Privacy Policy

Brindo for iPhone and iPad · Last updated 4 November 2026

Brindo has no advertising, cross-app tracking or required account registration. Private photo review happens on your device. Internet shared albums use encrypted storage, with readable service metadata; a photo you submit in a report is readable by us.

Who is responsible and what this covers

Edoardo Vaira, operating personally in Italy, is the controller for Brindo’s service data. Contact help@getbrindo.com for privacy questions or requests. This policy covers the app, shared-album browser pages, this website and support/report correspondence. Internet sharing is currently available in beta; which features you use determines which data is handled.

Your photos

• Brindo reads the Photos metadata you allow it to access to show a visual browser of photos and albums. You choose individual photos or a range before review starts, and the same way when you add photos to an album. It records your choices — keep or remove — review settings, any explicit screenshot exclusions, and the order you arrange your keepers in. Skipping screenshots does not delete them.
• With Photos access already granted, Home can use capture dates to show “On this day” photos from earlier years. This lookup and its small display previews stay on your device. It respects limited access and excludes hidden photos. You explicitly choose which photos to review; discovery never chooses favourites or creates an album automatically.
• Full originals are not copied by default. The app refers to them in your Apple Photos library. If a photo is stored in iCloud, iOS may download it from your own iCloud account so it can be shown to you. Brindo keeps bounded, disposable display previews on your device to make browsing faster. They are not used instead of originals when saving or sharing.
• When you choose Share photos, you select which kept photos to send through the iOS share sheet. Brindo prepares a temporary full-quality copy of each, as it looks in Photos with your edits, starting as you select them when you are on Wi-Fi, and removes these copies when you leave the sharing screen. Sharing one photo from Swipe works the same way, for that photo alone. The receiving app or service handles the photos under its own privacy policy.
• When you finish an album, Brindo also makes it an album in your Apple Photos library, on your device, with the same name and the photos you kept, in your order. It uses the photos already in your library and never copies them. Changes you make later in Brindo update it. Nothing is deleted from Apple Photos.
• You may optionally download copies of an album for offline review. Those copies are stored only on your device and can be deleted from within the app.
• "Remove" excludes a photo from your album. It does not delete anything. Deleting photos from Apple Photos is a separate action that asks you to confirm the exact photos first.
• Edit can crop, rotate or flip a photo. Only when you tap Done does Brindo change that photo in your Apple Photos library, on your device, without making a copy. Apple Photos keeps the original: Revert to Original, in Brindo or Apple Photos, brings it back.
• Photo details shows where a photo was taken on an Apple Maps map, with the place’s name. Opening details on a photo with a location sends that location to Apple for the map and the name; nothing reaches us.
• Private review does not upload your photo library to us. Shared albums, reports and correspondence are described below.

Sharing photos with people nearby

• Brindo can share original photos directly with other people's devices over a local Wi-Fi connection, but only when you choose to start or join a shared album.
• These transfers are encrypted and go directly between devices. They do not pass through any server of ours, and no copy is retained by us.
• Your own keep/remove choices are never transmitted. Only the photographs you explicitly contribute are shared.
• Deleting a shared album removes its local room record and invitation credentials. Downloaded photos stay on your device, accessible in Settings → Saved photos until you review them into a personal album or explicitly delete those saved photos. Deleting a room does not delete photos from Apple Photos or from friends’ devices.
• Shared photos are originals, with their embedded details, such as where and when they were taken. Everyone in the album can see them.

Shared albums over the internet

Your app or browser encrypts shared photos, previews, embedded details, display names, the album name and its cover before upload. The invitation or personal return link contains the key; ordinary album storage does not give us that key. Browser encryption also depends on the code our server supplies. Reports, correspondence and legal processes can separately supply readable material.

Members can see shared photos and their embedded details, including location where present. Keep invitations private. Replacing an invitation does not change the encryption key. Removal blocks new authorized requests, but an existing transfer may finish and copies already received cannot be recalled.

When an album requires approval, waiting and rejected photos are visible only to the person who added them and the album’s admins. Rejected photos stay privately on the server until the album expires, unless explicitly removed sooner. An admin can approve them later, making them visible to all members.

To operate an album, we handle random album/member identifiers, credential and recovery-secret hashes, short-lived handoff records, membership and role changes, file sizes and upload dates, approval status, delivery/feed progress, and service requests. Selective original downloads can suggest which photos you wanted, but do not reveal the picture. Your private Keep/Remove decisions, private albums and Apple Photos identifiers are not sent to our server.

Apple App Attest provides device security keys. Native members may register push tokens and notification preferences, including muted albums and blocked member IDs, to control notifications. Push messages contain random identifiers, counts and encrypted display text; Apple delivers them. Local monthly reminders are scheduled on your device. You can turn notifications off in iOS and change album preferences.

Network requests expose an internet address to the network providers. Brindo uses addresses for short-lived request limits and does not maintain an application database of address histories. Cloudflare and other providers may process network/security logs under their own service configurations and policies. Operational error counts, timings and transfer status are different from advertising or cross-app tracking.

Reports, support and people who do not use Brindo

Reports contain the reporter’s member ID, the reported photo/member identifiers, reason, time and any note. A photo report attempts to attach a readable preview. We can receive the notice even if that attachment fails. Report handling and moderation produce case records, outcomes and decision notices. Report notifications, when enabled, use Cloudflare to email the operators a reference, album identifier and reason, without the photo or note text.

If you email us, we receive your address, message, attachments and any details you choose to supply. Settings → Feedback prepares an email in your mail app with visible app/device/version information you can remove; it sends only if you send it. Do not email suspected child abuse imagery, passwords or secret invitation/return links.

Other people may share a photo of you or mention you in a report without you joining. The source is the person who shared it or made the report; it is not consent from you. Contact us without creating an account if you want information or wish to exercise your rights. We may need non-secret identifying details to locate the material.

Why we process data

• Providing the service you request: necessary membership, encrypted delivery, recovery, notification delivery/preferences and agreement records are processed to perform the sharing agreement, or take steps you request before it (GDPR Article 6(1)(b)). Optional OS permissions control access on your device; they are not blanket consent to all processing.
• Security, support and handling abuse: necessary device checks, request limits, reports, moderation and correspondence serve our legitimate interests in operating a secure service, responding to users, protecting people and establishing or defending claims (Article 6(1)(f)), balanced against affected people’s rights. Where data concerns someone who is not a party to the agreement, we do not treat that agreement as their legal basis.
• Legal obligations: we process necessary information where a relevant EU or member-state legal obligation requires it (Article 6(1)(c)). We assess foreign requests and international disclosure separately; an overseas request is not automatically such a legal obligation.
• Consent: if a particular use requires consent, we must request it for that use and provide a way to withdraw it. We do not rely on accepting the Terms as consent to advertising or unrelated processing.

Reports may reveal sensitive information or alleged offences. These require additional legal conditions and safeguards, not just a general legitimate interest. We minimize what is requested, restrict access and assess the applicable basis for each case, such as legally permitted handling of claims or a specific legal requirement. Please give the least sensitive information that identifies your concern.

Shared albums need their operational records to work; without the required membership and delivery data we cannot provide online sharing. Photos, notes and support requests are choices you make. You can still use private review without joining an internet album.

Who receives information and where

• Album members receive what you choose to share. They may be outside your country.
• Cloudflare hosts the sharing API, database and files and processes network/security data. The service is configured to use EU storage; requests may be processed at locations outside the EU. EU storage does not mean all processing is confined to the EU.
• Apple supplies Photos/iCloud, Maps, App Attest and push services. A photo location is sent to Apple when you open its map.
• Cloudflare also hosts this public website, receives email sent to our getbrindo.com addresses and forwards it to our team mailbox, and delivers the limited operator report alerts described above.
• Google provides our team mailbox (Gmail), where emails to our getbrindo.com addresses arrive.
• Authorized operators, advisers and authorities may receive relevant information for necessary support, security, claims or valid legal requirements, subject to appropriate confidentiality and access restrictions.

International processing may involve countries with different data-protection laws. Where EU transfer rules apply, the transfer must have an applicable adequacy decision or safeguards such as the EU standard contractual clauses, with additional measures where necessary. Ask us for information about the safeguards applicable to your data. Provider terms and information are available from Cloudflare, Apple and Google.

We do not sell personal data or use it for advertising, cross-app tracking or AI-model training. Brindo uses a local OpenCV library for grouping layout, not to choose your photos. It has no advertising or analytics SDK.

How long information is kept

These details describe the currently deployed beta. Additional automatic retention limits are being prepared; they are not yet active.

• Album access: ends 30 days after the last photo was added, no later than 90 days after the first. Empty albums end after 90 days. The host may end an album sooner.
• Files and operational album records: deletion is queued after expiry/removal and processed by scheduled, bounded cleanup. Failed or late transfers, cleanup backlogs and technical failures can delay physical deletion after access stops. We do not promise that every stored copy disappears within 24 hours. Cloudflare D1 retains a restorable history for 30 days from actual database deletion. Copies already saved by members are under their control.
• Reports and readable evidence: open reports remain stored until resolved; resolved cases are scheduled for deletion after 90 days. Required legal preservation needs separate handling. Contact us for a report’s status or a request about its data.
• Moderation and agreement records: the current beta keeps available rule notices and the Terms version recorded with a membership until operational album cleanup. Separate decision receipts and more detailed agreement records with their own expiry limits are not yet active.
• Device security records: the current beta stores App Attest and device-ban records without automatic expiry. You can request a review or deletion using the contact above. Planned automatic limits are not yet active; the absence of a timer does not remove your privacy rights.
• Support correspondence and operator alert emails: reviewed for deletion 90 days after the matter closes, unless a complaint, dispute or legal obligation justifies longer. Provider logs and backups have their own retention settings; we assess them against the purpose of the service.
• Legal preservation: relevant data may need to be retained for the applicable legal period or while a specific claim requires it. Preservation is separate from ordinary member access. A request does not itself guarantee that data still exists or that preservation has been confirmed; contact us promptly.

Browser and device storage

The browser uses local storage for your album membership credential, display name, feed position, blocked/hidden photos, agreement version and retry references. Pending join/recovery/handoff state lets the service recover interrupted steps. This storage is for the features you request, not advertising. It may remain until you clear the site’s data; clearing it can lose your access unless you have a valid personal return link or another credential. Treat return links as private credentials.

The app stores local albums, review choices, previews and downloaded copies on your device. Shared-album secrets can use your iCloud Keychain for recovery. Removing a local room does not necessarily delete its downloaded originals: use Settings → Saved photos for those copies. Your device/iCloud backups follow your Apple settings.

Your rights

Where applicable, you may request access, correction, deletion, restriction or portability of personal data, object to processing based on legitimate interests, and withdraw consent for a use based on consent without affecting prior lawful processing. Email us whether or not you use the app, remain in an album or have an account. We verify identity proportionately and may request non-secret identifiers; do not send a full secret invitation or return link.

We normally respond within one month. If a lawful extension is necessary, we explain it within that month. Rights have legal exceptions, including necessary preservation. Deleting our copy cannot erase someone else’s saved copy. You may complain to Italy’s Garante per la protezione dei dati personali, or your competent local data-protection authority.

We do not make decisions about people solely by automated processing that have legal or similarly significant effects. Request limits and device-security checks are automated technical safeguards. Brindo never scores or chooses your photographs for you.

Diagnostics

The app writes basic diagnostic messages to the iOS system log on your device — counts and timings, such as how long an import took. These never include photographs, filenames, or locations, and they never leave your device unless you choose to send Apple a diagnostic report.

Permissions

• Photos — to browse allowed photos and albums, show your selected photos, rediscover photos from this day in past years, save your finished album back to your library, save friends’ photos you keep from a shared album to your library, and save crops, rotations and flips you make with Edit to that photo. Limited access shows only the photos you have allowed.
• Local network — only for sharing photos with people nearby.
• Camera — only if you scan a QR code to join a shared album.
• Notifications — for a reminder on the last evening of each month to make that month’s album and, in shared albums, when friends add photos or the album’s photos are about to leave the server. Your phone writes the reminders itself; friends’ photos come through Apple from our server, as above. Turn each on or off in Settings → Notifications, or mute one album in its details.

Notifications are asked for only if you say yes to the monthly reminder or to friends’ photos, or from Settings → Notifications. The others are requested at the moment they are needed. The app works without granting the last three.

Children

Shared albums are not directed at children under 13. A stated age limit does not itself verify someone’s age. Shared albums are for people aged 13 and over, or older where local law requires it (Terms of Use). Contact us if you believe a child is using the service contrary to the applicable requirements, or a child’s information is being misused. Reports and correspondence may contain readable information.

Changes

The date changes when this policy changes. We will give additional notice of material changes where required. A new notice does not authorize an incompatible use of existing data by itself.

Contact

Questions about privacy, or anything else: help@getbrindo.com