under 13.

16. Changes to this policy

This Privacy Policy is adjusted as soon as functions or data flows change. Before a new processing operation is introduced, this policy is updated first. The version in force at any given time is always available in the App and at spohad.app/privacy.

17. The spohad.app website

I run the spohad.app website, which carries this policy, the Terms of Use, the Impressum, and the help pages, through the Cloudflare Pages service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

When you open a page, Cloudflare processes, as is technically necessary, the connection data of your device — in particular the IP address, the time, the address requested, details of your browser (user agent), and the amount of data transferred — in order to deliver the page and to protect the website against attacks and abuse. In doing so, Cloudflare acts as my processor under Article 28 GDPR. According to its published documentation, where HTTP request-log retention is enabled, Cloudflare keeps those logs available for at least three and no more than seven days. Otherwise, under the data processing agreement Cloudflare processes personal data only while necessary to provide the service and deletes it after the agreement ends unless the law requires retention. I myself store no access logs and analyse none. The legal basis is Article 6(1)(f) GDPR; my legitimate interest lies in providing the website securely and reliably. You can object to this processing under Article 21 GDPR.

Cloudflare also processes this data in the United States. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer rests on the European Commission’s adequacy decision of 10 July 2023 (Article 45 GDPR) and, additionally, on the standard contractual clauses in the data processing agreement.

The website sets no cookies and stores nothing in your browser’s storage, so no consent under § 25 TDDDG is required. The home page only reads the language set in your browser to show you a hint about the German or Ukrainian version; nothing is stored or transmitted in doing so. The interactive preview of the app on the home page runs entirely in your browser and loads only files from this website. The website uses no analytics or reach measurement and no advertising, and loads no fonts, scripts, or other content from third-party servers. Cloudflare may, however, use the NEL and Report-To response headers to cause the browser to send network-error reports to Cloudflare; they may contain the requested address, error type, time, browser details, and IP address and are used only for the stability and security of delivery. There is no form; if you write to me at an email address given on the website, section 4 j applies.

18. Language versions

This policy is provided in several languages with equivalent meaning. If language versions differ or wording remains unclear, the interpretation more favourable to you applies; mandatory statutory rights always remain unaffected.