What we collect, and what we do not.

The short version.

Your library is private to your account. We do not sell your files or use their contents for advertising. We use service analytics and crash reporting to understand reliability. Starting with iOS version 1.0.2, optional Meta advertising measurement runs only after you grant Apple’s tracking permission.

• You keep your files. We store them so the app can show them back to you and so the people you share an album with can open it.
• CloudWink is not end-to-end encrypted. Files are encrypted in transit and at rest with keys we manage, which means our systems can technically read them.
• On iOS 1.0.2 and later, Meta app-event measurement and access to the advertising identifier (IDFA) require your tracking permission. Declining does not limit storage, uploads, sharing or subscriptions. Meta measurement is not enabled on Android.
• You can delete individual files, an album or your whole account from inside the app at any time.

Account information you give us.

To create an account we need an email address, and the address has to be verified before the app will work. You can add a display name, and you can turn on an authenticator app for a second sign-in factor. Sign-in is handled by Amazon Cognito using a password-proof exchange, so your password is never sent to or stored by CloudWink.

• Email address, verification status, and an account identifier that is used as the owner key for everything you store.
• Optional display name. Optional time zone, taken from the device, so scheduled notifications respect quiet hours.
• If you sign in with Google or Apple, the provider tells us the email address and, once only, the name you approve. Apple’s Hide My Email relay address works the same way as any other address.

Your files and the information around them.

Photos, videos, audio and PDFs you upload are stored byte for byte, without compression or re-encoding. Alongside the file we store the details the library needs to work.

• File name, declared content type, size, upload and modification times, and a SHA-256 checksum used to detect exact duplicates.
• Album titles, album descriptions and album membership; a flag marking a file as being in the Locked folder.
• Small server-generated previews: a 512-pixel WebP thumbnail, a 1080-pixel WebP image for Memories stories, and, for video, a poster frame. They are produced on our servers, which means our systems process the file content to make them. The originals are never changed.
• For Memories, the date a photo or video was taken, and the nearest town and country when the photo carries GPS coordinates. The coordinates are read on our servers and matched against an offline place list (GeoNames, CC BY 4.0); only the town and country names are stored, never the coordinates, and no location is sent to any third party. Photos in the Locked folder are never used for Memories.
• CloudWink reads photos you select, or checks the photo library for new items when you grant photo access and turn on Automatic backup. You can turn backup off and revoke photo access in device settings. Free Up Space removes local copies only after their stored copies have been confirmed.

Information collected automatically.

Running a service produces operational records. We keep the smallest set that still lets us fix faults and bill infrastructure correctly, and we redact what would otherwise leak secrets.

• Request logs: method, route, redacted path, status code, request identifier, duration, error code and app version. Share tokens, passwords, signed URLs, request bodies and file contents are excluded by rule and covered by an automated test.
• Network-level records held by our infrastructure provider, including IP address, in API access logs kept for 14 days.
• Storage and usage counters for your account, which the app shows you as quota and upload activity, plus aggregate statistics grouped by plan and account age. The aggregate rollups describe cohorts, not individuals.
• Device registration when you enable notifications: an install identifier, push token, platform and app version.
• Google Firebase Analytics and Crashlytics receive app usage events, screen names, device/app information and crash diagnostics for product analytics and reliability. Our custom event payloads exclude file names, file contents, share links, passwords, emails and account identifiers. Firebase Analytics is configured without advertising-ID support on iOS.

Sharing an album.

A share link is created only when you make one. We store the settings of the share and a hash of its secret, never the secret itself, so a copy of our database does not hand anyone your links.

• Share settings: expiry, the number of download grants allowed, whether a password is required, and for a restricted share the CloudWink user identifiers you invited.
• A record of sharing activity on your own albums, kept for 30 days, so the app can tell you a link was opened.
• Anyone you give a link to can see the files in that album and download them. Revoking a link stops new downloads, but download URLs already issued can keep working for up to a minute, and bytes already downloaded cannot be recalled.
• Notification text never contains file names, links or tokens. Album titles appear only if you turn that option on.

Subscriptions and payments.

Paid plans are sold as auto-renewing subscriptions through the Apple App Store and Google Play. We never see your card number, and we do not process payments ourselves.

• Purchases are handled by Apple or Google. They charge you, hold the payment details, and tell us whether an entitlement is active.
• We use RevenueCat as a processor to reconcile purchases. RevenueCat receives your CloudWink account identifier (never your email address or name), the product purchased, and purchase, renewal, cancellation and expiry events, along with device and country information it collects to deliver that service.
• Our servers store the resulting plan, quota and renewal state so the app can enforce what you paid for. Only an authenticated store webhook may change a plan.

Features you switch on.

Some data is collected only if you use the feature it belongs to, and turning the feature off stops the collection.

• Google Drive import: you grant a one-time, read-only access token which is used for that import and never stored as a long-lived credential. There is no background or recurring Drive sync, and we cannot reach your Drive again after the token expires.
• Locked folder: unlocking uses Face ID, Touch ID, fingerprint or your device passcode. That check happens on the device and its result never leaves it. The Locked folder is a visibility gate, not encryption: the files are stored like any other file and still count against your quota.
• Push notifications: tokens are relayed through Expo’s push service to Apple and Google. An account keeps at most ten devices, and a device that has not been seen for 90 days is dropped.
• Referrals: we store your referral code and the credits earned on each side. The summary shown in the app does not identify who earned a credit.
• Account emails: welcome and storage notices are sent by Amazon SES and carry an unsubscribe link. Service messages required to run your account, such as email verification, are not marketing and cannot be unsubscribed from.

Why we are allowed to use it.

Where the GDPR or UK GDPR applies, we rely on these legal bases: performing the contract with you, for account, storage, sharing and subscription data; our legitimate interests in keeping the service secure, preventing abuse and understanding aggregate usage; your consent, for photo library access, notifications and Drive import, each revocable in your device settings; and legal obligations, where we must keep or produce records.

Who else processes it.

We use the service providers listed below for the stated purposes. We do not sell your library or give its contents to data brokers. Optional Meta measurement shares advertising identifiers and app activity only with your tracking permission; Meta may process that information under its own policies to attribute advertising.

• Amazon Web Services: storage, database, authentication, delivery, email and logs. AWS is the substrate the whole product runs on.
• RevenueCat: subscription reconciliation. Apple and Google: payment, sign-in and app distribution.
• Expo: relaying push notifications to Apple and Google notification services.
• Google Firebase: app usage analytics and crash diagnostics. Meta: optional iOS advertising measurement after tracking permission, including activation/install signals, supported automatic purchase/subscription events, advertising identifiers, and SDK-collected device, network and app information. Neither integration receives your photo or file contents from CloudWink.
• Law enforcement or regulators, when a valid legal request compels disclosure, and a successor in a merger or acquisition, in which case this policy governs until the successor publishes its own.

Where your data lives.

Your account, metadata, subscription state and logs are held in the United States (AWS us-east-1). File bytes are stored in the storage region assigned to your account: the United States by default, or the United Arab Emirates (AWS me-central-1) when the app measures a materially faster path there. The assignment is automatic, based on connection latency, and can change at most once every 30 days; files already written stay where they were written. Transfers out of the EEA or the UK rely on the European Commission’s Standard Contractual Clauses.

How long we keep it.

Retention is bounded by design, and the boundaries are these.

• Files: until you delete them. Deleting a file moves it to Trash for 30 days, then removes every stored version.
• Account deletion: app access ends at once, and the erase of files, metadata, shares and the sign-in record begins about 20 minutes later, once download links already issued have expired.
• Database backups: point-in-time recovery holds a 35-day window, so deleted records can persist in backups for up to 35 days before ageing out.
• Request and access logs: 14 days. Sharing activity: 30 days. Device registrations: 90 days after the device is last seen.
• Usage counters that feed aggregate statistics: up to 400 days, tied to your account identifier, and removed with the account.

Your rights and how to use them.

Most of what a privacy request asks for is available directly in the app: download or delete any file, delete an album, revoke a share, change notification settings, unsubscribe from account emails, or delete the entire account from account settings.

• If the GDPR or UK GDPR applies to you: access, rectification, erasure, restriction, portability, objection, and the right to complain to your supervisory authority.
• If you are a California resident: the right to know, delete and correct, and to be free of discrimination for exercising them. We do not sell your library or process sensitive personal information to infer characteristics. Optional advertising measurement may constitute sharing under some privacy laws. You can decline or revoke tracking permission in iOS Settings and contact us about your privacy rights.
• Email support@cloudwink.pro to make a request. We answer within the time your law allows, normally one month, and we may need to confirm control of the account before acting.

How your data is protected.

Security measures we actually run, stated plainly.

• TLS in transit, AWS-managed encryption at rest, private buckets with no public access, and signed short-lived URLs for originals.
• Every request is authorised against a verified token, and the server derives your storage keys from your account identifier, so one account cannot name another’s files.
• On the device, tokens live in the iOS Keychain or Android Keystore; cached media sits in the app sandbox, is excluded from iCloud and Android auto-backup, and is wiped when you sign out.
• What we do not claim: CloudWink is not end-to-end encrypted, revocation is not instantaneous, and uploads are not scanned for malware. No transmission or storage system is perfectly secure.

Children.

CloudWink is not directed to children. You must be at least 13 to hold an account, or 16 where local law sets that as the minimum age for consent to online services, and under those ages a parent or guardian must hold the account. We do not knowingly collect data from children below the applicable age; if we learn that we have, we delete the account and its contents.

Advertising.

CloudWink does not display third-party ads in the app. Starting with iOS 1.0.2, we use Meta’s SDK to measure ads promoting CloudWink only when you allow Apple’s App Tracking Transparency prompt. Meta’s SDK may collect IDFA, app/device and network information, activation signals and supported automatic store events to match app activity to advertising. We do not send your files or account identifiers to Meta. The prompt appears after onboarding and sign-in when the main app is ready. Decline to keep Meta measurement off, or revoke it in iOS Settings → Privacy & Security → Tracking. Firebase product analytics and crash reporting are separate from this permission. Meta’s privacy policy is at https://www.facebook.com/privacy/policy/.

Changes to this policy.

This policy was last updated on 1 November 2026. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect, and the date above will change.

Contact us.

Email support@cloudwink.pro with any privacy question, request or complaint. If you are in the EEA or the UK you may also complain to your national data protection authority.