Sift Privacy Policy

In short

• Your photos never leave your device. Sift reads them, shows them to you, and deletes the ones you choose. Nothing is uploaded to us.
• Face detection happens on your device only. The face data Sift creates stays there and is never transmitted.
• Analytics is off unless you turn it on. If you do, Sift sends one small daily upload of counts. It contains no photos, no name, and no identifier that links it to you or your device.
• We do not sell or share your data, and we show no advertising.

This summary is not a substitute for the detail below, but it is accurate.

1. Who we are

Controller: Yotam Samuel Rozin, a sole trader established in England and Wales, trading as YORO, developer of the Sift Android application.

Postal address: Unit 171423, PO Box 7169, Poole, BH15 9EL, United Kingdom

Email: support@yotamrozin.com

2. Your photos

Sift reads the photos on your device so it can show them to you for review, and deletes the ones you confirm you want deleted. This access is necessary for the app to do anything at all.

Your photos are processed entirely on your device. They are never uploaded, transmitted, copied to any server, or seen by us. We hold no copy of any photo and could not retrieve one if you asked.

We are not a controller of your photo library. It is your data, on your device, and you decide what happens to it.

Deleting a photo in Sift removes it from your device's storage only. It does not delete copies you have backed up to Google Photos or other cloud services — those services keep their own copies until you delete them there. Android keeps device storage and cloud backups separate, and Sift has no access to your cloud accounts. If a photo matters to you, keep a backup.

3. Face and pet detection (People & Pets)

To group photos by the people and pets in them, Sift detects faces in your photos and creates face crop images and facial geometry data.

This happens entirely on your device. The face data is stored in Sift's private app storage, is never transmitted anywhere, and is never accessible to us.

Facial geometry is biometric data. Under UK and EU data protection law, biometric data used to identify individuals normally attracts additional protection. Because this processing happens solely on your own device, under your control, for your own personal use, we do not receive it and do not act as a controller of it. We are telling you about it because you should know it is happening, not because we hold it.

Controls:

• People & Pets is off by default. Face detection runs only after you turn it on by tapping "Find people" in the People & Pets collection, which records your consent first. No facial-geometry data is created before that. If you used an earlier version of the app, any face data it created is erased until you opt in.
• You can turn it off and delete all face data at any time in Settings → Privacy → Delete face data, which erases the facial-geometry data and face crops from your device immediately.
• All face data is stored in Sift's private app storage and is removed when you uninstall Sift.
• We do not retain face data for any period, because we never receive it.

4. Analytics (optional, off by default)

If you turn analytics on, Sift sends one small upload per day. Counts are accumulated on your device throughout the day, and only the daily totals are sent.

What is in the upload:

• how many review sessions you started and completed that day;
• which locked Premium features you tapped;
• a small number of yes/no flags recording which prompts the app showed you and whether you used your free weekly session;
• a coarse "week 1 to 4" retention bucket;
• the date, and a random one-off reference number used to discard duplicate uploads.

What is not in the upload: no photos, no face data, no name, no email address, no location, no device identifier, no install identifier, no advertising identifier, and no session token. Nothing links one day's upload to another, or to you. Your install date never leaves your device — only the coarse week bucket derived from it.

We have designed this so that we cannot identify you from it. The random reference number in each upload is generated fresh every time and never stored, so it cannot be used to connect two uploads.

As with any request sent over the internet, your device's IP address is visible to our hosting provider (Cloudflare) at the moment the upload is received. We do not log or retain it — the server never reads the IP, and edge request-logging is disabled.

Why we do this: to understand whether the app is useful — whether people finish review sessions, which features they look for, and whether they come back. It is the only feedback we get.

Legal basis: your consent, under Article 6(1)(a) UK GDPR and EU GDPR where the data is personal data, and under regulation 6 of the Privacy and Electronic Communications Regulations 2003 for storing the counter buffer on your device. You can withdraw consent at any time and it is as easy to withdraw as it was to give.

Turning it off: Settings → Privacy. Withdrawing consent stops collection immediately and deletes any analytics data still held on your device.

5. Where data goes, and who else is involved

Cloudflare (analytics hosting)

Analytics uploads are received and stored by Cloudflare, Inc., acting as our data processor under Cloudflare's Data Processing Addendum, incorporated into the Self-Serve Subscription Agreement (which includes the EU Standard Contractual Clauses and CCPA service-provider commitments).

Cloudflare operates a global network, so an upload may be received and processed at an edge location outside the UK and the EEA. International data transfers to Cloudflare (a US-based processor) are governed by the UK International Data Transfer Addendum (IDTA), which incorporates the EU Standard Contractual Clauses as adopted under UK GDPR. Cloudflare's Data Processing Addendum incorporates these Standard Contractual Clauses alongside supplementary technical and organisational measures (encryption, pseudonymisation). Cloudflare additionally holds certification under the UK Extension to the EU-U.S. Data Privacy Framework, providing a supplementary transfer mechanism.

You can request a copy of the safeguards by emailing support@yotamrozin.com.

Our analytics database holds only aggregate, non-identifying counts, and it is pinned to Cloudflare's European Union jurisdiction (created with EU data residency), so this data is stored within the EU.

Cloudflare has no access to your photos, your face data, or any information identifying you.

Google (app distribution and purchases)

Sift is distributed through Google Play. If you purchase Premium, Google processes your purchase as an independent controller under its own privacy policy, and in most countries acts as the seller of record. We never see or hold your payment details. Google also processes app installation and crash data under its own terms. See https://policies.google.com/privacy.

Crash reporting

We do not use any third-party crash-reporting software. Crash and performance data collected automatically by Google Play is processed by Google under its own privacy policy.

Nobody else

We do not sell, rent, or share your data with any third party for advertising or marketing. We show no advertising in Sift. We have no other processors.

6. How long we keep things

7. Security

We keep the amount of data we hold to a minimum, which is the most effective protection available. Your photos and face data never leave your device, so they cannot be exposed by any breach of our systems.

Analytics uploads are sent over an encrypted connection (HTTPS) and stored on Cloudflare's infrastructure, which is subject to their security programme. Access to the analytics database is restricted to the developer.

No system is completely secure, but because we hold nothing that identifies you, the consequences of any compromise of our systems are limited.

8. Your rights

Under UK and EU data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data deleted;
• restrict how we use it;
• object to our use of it;
• receive it in a portable format;
• withdraw consent at any time, where we rely on consent;
• complain to a supervisory authority.

In practice. Because Sift holds nothing on our servers that identifies you or your device, we cannot locate "your" data in order to act on most of these rights — there is no key to look you up by. This is a consequence of the design, not an evasion. The rights that are meaningful here are the ones you can exercise directly in the app: withdrawing analytics consent, which stops collection and clears local data immediately, and deleting your face data.

If you believe we hold personal data about you and want to exercise any right, email support@yotamrozin.com and we will respond within one month.

Complaints. You can complain to the Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your country if you are in the EEA. We would appreciate the chance to put things right first.

9. Photos of other people

Your photo library will contain images of friends, family and strangers who have not agreed to anything. Because all processing happens on your device, under your control, for your own personal and household purposes, we are not a controller of those images and no data about those people reaches us.

You remain responsible for how you use your own photographs.

10. Age

Sift is intended for users aged 18 and over. We do not knowingly collect information from anyone under 18. We use Google Play's minor restriction feature to limit access to users Google has determined to be adults.

11. Changes to this policy

If we make material changes we will tell you in the app before they take effect, and update the date above. Where we rely on your consent and want to use data for a new purpose, we will ask you again rather than assuming your agreement.

Previous versions are available on request.

12. Contact

Annex A — Region-specific information

A1. United States — California

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, and we do not use personal information for cross-context behavioural advertising. We have not sold or shared personal information in the preceding twelve months.

A2. United States — Illinois

Because Google Play availability cannot be limited to exclude a single US state, the following notice applies to residents of Illinois:

Notice to Illinois residents. Sift's People & Pets feature creates facial geometry data from photos on your device in order to group them. This data is created and stored solely on your device, is never transmitted to us or to any third party, and is never sold, leased or otherwise disclosed. It is deleted when you turn the feature off, when you delete face data in Settings → Privacy, or when you uninstall the app, and in any event no later than 3 years after your last use of the app. We obtain your consent before this processing begins.

A3. European Economic Area

Your rights under the EU GDPR apply as set out in section 8. You may complain to the supervisory authority in your country of residence. Our lead position is with the UK ICO as we are established in the United Kingdom; if you are in the EEA you may still complain locally.

A4. Canada

PIPEDA applies to personal information handled in the course of commercial activity. If you reside in Quebec, Law 25 applies and you are entitled to this policy in French.