Privacy Policy

1. Data processed on your device, not collected by us

To categorise your media, find duplicates, and let you review and delete them, the app reads, locally, on your device only, the following:

• photo_libraryPhotos and videos and their metadata (file name, size, dimensions, creation date, album), via the READ_MEDIA_IMAGES and READ_MEDIA_VIDEO permissions.
• descriptionDocuments, to find duplicate files. On Android 11 and later this uses the MANAGE_EXTERNAL_STORAGE permission, which Android grants only after you allow it explicitly in system settings. The app reads file names and sizes, and reads a candidate file's bytes only to compute a content hash; it never parses, indexes, stores or transmits what a document contains.
• auto_awesomeOn-device machine learning. Categorisation (for example pets, food) runs through an on-device library, Google ML Kit Image Labeling. Images are not sent to a server for analysis. Results (category, confidence score, label text) are stored only in a local database on your device.
• fingerprintDuplicate detection. Content hashes (MD5, and quickXorHash for OneDrive) are computed to find exact byte-identical copies. Hashes are cached locally on your device.

This on-device data lives in a local SQLite database, on-device key/value storage, and the app's private files. It never leaves your device except through the optional features below, and it is removed when you uninstall the app.

2. Cloud accounts, optional and only if you connect one

If you choose to connect Google Drive or Microsoft OneDrive, you authorise the app via OAuth 2.0. In that case:

• sync_altThe app communicates directly with Google's and Microsoft's APIs to list your files and their metadata and content hashes (to count photos and find duplicates) and to delete files that you select. Google Drive and OneDrive deletions are permanent and bypass the provider's trash.
• keyAccess tokens are stored on your device. Signing in with Google is handled by Google Play Services, so no Google refresh token is stored at all: each request obtains a short-lived access token from the system and keeps it only for that request. For OneDrive, the long-lived refresh token is held in the Android Keystore. We do not receive or store your cloud credentials on any server of ours, because we operate none.
• link_offYour use of Google Drive and OneDrive is also governed by Google's and Microsoft's own privacy policies. You can disconnect a cloud account at any time in the app, which removes the stored tokens and cached cloud data from your device.

The app integrates Google Drive and Microsoft OneDrive only. It does not access Google Photos.

3. Subscriptions and purchases

Optional subscriptions are sold through Google Play and managed with RevenueCat, a third-party subscription-management service. When you purchase or restore a subscription, RevenueCat processes purchase information (a purchase receipt or transaction, an app-generated user identifier, and device and platform information) to validate your entitlement. We do not receive or store your payment card details; those are handled by Google Play. See RevenueCat's privacy policy and Google Play's privacy policy for details of their processing.

4. Notifications

The app may send local notifications on your device, for example an Auto-Pilot alert when a background scan finds new duplicates, or a reminder about your free monthly allowance. These are generated on your device: there is no push server and no personal data is transmitted to send them. You can turn them off in the app (Profile, then Notifications) or in your device settings.

5. Audience measurement

The app includes Google Analytics for Firebase, for one narrow purpose: attributing subscription events so we can tell whether the paid tier works. Firebase generates a pseudonymous app instance identifier and collects technical and usage data such as app version, device model, operating system, coarse region derived from your IP address, and app-open and subscription events. RevenueCat forwards subscription events to that Google Analytics property, keyed on the same identifier.

• image_not_supportedMeasurement never touches the content of your photos, videos or documents. It records how the app is used, not what is in your library.
• blockWe do not integrate advertising SDKs, we do not use an advertising identifier, we do not build profiles or cross-app tracking, we never sell your data, and there is no automated decision-making.
• infoMeasurement currently starts when you first open the app, and the app does not yet offer an in-app switch for it. Uninstalling the app stops it. If you want your measurement data deleted, write to us and we will have it removed from the Google Analytics property.

Internal event counters used purely for in-app logic stay in memory on your device and are never transmitted.

6. Background processing

The app may run a periodic background task (using RECEIVE_BOOT_COMPLETED) to analyse newly added photos and detect duplicates. It is a deferrable window scheduled by Android, not a foreground service. All of this runs on your device; it does not upload your photos.

7. Legal bases

Under Article 6 of the GDPR, each purpose rests on a specific legal basis:

8. Recipients and transfers outside the EU

We have no server, so there is no database of ours holding your data. The recipients are the services you use:

• cloudGoogle LLC (Google Drive API, Google Sign-In, Google Play, Google Analytics for Firebase) and Microsoft Corporation (OneDrive API).
• card_membershipRevenueCat, Inc., as a processor for subscription management.

These providers are established in the United States, so the data described in sections 2, 3 and 5 may be transferred outside the European Union. Such transfers rely on the safeguards in Chapter V of the GDPR: the EU-US Data Privacy Framework where the provider is certified, and otherwise the European Commission's standard contractual clauses. You can ask us for the specific safeguard applying to a given provider.

9. Data protection and security measures

Diluza is a local application. There is no Diluza server, no user account and no database operated by us. Your photos and your Google Drive information never reach a server under our control. The measures below describe how sensitive data (your Google account credentials and the Google user data obtained through the https://www.googleapis.com/auth/drive scope) is protected on your device and while it travels to Google.

• httpsEncryption in transit. All communication with Google (OAuth 2.0 and the Google Drive API v3) and with Microsoft OneDrive uses HTTPS, over the Android platform's TLS stack. The released application contains no unencrypted endpoint, permits no cleartext traffic and defines no custom network security configuration, so Android's platform-wide block on unencrypted traffic applies to every request. Certificate validation is never overridden, relaxed or bypassed.
• keyCredentials. Signing in with Google is handled by Google Play Services, which holds the credential material: Diluza never sees your Google password, and stores no Google refresh token at all. Each request to Google Drive obtains a short-lived access token from the system at the moment it is needed and keeps it only for the duration of that request. For Microsoft OneDrive, where the sign-in flow does hand the application a long-lived refresh token, that token is stored in the Android Keystore , hardware-backed on devices that provide a secure element, and never in plain text in ordinary application storage.
• encryptedEncryption at rest. All other application data is stored in the application's private storage area on your device, protected by Android's file-based encryption and unlocked only with your device credentials. This includes the Google Drive inventory (file identifiers, names, sizes and checksums, that is, metadata only) held in a local SQLite database, and the thumbnail images cached so the app can show you what you are about to delete.Nothing is written to shared or external storage where other applications could read it. Automatic cloud backup of the application's data is disabled, so this data is never copied into a Google account backup nor transferred to another device.
• shieldAccess control and isolation. The Android application sandbox prevents any other application from reading Diluza's storage. Access to your Google Drive is granted only through the Google consent screen and can be revoked by you at any time. Although the permission Google grants is broad, the app only ever reads and acts on the image and document files you own (see Data minimisation below) and never on anything else. Because we operate no server, there is no administrator, employee or subcontractor account able to reach your data: no human being ever sees it.
• filter_altData minimisation. Finding duplicates uses metadata only: the app compares the checksum Google Drive itself computes and returns, so it never needs to download the content of your files to detect a duplicate. It lists only files that you own and that are not in the trash: images, and the document and archive types the duplicate finder can group (PDF, Office and OpenDocument files, RTF, plain text, CSV, ZIP/RAR/7z); files other people have shared with you are never listed.Checking what has changed since the last run goes through Google Drive's change feed, which the Drive API does not allow to be filtered by file type. Google therefore returns basic details (name, size, type, checksum) for any file you changed in your own Drive, and the app discards everything outside the types above immediately, on your device. Nothing else is ever stored, grouped, or shown to you.Deletion is performed only on the files you have explicitly selected and then confirmed in a dedicated confirmation step that states the deletion is permanent.Your files' contents are downloaded in exactly two situations, both of them for your benefit and never in the background: the thumbnail of a file, so you can see what you are about to delete, and the full-resolution original of a single photo when you tap Share on it. The file is placed in the app's temporary cache and handed to the Android share sheet you chose.
• blockNo transmission to third parties. Google user data is never transmitted to us or to any third party. Two third-party components are integrated. RevenueCat receives your subscription status only. Firebase Analytics collects standard app-usage telemetry automatically (an app-instance identifier, device and app-version information, session and screen events, and an approximate location derived from your IP address), as declared in this app's Play Store data-safety section; the application itself sends it no custom event of its own. Neither of them ever receives any Google Drive data: no file name, file identifier, checksum, thumbnail, or any other Drive content or metadata is included in what they receive.
• link_offDeletion and revocation. Disconnecting a cloud account inside Diluza revokes the authorisation on your Google account (the permission is withdrawn from the account itself, not merely forgotten by the app) and, in the same operation, erases from the device the Drive inventory, the duplicate results, the review progress, the stored quota and any token held. Temporary image caches managed by the system are cleared with the app's cache or on uninstall. You may also revoke the access at any time from your Google account at myaccount.google.com/permissions. Uninstalling the application removes all of its data from the device.
• verified_userApplication hardening. Published builds are code-shrunk and obfuscated (R8), are not debuggable, and contain no debugging or proxy configuration. The application ships no client secret.

10. Retention

• smartphoneOn your device (classifications, hashes, preferences, cached cloud data): until you uninstall the app or clear its data.
• link_offCloud tokens and cached cloud data: deleted as soon as you disconnect the account in the app.
• receipt_longSubscription records at RevenueCat and Google Play: for the life of the subscription plus the period their own policies and applicable accounting law require.
• query_statsMeasurement data: retained for the period configured in the Google Analytics property, 2 months by default, then deleted.

11. Children

The app is not directed to children under 15, the age of digital consent in France, and we do not knowingly collect personal data from them.

12. Your rights

You have the rights of access, rectification, erasure, restriction of processing, objection and portability, and the right to withdraw your consent at any time. Because the app's processing happens on your device and we hold no account about you, most of these are exercised directly:

• deleteErasure of on-device data: uninstall the app or clear its data in Android settings.
• link_offCloud access: disconnect the account in the app, and revoke Diluza's access in your Google or Microsoft security settings.
• toggle_offMeasurement: uninstall the app, or ask us to delete your measurement data.

For anything else, write to contact@diluza.com. We answer within one month, as required by Article 12 of the GDPR.

This policy and the processing it describes are governed by French law and by the GDPR. If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French supervisory authority, at cnil.fr.

13. Changes to this policy

We may update this policy. Material changes will be reflected by updating the effective date above and the hosted version linked from the app.

14. Contact

Bastien Botrel, contact@diluza.com