Kipply
Privacy Policy
Last updated: November 15, 2026
1. Who we are
Visto Apps is the brand of Darius Cirjan, the developer and data controller. This policy explains what the Kipply app (iOS) and the website https://kipplyapp.com do with personal data.
Contact for any privacy question or request: iosallapps@gmail.com. Website: vistoapps.com. We answer within one month (art. 12 GDPR). We are not required to appoint a Data Protection Officer.
Last updated: November 15, 2026.
2. At a glance
- No account. Kipply does not ask for your name, email or phone number.
- Your photos and videos are scanned on your device and are never uploaded. Review history, statistics and scan results stay on your device.
- The free version shows ads from Google AdMob. Personalised ads only with your consent; in the EEA, UK and Switzerland no ad loads before you answer the consent form.
- Usage statistics (Google Analytics for Firebase) start only after the consent form has been answered in the EEA, UK and Switzerland. Crash reports help us fix bugs.
- We do not sell personal data for money. We have no servers of our own that receive your data.
3. Data that stays on your device
Kipply needs access to your Photos library to work. It reads your photos and videos on the device, with details stored with them such as date, size, type and any location your camera recorded, to show them to you and to find duplicates, similar shots, screenshots and blurry photos. To compare photos it calculates small image fingerprints and measurements such as sharpness and how many faces or animals appear. It does not recognise who anyone is. These results and the thumbnails Kipply makes are stored on your device only. A location saved in a photo is only shown to you; Kipply never asks for your device's location.
Kipply also keeps on your device your review history (which items you kept or marked for deletion, and the Deleted tab list), your statistics, streak, XP and challenges, your preferences, and your consent choices. Two counters for the free daily swipe limit are kept in the iOS Keychain, so the limit still applies after a reinstall; they hold only counts and a date. We have no server that receives any of this and we cannot see it. This data can be part of your iCloud or computer backup, which Apple's own policy covers.
How to remove it: Settings, Data, Reset Statistics clears your statistics. Deleting the app removes the rest, except the two Keychain counters. Swiping an item to Deleted does not remove it from your library until you confirm. If you use Share, iOS sends the item only to the app or person you choose and Kipply gets no copy.
4. Services that receive data
Each service below receives data only when the part of the app that uses it runs. Google, Apple, RevenueCat and the other providers act as independent controllers or as our processors, under their own terms.
| Service | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Google AdMob Google Ireland Ltd / Google LLC | Advertising identifier (IDFA, only if you allow tracking), IP address, device and app information, ad impressions and taps, and the answer you gave in the consent form. | Showing full-screen ads (when the app opens and at some points while you use it) in the free version. Personalised ads only with your consent; otherwise limited, non-personalised ads. Never chosen from your photos. | Personalised ads: consent, art. 6(1)(a) GDPR and art. 5(3) ePrivacy. Limited ads: legitimate interest in funding the free app, art. 6(1)(f) GDPR. | Set by Google (see its policy). Outside the EEA. |
| Google User Messaging Platform Google Ireland Ltd / Google LLC | Your consent choices (IAB TCF string), stored on the device; device information needed to show the form. | Asking for and recording your consent in the EEA, UK and Switzerland. | Legal obligation, art. 6(1)(c) GDPR | On your device until you change it or delete the app. Outside the EEA. |
| Google Analytics for Firebase Google Ireland Ltd / Google LLC | A random app instance ID, events such as screens opened, features used and purchases started, app version, device model, OS, language, country derived from the IP address. | Understanding which features are used so we can improve the app. No name, email or content you create is sent. | EEA, UK and Switzerland: consent given in the consent form, art. 6(1)(a) GDPR. Elsewhere: legitimate interest in improving the app, art. 6(1)(f) GDPR. | At most 14 months for event data. Outside the EEA. |
| Firebase Crashlytics Google Ireland Ltd / Google LLC | Crash reports: stack trace, device model, OS and app version, a random installation ID. | Finding and fixing crashes. | Legitimate interest, art. 6(1)(f) GDPR | 90 days. Outside the EEA. |
| Firebase Performance Monitoring Google Ireland Ltd / Google LLC | App start and screen timings, timings and sizes of the app's network requests, device model, OS and app version, a random Firebase installation ID, IP address. | Measuring how fast the app starts and runs so we can fix slowness. Runs on its own, without waiting for the consent form. | Legitimate interest, art. 6(1)(f) GDPR | Set by Google (see its policy). Outside the EEA. |
| Firebase Remote Config Google Ireland Ltd / Google LLC | A random Firebase installation ID, app version, device model, OS, language, IP address. | Fetching app settings we can change without an update, such as limits and which offer layout is shown. Runs at every launch and does not wait for the consent form. | Legitimate interest, art. 6(1)(f) GDPR | Set by Google (see its policy). Outside the EEA. |
| RevenueCat RevenueCat, Inc. (USA) | A random customer ID, purchase receipts and subscription status from the store, app version and country. | Checking which purchases you own and unlocking them, including on restore. | Performance of a contract, art. 6(1)(b) GDPR: needed for the feature you use | While you use the app, then deleted on request. Outside the EEA. |
| Apple App Store Apple Distribution International Ltd | Your Apple Account, payment details and purchase history. We never see your payment details. | Selling and renewing purchases, refunds. | Performance of a contract, art. 6(1)(b) GDPR: needed for the feature you use | Set by Apple. |
- Kipply has no feature that uploads your photos, videos, image fingerprints or scan results, and none of the services above receive them. Ads are never chosen using your photos. Photos kept only in iCloud are fetched by iOS (PhotoKit) when Kipply shows them; that traffic is between your device and Apple, not Kipply.
- Analytics events are about the app, not your library: screens opened, features used, purchase steps, and running totals such as swipes made, photos cleaned and storage freed. They carry no photo, file name, location or album.
- RevenueCat receives the Firebase app instance ID only while analytics is allowed, so that renewals and trial conversions can be counted in the statistics.
- Crash reports and performance measurements are not held back by the consent form; they are sent on the basis of our legitimate interest in a working, fast app and contain no photos.
- Kipply Pro shows no ads and no consent form. The Kipply Control Center control, Siri and Shortcuts only open parts of the app on your device and send nothing.
5. Permissions
The app asks for these permissions only when you use the feature, and works without them. Change them anytime in your device settings.
- Photos library. Needed for the app to work: Kipply reads your photos and videos on the device to show and sort them, and deletes only what you confirm. You can give full or limited access, and change it in iOS Settings, Kipply, Photos. Nothing from your library is sent to us or to any service listed above.
- Tracking (iOS, App Tracking Transparency). Asked once, after the consent form. If you choose Ask App Not to Track, the IDFA is not shared and ads are not personalised with it.
- Notifications. Local reminders scheduled on the device. No push server is involved.
6. Consent, ads and tracking
In the EEA, the UK and Switzerland the app first shows Google's consent form (a certified consent management platform under the IAB Transparency and Consent Framework). Until you answer it, no ad is requested and no usage statistics are sent. If you refuse personalised ads, you still get limited, non-personalised ads.
On iOS the App Tracking Transparency prompt comes after the consent form. Ads load only once it is answered.
Change your choice anytime: in the app, Settings, Legal, Ad Privacy Settings (shown only where the consent form applies). On iOS, also Settings, Privacy & Security, Tracking.
Analytics in those regions also need your consent to storing information on the device and to measuring performance; if you do not give it, analytics stays off.
Buying the paid version removes ads.
7. Purchases
Purchases are made through App Store. The store processes the payment; we receive only a pseudonymous receipt, checked through RevenueCat, that tells the app which purchase you own. We never see your card or account details.
8. How long data is kept
Data on your device stays until you reset your statistics in the app or delete the app; the two Keychain counters described above stay on the device after the app is deleted, until the device is erased. Data held by the services above is kept for the period listed in the table. We do not keep copies of our own. Emails you send us are kept as long as needed to answer, and at most 2 years.
9. Transfers outside the EEA
Some providers (Google, RevenueCat and others marked in the table) process data in the United States or other countries. Transfers rely on the EU-U.S. Data Privacy Framework for certified companies or on the European Commission's Standard Contractual Clauses (art. 45 and 46 GDPR).
10. Your rights (EEA, UK, Switzerland)
You have the right to access, correct and delete your data, to restrict or object to processing (including to object at any time to processing based on legitimate interest), to data portability, and to withdraw consent at any time without affecting earlier processing.
Because the app has no account, we usually cannot tell which data at Google or RevenueCat is yours. Write to iosallapps@gmail.com and, if you can, include an Apple order number for a purchase, and we will forward the request to the provider. You can remove the data on the device by deleting the app (see above for the two Keychain counters).
You can complain to the supervisory authority where you live or work, or to ours: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro. The list of EU authorities: edpb.europa.eu.
11. United States
- We do not sell personal information for money.
- When you allow personalised ads, Google AdMob uses your advertising identifier for ads based on activity in other apps. Some US state laws (for example California) call this "sharing" or "targeted advertising". You can opt out at any time: refuse tracking on iOS (Settings, Privacy & Security, Tracking), or email us and we will treat it as an opt-out request.
- Residents of California and other US states with privacy laws can ask to know, correct or delete their personal information, and will not be treated differently for doing so. Categories collected in the last 12 months are the ones in the table above (identifiers, internet activity, approximate location from IP, purchase records). Requests: iosallapps@gmail.com.
12. Children
Kipply is not directed at children. We do not knowingly collect personal data from children under 13, or under the age of digital consent in their country (13 to 16 in the EU). If you believe a child gave us data, write to iosallapps@gmail.com and we will delete what we can reach. Ads in the app are not designed for children.
13. Security
All network connections use HTTPS. Data on the device is protected by the operating system's app sandbox and encryption. No system is perfectly secure, so we keep what leaves your device to the minimum listed here.
14. This website
kipplyapp.com is hosted on GitHub Pages (GitHub, Inc., USA), which records the IP address of visitors in server logs for security. The site sets no cookies, uses no analytics or ads, loads no third-party scripts or fonts, and stores nothing in your browser. Its links to the App Store lead to Apple's own pages.
15. Changes
If the app starts handling data differently, we update this page and the date at the top before the new version ships. Important changes are also mentioned in the store update notes.