Cleanup ("the app", "we", "us") is developed by RA2 Lab.
This policy explains what the app does with your data — and, more
importantly, what it does not do.
---
## 1. The short version
- **Your photos and videos never leave your device.** All scanning,
comparison, blur detection, face grouping and search happen locally on
your iPhone or iPad. We do not upload, copy, or store your media on any
server. We cannot see your photos.
- **You do not need an account.** There is no sign-up, no email, no
password.
- **We do not sell your data**, and we do not share it with advertisers.
The app contains no advertising SDK and does not use the Advertising
Identifier (IDFA). You will never see an App Tracking Transparency
prompt, because we do not track you across other apps or websites.
- **Deleting is always your decision.** The app pre-selects candidates,
but nothing is removed until you confirm — and deletion runs through
iOS's own system dialog, into your "Recently Deleted" album.
- The only things that leave your device are: anonymous usage statistics,
crash diagnostics, subscription status, and — if you use them — the
text you type to the Cleo assistant and the actions you ask us to
perform on your Gmail account. Each is described below.
---
## 2. Photos and videos
When you grant photo library access, the app reads your library through
Apple's PhotoKit framework in order to:
- find exact duplicates and visually similar photos,
- detect blurred, screenshot, and chat/downloaded images,
- list large videos and compress them, or convert Live Photos to stills,
- compute an on-device search index so you can find photos by description
("cat", "ID card") and group photos by face.
All of this runs **on your device**. The image analysis models
(image-understanding and face-grouping) are bundled with the app and run
locally; no image, thumbnail, filename, or asset identifier is ever
transmitted to us or to any third party.
The derived index (small numeric fingerprints of your photos) is stored
only in the app's private storage on your device. Uninstalling the app
deletes it.
**Deletion.** The app never deletes anything silently. Every removal —
from the review screens, from Smart Cleaning, or from a Cleo result card
— requires your confirmation, and iOS then shows its own system
confirmation. Deleted items go to the Photos app's "Recently Deleted"
album, where you can restore them for 30 days.
**Secret Library.** If you use the Secret Library, the media you import is
copied into the app's private container on your device, protected by
iOS file encryption and excluded from iCloud backup. Your PIN is stored
only as a salted hash on the device. We never receive your PIN or the
contents of the vault, and we cannot recover them if you forget the PIN.
---
## 3. Contacts
If you use the Contacts tools and grant permission, the app reads your
contacts through Apple's Contacts framework to find duplicates and
incomplete entries, and to merge or delete them at your request. Contact
data is processed **entirely on your device** and is never uploaded. We
receive only the anonymous count of how many contacts were merged or
deleted (see §5).
---
## 4. Cleo (the in-app assistant)
Cleo answers questions about your library and suggests what to clean.
When you send a message, the following is transmitted over an encrypted
connection to our backend (`api.ra2lab.io`), which forwards it to our
AI model provider to generate a reply:
- the text of your message and the recent messages in that conversation,
- aggregate facts about your library — counts, total sizes in bytes, and
date ranges (for example: "1,240 duplicates, 3.1 GB").
The following is **never** sent: your photos or thumbnails, filenames,
photo identifiers, location data, text recognized inside your photos, or
anything derived from faces. Photo search and face grouping are performed
locally on your device; only the words you type travel to the network.
Conversations are stored **on your device** so you can revisit them, and
are deleted when you delete a conversation or uninstall the app. On our
side, messages are processed to produce the reply and are not used to
train AI models. Our model provider processes the text on our behalf
under a contract that prohibits using it for training.
If you use voice input, your speech is converted to text by **Apple's
speech recognition**, which — depending on your device and settings — may
process audio on Apple's servers under
[Apple's privacy policy](https://www.apple.com/legal/privacy/). We do not
store your audio.
Cleo can never delete anything by itself; it can only open a review
screen where you decide.
---
## 5. Analytics and crash reports
To understand whether the app works and where people get stuck, we use
two Google Firebase services:
**Firebase Analytics** — anonymous, aggregated usage events, for example:
which onboarding page you reached, that a paywall was shown, that a scan
finished (number of files, megabytes, duration), that a cleanup completed
(number of photos, megabytes), that an assistant query ran (query type and
number of results), and whether a tool such as video compression or email
cleanup succeeded or failed. Events include a device-generated identifier
(Apple's Vendor Identifier, IDFV) and general device/locale information,
plus whether the account is on a paid plan.
**Firebase Crashlytics** — crash and error diagnostics: stack traces,
device model, OS version, and a few technical values that tell us the
scale of the work being done when a crash happened (approximate number of
assets in the library, which scan stage was running, batch size of a
deletion).
We deliberately **do not** send: filenames, photo or video identifiers,
contact names, email addresses, email subjects or bodies, the questions
you ask Cleo, or any content of your photos. Analytics carries counts and
category-level labels only.
The app does **not** link this data to your identity, does not use it to
track you across other apps or websites, and contains no advertising or
attribution SDK.
---
## 6. Email Cleaner (Google account data)
The Email Cleaner is optional. It only does anything if you choose to
connect a Google account.
**What we request.** With your consent, we request the Gmail scope
`https://www.googleapis.com/auth/gmail.modify`, plus your basic profile
(email address) so the app can show which account is connected.
**What we do with it.** The app calls the Gmail API directly from your
device to:
- count and list messages in categories such as Promotions, Social, and
Updates, and read the message you open in order to display it,
- move messages you have selected to the Gmail **Trash** (recoverable in
Gmail for 30 days) — the scope we request does not allow permanent
deletion,
- read `List-Unsubscribe` headers and, at your request, send an
unsubscribe request from your account.
**Where it goes.** Your email data is fetched to your device and shown to
you. We do not copy your messages to our servers, we do not store their
content, and we do not use them for any purpose other than performing the
action you asked for in the moment you asked for it. Your Google access
token is stored on your device only. What we keep is the anonymous
counter described in §5 — for example "emails trashed: 128" — with no
addresses or subjects.
**Google Limited Use.** Cleanup's use and transfer of information received
from Google APIs adheres to the
[Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy),
including the Limited Use requirements. We do not transfer Google user
data to third parties, do not use it for advertising, and do not use it to
train AI or machine-learning models — including generalized models. Human
access is not permitted except with your explicit consent, for security
purposes, to comply with applicable law, or where the data has been
aggregated and anonymized.
**Revoking access.** You can disconnect at any time from Settings inside
the app, or from your Google Account at
[myaccount.google.com/permissions](https://myaccount.google.com/permissions).
Revoking immediately ends the app's ability to read anything from your
mailbox.
---
## 7. Purchases and subscriptions
Subscriptions are sold through Apple's In-App Purchase. **Apple processes
your payment — we never see your card details, billing address, or Apple
ID.**
We use [RevenueCat](https://www.revenuecat.com/privacy) to check whether
your subscription is active. RevenueCat receives an anonymous identifier
it generates, your purchase receipt from Apple, and device/platform
information. We use it only to unlock paid features and to know that a
purchase, restore, refund, or expiration happened.
To talk to our backend, the app also creates an **anonymous Firebase
account** — an identifier with no name, email, or password attached. It
exists solely so requests to `api.ra2lab.io` can be authenticated.
---
## 8. What we never collect
- Your photos, videos, or any copy, thumbnail, or crop of them.
- Filenames, photo identifiers, or photo location (EXIF/GPS) data.
- Faces, face templates, or any biometric identifier leaving the device.
- Text recognized inside your photos (for example, ID card numbers).
- Contact names, phone numbers, or email addresses from your address book.
- Email content, subjects, or sender addresses.
- Your Secret Library PIN or its contents.
- Your precise location.
- The Advertising Identifier (IDFA), or any cross-app tracking data.
---
## 9. Third-party services
| Service | What it receives | Policy |
|---|---|---|
| Apple (App Store, In-App Purchase, PhotoKit, Speech) | Payment and account data handled by Apple; dictation audio if you use voice input | [apple.com/legal/privacy](https://www.apple.com/legal/privacy/) |
| Google Firebase (Analytics, Crashlytics, Authentication) | Anonymous usage events, crash diagnostics, anonymous account id, IDFV | [firebase.google.com/support/privacy](https://firebase.google.com/support/privacy) |
| RevenueCat | Anonymous user id, purchase receipts, subscription status | [revenuecat.com/privacy](https://www.revenuecat.com/privacy) |
| Google Gmail API (only if you connect an account) | API requests made from your device with your token | [policies.google.com/privacy](https://policies.google.com/privacy) |
| ra2lab backend (`api.ra2lab.io`) and its AI model provider | Assistant message text and aggregate library counts | this policy |
We do not sell personal information, and we do not share it for
cross-context behavioural advertising.
---
## 10. Retention and how to delete your data
- **On-device data** (photo index, conversations, Secret Library,
settings, keep-lists): deleted when you delete the app, or from within
the app where offered.
- **Analytics and crash data**: retained by Firebase for a limited period
according to Google's retention settings (currently up to 14 months for
analytics events, 90 days for crash reports), then deleted
automatically.
- **Assistant messages**: processed to generate a reply; retained briefly
for abuse prevention and operational logging, then deleted.
- **Google account data**: not retained by us at all; revoke access to
cut it off immediately.
To request deletion of anything associated with your device, email
**admin@ra2lab.io** from the device's context (tell us the approximate
date and country of use — we have no name or email to look you up by, so
this is the only handle we can work with). We will respond within 30 days.
---
## 11. Your rights
Depending on where you live, you may have the right to access, correct,
delete, or export your personal data, to object to or restrict certain
processing, and to lodge a complaint with your local data protection
authority.
**If you are in the EEA/UK:** we process anonymous usage and crash data
on the basis of our legitimate interest in keeping the app stable and
usable; assistant messages and Gmail access on the basis of performing
the service you requested (contract) and your consent to the relevant
permission; purchase data on the basis of contract. You can withdraw a
permission at any time in iOS Settings, and revoke Google access as
described in §6.
**If you are in California:** we do not sell or share personal
information as those terms are defined by the CCPA/CPRA, and we do not
use it for cross-context behavioural advertising.
Data may be processed on servers located in the United States and other
countries by the providers listed in §9, under their respective
safeguards for international transfers.
---
## 12. Children
Cleanup is not directed to children under 13 (or the equivalent minimum
age in your country), and we do not knowingly collect personal data from
them. If you believe a child has provided us with data, contact us and we
will delete it.
---
## 13. Security
Network traffic uses TLS. The Secret Library and on-device index are kept
in the app's private container with iOS file protection enabled, and the
Secret Library is excluded from iCloud backups. No system is perfectly
secure, but because your photos, contacts, and email content never reach
our servers, there is no copy of them for us to lose.
---
## 14. Changes to this policy
If we change what data the app collects, we will update this page and the
"Last updated" date above, and — for material changes — surface a notice