Effective date: October 11, 2026
This privacy policy explains how EXIF Editor - Photo Metadata (the “Application”) handles personal data. The Application is developed and operated by Yejie Chen (the “Service Provider”).
The Service Provider acts as the Data Controller for the personal data described in this policy.
Name: Yejie Chen
Address: Shenzhen, China
Email: g1940879828@gmail.com
For any data protection inquiry, or to exercise any of the rights described in this policy, contact the Service Provider using the details above.
We want the essential facts to be clear before you read the full policy.
Your photos and their metadata never leave your device. Reading, editing, and cleaning metadata are performed entirely on your device. The Service Provider operates no server that receives your images.
The Application does not request device location permission. It cannot read where you are.
The Application has no user accounts and requires no registration. There is no login, no password, and no user profile.
The Application uses advertising and in-app purchase third-party SDKs, which are listed in full in Section 4.
The map picker sends map tile requests to OpenStreetMap, including your IP address and the tile coordinates corresponding to the location you are viewing. See Section 3.5.
You can change your advertising privacy choices inside the Application. See Section 10.
The Application does not require you to create an account, and does not collect your name, email address, phone number, or any other identifier that you personally provide. There is no registration process.
Photos and videos you choose to open with the Application are read directly from your device storage by the operating system. They are not transmitted to the Service Provider.
The Application’s core function is to read and modify photo metadata — for example capture time, camera model, copyright fields, and GPS coordinates embedded by the camera.
This processing happens entirely on your device.
Your photos, and the metadata contained in them, are never uploaded to the Service Provider or to any third party by the Service Provider.
Saving creates a new copy on your device. Your original file is not modified.
If you use the system’s share function to export a photo, that file is handed to the app or service you select. Once you share it, the handling of that file is governed by the recipient’s privacy policy, not by this one.
Third-party SDKs included in the Application (see Section 4) may automatically collect the following, subject to your consent where required by law:
Device identifiers, such as the Android Advertising ID or Apple IDFA where permitted
IP address
Device model, manufacturer, operating system and version
Screen resolution, language and locale
Application version and crash or diagnostic information
Approximate location derived from your IP address
Advertising interaction data such as impressions and clicks, and in-app events
Purchase and subscription transaction status, via the in-app purchase SDK
The Application does not request device location permission. The Application’s permission manifest explicitly removes both ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION.
This is different from GPS coordinates that a camera embeds inside a photo file. The Application can read and edit those coordinates because they are part of the file you selected, but the Application cannot determine where your device currently is.
The Application includes a map picker that lets you choose a location on a map to write into a photo’s GPS field.
When you open the map picker, the Application requests map tiles from the OpenStreetMap Foundation’s tile servers. Each tile request transmits your IP address and the tile coordinates, which mathematically correspond to the geographic area you are viewing on the map.
The Service Provider does not receive or store this information. The OpenStreetMap Foundation processes it under its own privacy policy.
Tile requests identify the Application through a standard User-Agent header, and the map view permanently displays “© OpenStreetMap contributors” attribution with a link to the OpenStreetMap copyright page.
The map picker is offered on Android only. You can dismiss it at any time without selecting a location.
A location is written to your photo’s metadata only after you explicitly confirm it. If you cancel, nothing is saved.
From the GPS details view, the Application can hand a coordinate to an external map application, such as Google Maps, Amap, or Baidu Maps. If you tap this option, the coordinate is transmitted to the provider of the app or website you are directed to, and is then handled under that provider’s privacy policy. The Service Provider does not control or receive this data.
Purchases are processed entirely by Google Play. The Application never sees or stores your payment card details, billing address, or payment credentials.
The Application uses the RevenueCat SDK to verify purchase status. This SDK communicates with RevenueCat servers to send and receive purchase and subscription status. It uses an anonymous installation identifier. The Application does not associate this identifier with your name, email address, or any account.
The Application displays advertisements to free users. Users who purchase the Pro upgrade do not see advertisements, and the advertising SDKs are not initialized for them.
Advertisements are served by Google AdMob. In accordance with Google’s EU User Consent Policy, where required by law the Application obtains your consent via Google’s User Messaging Platform (UMP) before requesting advertisements. See Section 5.
The Application does not use Artificial Intelligence (AI) technologies, including generative AI or machine learning models, to process your data or to provide any feature.
The Application uses the following third-party SDKs and services. This list is complete.
Purpose: advertising. Data involved: advertising ID, IP address, device and operating system information, approximate location, and advertising interaction data. Privacy policy
Purpose: in-app purchase and subscription verification. Data involved: anonymous installation identifier, transaction status, and device or app metadata. Privacy policy
Purpose: map tiles for the map picker. Data involved: IP address and tile coordinates. Privacy policy · Tile copyright and attribution
Purpose: payment processing. Data involved: transaction status only. Privacy policy
Purpose: optional app rating prompt. Data involved: device and app metadata. Privacy policy
Other components of the Application, such as local settings storage, are provided by the Flutter framework and run entirely on your device.
Where required by law, the Service Provider enters into Data Processing Agreements (DPAs) with third-party service providers that process personal data on its behalf, as required by Article 28 of the GDPR.
The Service Provider may disclose information in the following circumstances:
As required by law, such as in response to a subpoena or similar legal process.
Where the Service Provider believes in good faith that disclosure is necessary to protect the rights or safety of the Service Provider, the Application, or other users, to investigate fraud or abuse, or to respond to a government request.
To service providers who act on the Service Provider’s behalf, do not use the information for their own purposes, and are bound by obligations consistent with this policy.
Where the law requires your consent before personalized advertising can be served — for example in the European Economic Area, the United Kingdom, and Switzerland — the Application presents a consent form provided by Google’s User Messaging Platform (UMP) SDK. Google is a certified Consent Management Platform under the IAB Europe Transparency and Consent Framework.
The consent form is configured by the Service Provider in the Google AdMob console and explains which advertising data may be used. The form is displayed in your device’s language.
If you consent: personalized advertising may be served, which can produce more relevant ads and higher revenue for the Application.
If you decline: the Application continues to work exactly the same. Advertisements are served in a non-personalized form, which does not use your advertising identifier for targeting. Non-personalized advertising generally generates less revenue.
Declining consent does not remove any functionality from the Application.
You may change or withdraw your consent at any time:
Through the privacy options entry available in the Application’s settings
By contacting the Service Provider at g1940879828@gmail.com
Withdrawing consent does not affect processing carried out before the withdrawal.
The Service Provider may enable a debug region in development builds to verify the consent flow works correctly. This is disabled in production builds distributed to users.
Where the GDPR applies, the Service Provider relies on the following lawful bases:
Consent — for processing based on your explicit agreement, including personalized advertising and optional features. You may withdraw consent at any time without affecting processing carried out before withdrawal.
Contract performance — processing necessary to provide the Application to you.
Legitimate interests — processing necessary for the Service Provider’s legitimate interests, such as maintaining network and information security, preventing fraud and abuse, diagnosing crashes, and improving the Application’s core functionality, provided those interests are not overridden by your data protection rights or fundamental freedoms.
Legal obligation — to comply with applicable laws or valid government requests.
The Application does not use cookies in the traditional browser sense, because it is not a website. It and its third-party SDKs may use device identifiers, SDKs, pixels, and similar technologies to support functionality, analytics, and service delivery.
Where required by law, the Service Provider obtains your consent before using non-essential tracking technologies.
If the GDPR applies to you, you have the following rights:
Right of Access — to request access to your personal data.
Right of Rectification — to request correction of inaccurate data.
Right of Erasure — to request deletion of your personal data, the “right to be forgotten.”
Right to Restrict Processing — to request that the Service Provider limits how your data is used.
Right to Data Portability — to request a copy of your data in a structured, commonly used, machine-readable format.
Right to Object — to object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing at any time.
Right to Withdraw Consent — to withdraw consent at any time where processing is based on consent. See Section 5.3 for how.
Rights Regarding Automated Decision-Making — you have rights related to automated decisions that significantly affect you.
To exercise any of these rights, contact the Service Provider at g1940879828@gmail.com. The Service Provider will respond within one month of receipt, extendable by up to two additional months where necessary due to complexity or volume, as permitted by law.
If you believe your data protection rights have been violated, you may lodge a complaint with your local Data Protection Authority. Contact details for each country’s authority are available at edpb.europa.eu/about-edpb/members_en.
If you are located in the United Kingdom, you may contact the Information Commissioner’s Office at ico.org.uk.
If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:
Right to Know — to request disclosure of the categories and specific pieces of personal information collected about you.
Right to Delete — to request deletion of personal information, subject to certain exceptions.
Right to Correct — to request correction of inaccurate personal information.
Right to Opt-Out — to opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information — to limit the use of sensitive personal information to essential purposes only.
Right to Non-Discrimination — the Service Provider will not discriminate against you for exercising any of your CCPA/CPRA rights.
To exercise these rights, contact the Service Provider at g1940879828@gmail.com. The Service Provider will verify your request using the information you provide and respond within the timeframes required by law. You may designate an authorized agent to make a request on your behalf.
Independent of the consent form described in Section 5, you can limit advertising personalization in the following ways.
In the Application. Open the privacy options available in the Application’s settings to change your choice at any time.
On your device. On Android, go to Settings, then Privacy, then Ads, turn on “Delete advertising ID” and enable “Opt out of ad personalization.” On iOS, go to Settings, then Privacy & Security, then Tracking, and turn off “Allow Apps to Request to Track.”
Opting out reduces the advertising revenue the Application receives, which helps keep the Pro upgrade affordable.
If the Application uses automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, you have the right to request human review, express your point of view, and contest the decision. Information about the logic involved and the likely consequences of that processing will be provided where required by law.
The Service Provider does not make decisions with legal or similarly significant effects based on automated processing.
The Service Provider and its third-party service providers may transfer personal data outside the European Economic Area (EEA), primarily to the United States and China. Where such transfers occur, the Service Provider uses an appropriate transfer mechanism required by GDPR Chapter V, which may include:
Adequacy decisions by the European Commission
Standard Contractual Clauses (SCCs) approved by the European Commission
Other safeguards or derogations recognized under GDPR Chapter V, including consent where legally permitted
Countries outside the EEA may not provide the same level of data protection as the EEA. Where required by law, the Service Provider applies appropriate safeguards and obtains any consent required for the transfer.
The Service Provider retains personal data only for as long as necessary for the purposes described in this policy.
Photos and metadata on your device — retained on your device until you delete them or uninstall the Application. The Service Provider holds no copy.
Local preferences and settings — stored on your device and deleted when you uninstall the Application.
Advertising data held by Google AdMob — retained by Google under its own retention policies.
Purchase and subscription records held by RevenueCat — retained by RevenueCat under its own retention policies.
Aggregated and anonymized data — retained indefinitely, as it no longer identifies you individually.
Data required for legal compliance — retained for as long as required by applicable law.
You may request deletion of your personal data at any time, except where retention is required by law.
Because the Service Provider does not hold your photos or metadata, most data is deleted simply by uninstalling the Application from your device. Uninstalling stops all data collection immediately, but does not by itself delete information already transmitted to third-party SDKs.
To request deletion of data held by the Service Provider or by third-party SDKs, or to withdraw consent, contact the Service Provider at g1940879828@gmail.com. Upon verifying your identity, the Service Provider will process the request within the timeframes required by applicable law, except where retention is required for legal compliance.
The Application is not directed to children under 13 years of age, and is not intended for children under 16 years of age or the higher age of digital consent established under applicable law. The Service Provider does not knowingly solicit data from children, and does not market the Application to them.
The Service Provider does not knowingly collect personally identifiable information from children below the applicable minimum age in violation of applicable law. If the Service Provider discovers that a child has provided personal information, it will delete that information from its systems promptly.
If you are a parent or guardian and believe your child has provided personal information, contact the Service Provider at g1940879828@gmail.com so that the necessary steps can be taken.
The Application does not use age-gating, because it collects no personal data from users directly. Where the Application’s third-party SDKs are concerned, advertising for children is not enabled.
The Service Provider is committed to safeguarding the confidentiality of information it processes. Physical, electronic, and procedural safeguards are used to protect that information. Because the Application is designed so that photos and metadata are processed locally, the amount of data at risk on the Service Provider’s side is minimized.
However, no security system is completely secure, and absolute security cannot be guaranteed.
In the event of a personal data breach that poses a risk to your rights and freedoms, the Service Provider will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by applicable law.
Where the breach is likely to result in a high risk to your rights and freedoms, the Service Provider will also notify affected users without undue delay, providing information about the nature of the breach, the categories of data affected, and the measures taken or proposed to address it.
The Service Provider may update this Privacy Policy from time to time. Material changes will be published on this page together with a revised effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.
Previous versions of this Policy are available upon request by contacting the Service Provider at g1940879828@gmail.com.
If you have questions about privacy while using the Application, or about the Service Provider’s privacy practices, contact us by email at:
Yejie Chen
Shenzhen, China
g1940879828@gmail.com
This privacy policy is effective as of October 11, 2026.