Effective: September 1, 2026
Data controller:
PIOTR SĘKARA
PL5423191872
ul. Podlaska 2B/5
15-549 Białystok
Your photos and videos never leave your device. Poof has no accounts, no sign-in, and does not know who you are. Four things leave the phone: anonymous usage statistics, crash reports, a message if you choose to send one from the feedback sheet, and the fact that you bought Premium.
Poof reads your photo library through Apple's PhotoKit so it can show it to you for review. Photos, videos, thumbnails and metadata are never uploaded, copied or stored anywhere outside your device. Your decisions (keep, trash, later) are saved locally only.
Deletion is performed by iOS on your instruction and after your confirmation. Deleted photos go to the system Recently Deleted album, where they stay for around 30 days under Apple's own rules.
Poof uses Google Firebase Analytics to learn which screens and features are used. It records events such as "screen opened" and "button tapped", along with counts: how many photos a sitting reviewed, how many went to the trash, how much space was reclaimed. Technical details are sent with them (device model, iOS version, language, app version) plus a pseudonymous app instance identifier that is not linked to you or to your Apple Account.
We never send photos, thumbnails, file names, photo identifiers, or when and where a photo was taken.
Poof does not track you in Apple's sense of the word: it does not use the advertising identifier (IDFA), never shows the App Tracking Transparency prompt, does not combine data with other companies' data, and shows no ads.
Poof uses Firebase Crashlytics. If the app crashes, it sends the state of the program at that moment, the device model and the system version. It contains none of your photos or content.
If you send a message from the feedback sheet, it is delivered to the developer's private Slack channel. The message, the category you picked, the app version and build, the device model, the iOS version, the language and the name of your plan are sent. No email address or identifier is attached, so a message cannot be replied to unless you include contact details in it. Only the developer sees it.