Privacy Policy

1. Controller and scope

This Privacy Policy explains how There You Are (the “App”) and its website handle personal information. They are operated by Dmytro Kniazik, an individual developer based in Poland (the “Developer”). The Developer is the controller of personal information processed for the analytics, diagnostics, support, website, and security purposes described in this policy.

Privacy enquiries may be sent to support@thereyouare.photos.

2. Photos and on-device matching

The App processes the photos, selfies, and reference images you select to find people in your photos. All core face-matching processing occurs on your device. Images and information derived from faces are not uploaded or made available to the Developer as part of matching.

The App retains local copies or references to selected images, previews, search progress, results, and settings so you can use the service and return to a search. Section 12 explains how this information is removed.

Face-related information is not used by the Developer for advertising, identity verification, surveillance, or training AI models. Photos or videos leave the App only when you choose to share or export them, or attach them to feedback. Separate storage and synchronisation services, such as iCloud Photos, remain subject to their providers’ terms.

3. Product analytics

The App automatically collects limited usage information through Amplitude to understand feature use and improve performance. This includes actions within the App, permission outcomes, photo counts, search durations and outcomes, error codes, and technical information such as App version, operating system, device model, language, and session details.

Analytics uses a temporary random identifier that changes when the App is fully restarted. The configuration excludes IP addresses, derived location, mobile carrier information, and device vendor identifiers from analytics event data.

Analytics does not include your photos, videos, face data, filenames, file paths, image identifiers, feedback messages, email addresses, or album names. It is not used for advertising or tracking across other apps or websites. Available choices are described in Section 13.

4. Crash and performance diagnostics

The App automatically sends technical reports to Sentry to identify and resolve crashes, freezes, errors, connection failures, and performance problems. These reports may include crash details, error codes, App and device information, performance measurements, and limited network request details.

The App is configured to exclude your photos, videos, face data, filenames, and message contents from diagnostic reports. It does not record your screen or attach screenshots. Diagnostic reporting operates separately from product analytics and from the optional details included with feedback.

5. Feedback and support

If you contact the Developer or submit feedback, the Developer receives the information you provide, which may include:

• your message, feedback category, and submission details;
• an optional contact email address;
• optional technical details about the App, device, search, and errors;
• photos or videos you attach, including filenames and any metadata contained in those files.

Technical details are enabled by default in the feedback form, are shown before submission, and can be turned off. They include photo counts and search performance, but do not include image contents or face data. Attachments are sent only when you add them. An email address is optional; without it, the Developer may be unable to reply.

Unsent feedback and attachments are stored on your device and delivery is retried automatically. They are removed from that local queue after successful delivery. Start Over does not cancel queued feedback.

Support providers process submissions to deliver them to the Developer. IP addresses, request records, and information used to verify the App and device are also processed to protect the service against abuse. Please include only information necessary for your request and ensure you are entitled to share any information about others.

6. Apple and system services

iOS controls access to your photos, files, and camera. You can manage applicable permissions in your device settings. The App uses Apple services for distribution, ratings, device verification, and actions you request, such as saving, sharing, or deleting photos.

Apple, cloud storage providers, and destinations you choose when sharing handle information under their own privacy policies. Changes to photos stored in iCloud may synchronise across your devices.

7. Website data

The website is hosted by Cloudflare, which processes IP addresses, pages requested, browser and device information, timestamps, and security records to deliver and protect the site. The Developer does not add advertising or product-analytics scripts or marketing cookies to the website.

8. How information is used

The Developer uses information to:

• provide and maintain the App and website;
• understand usage, improve features, and resolve technical problems;
• handle feedback and support requests;
• protect the services against misuse and comply with legal obligations.

The Developer does not sell personal information, use it for targeted advertising, or use photos or face data to train the Developer’s AI models.

9. Legal bases

Where European Economic Area or UK data protection law applies to processing by the Developer, the legal bases are:

• Performance of a contract: processing necessary to provide the services you request.
• Legitimate interests: understanding product use, maintaining reliable and secure services, preventing abuse, and responding to enquiries, where necessary and where these interests are not overridden by your rights and freedoms.
• Legal obligations: processing necessary to comply with applicable law.

Where consent is required for an activity, it must be obtained before that activity begins. This policy does not itself constitute consent. Face matching takes place on your device at your direction; the Developer does not use it to make decisions producing legal or similarly significant effects on you.

10. Service providers and sharing

The following providers process information for the purposes described in this policy:

• Amplitude: usage analytics described in Section 3.
• Sentry: technical diagnostics described in Section 4.
• Google Firebase: App and device verification information and security tokens used to protect support services.
• Cloudflare: website and support hosting, including request and security information and the feedback it handles.
• Resend and the Developer’s email provider: delivery and storage of support messages, contact details, optional diagnostics, and attachments.
• Apple: the system services described in Section 6.

Providers acting on the Developer’s behalf are required to process information only for the agreed purposes and to provide at least the protection described in this policy and required by applicable law. Their linked policies explain their practices, including any processing for their own service administration, security, or legal obligations.

Information may also be disclosed to destinations you choose when sharing content, or where disclosure is required by law or valid legal process.

11. International data transfers

App analytics and diagnostic reports are sent to the providers’ EU regions. This does not mean all provider operations take place within the EU. Service providers and their subprocessors may also process information in the United States or other countries; Resend stores email data in the United States.

Where required, transfers outside the EEA or UK are subject to recognised safeguards, such as adequacy decisions or approved contractual protections, including applicable UK arrangements. You may contact the Developer for information about, or a copy of, the relevant safeguards.

12. Retention and deletion

• Saved searches: search records, App-stored selfies and reference images, and face-matching data are removed when you use Start Over or delete the App. Start Over does not delete original items in Photos or Files.
• Temporary data and settings: temporary files are removed when no longer needed. Some previews may remain in device memory until released by the App or iOS. Local preferences and usage records are not reset by Start Over and remain until cleared or the App is deleted.
• Analytics: no longer than 12 months.
• Crash and performance reports: no longer than 90 days.
• Unsent feedback: kept on your device until delivered or the App is deleted. Start Over does not remove it.
• Support correspondence: up to 12 months after resolution or the last communication, unless longer retention is necessary for legal obligations, disputes, or security.
• Support delivery records: Cloudflare service logs are kept for up to 7 days. Resend states that email and log data is kept for 30 days on its standard plans.
• Verification and website records: retained for the periods needed to validate requests, deliver services, and protect against abuse under the applicable provider policies and service settings. Firebase does not retain the verification material used by its App Check service; security tokens are subject to validity and security-related retention limits.

Deleting the App or using Start Over does not remove information already received by service providers or the Developer. Rights requests are described below.

13. Your choices and rights

Subject to applicable law, you may request access to, correction or deletion of, or restrictions on the use of your personal information, and receive a portable copy where the right to portability applies.

Right to object: you may object to processing based on legitimate interests on grounds relating to your particular situation. The Developer must then stop that processing unless there are compelling overriding grounds or it is necessary for legal claims. Send requests to support@thereyouare.photos.

• Manage photo and camera permissions in iOS settings, and use Start Over to remove saved search data.
• Choose whether to include technical details, an email address, or attachments with feedback.
• The current App does not offer an in-app switch for automatic analytics or diagnostic reporting. Uninstalling the App stops future collection from that installation.

The Developer may request proportionate information to verify a request or locate relevant records. Because the App does not require an account, some records may not be identifiable as yours. Requests will be handled within the time limits required by applicable law.

Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You may also complain to your local data protection authority, including Poland’s Personal Data Protection Office (UODO) or the UK’s Information Commissioner’s Office (ICO).

14. Children

The App is not directed to children. Processing family photos on your device does not send those photos to the Developer. Children should not submit personal information without parental or guardian authorisation where required by law. If you believe a child has provided personal information improperly, please contact the Developer.

15. Security

The Developer uses technical and organisational measures appropriate to the information processed, including encrypted transmission and measures to prevent unauthorised access and abuse. No method of transmission or storage can be guaranteed to be completely secure.

16. Policy updates

The Developer reviews this policy and App Store privacy disclosures to reflect changes in the services, provider practices, and applicable law. Revisions will be published here with an updated effective date. Additional notice and, where required, consent will be provided before material changes take effect.

17. Contact

For privacy enquiries, rights requests, or complaints, contact:

Dmytro Kniazik
Individual developer
Poland
Email: support@thereyouare.photos