Privacy policy

1. Who this covers

This policy describes what Rollshelf (the "app") does with information on your phone, and the small amount of information that leaves it. The app is published by Dinesh Kumar, Chandigarh, India (the "developer").

2. What the app reads

The app asks for permission to access your photo library, and it reads what the operating system grants: the photos and videos on your phone — all of them, or, if you chose "Selected photos", only the ones you picked. It reads them to sort screenshots onto shelves by what each one needs, to find duplicates, videos, old months and documents, and to make the grid and search work.

iOS and Android grant photo access at the library level, not per album, and the app uses it at that level. You can narrow or revoke it in system settings at any time; the app re-reads the level every time it opens and works on whatever it is given.

For each photo or video, the app reads the image (or one frame of a video), the date it was taken, its size and kind, whether it is a screenshot, and, where the operating system provides it, the albums it is in, whether you have favourited it, the name of the app a screenshot came from, and the place stored in the file — that last one only while "Keep photo locations" is on (§4.1).

It also reads what you hand it yourself:

• Things you share into the app from another app's share sheet (a picture, or text) are read the same way and kept as items on your phone.
• The camera is used only by Scan, when you tap it, to photograph paper documents (on iPhone, Apple's own document camera; on Android, your camera app). The app never uploads the pages.
• The tools (Scan, Resize, Redact, Long screenshot, Convert, Photos to PDF, Edit and the others) read only the photos you pick in them.

3. What is processed, and where

All processing happens on your phone, using models that ship inside the app or with the operating system. Nothing is sent to a server for processing, and no model is downloaded after installation.

On Android, text recognition uses Google's ML Kit with models bundled into the app. The models run on the device; what the library itself reports to Google is in §5.3.

Faces. The app does not recognise faces. It builds no face template, no face signature and no "people" grouping, and it never works out who is in a photo — not on your phone, and not on our one server, the invite service (§5.7), which never receives a photo. Nothing in the app identifies a person from their appearance.

4. What is stored

The results above, together with the state of each item (active, snoozed, done, kept, archived, deleted) and the actions you take, are stored in a local database on your phone. Small thumbnails are cached locally to make lists fast.

• Backups. iPhone: the database is part of your iPhone backup when you back up to iCloud or a computer, like every app's data — so the text read from your photos travels with that backup, and so do your Vault items and any pack not yet saved (§4.2, §4.3). It goes nowhere else. A pack saved to your folder is backed up with that folder, if at all. Android: the app opts out of Google's backup, so neither the database nor a pack not yet saved is in it. The thumbnail cache is in neither.
• The database is stored in the app's private storage and protected by the operating system's file protection.
• Videos are handled like photos: the app reads the date, size and length and one frame, to make a thumbnail and to spot near-copies and large files. It does not transcribe audio and keeps no copy of a video outside a pack or the Vault (§4.2, §4.3).
• The app writes to your photo library only when you ask: deleting photos (the system confirmation every time, one dialog per batch), adding to or removing from an album, setting the favourite flag, Space saver and Unpack (§4.2), Move to Vault and Put back (§4.3), and saving a new copy you made with a tool, only when you tap Save — the original is left as it is. Nothing is copied, moved, changed or deleted as a side effect of anything else you do in the app.
• "Show in Spotlight" (iPhone) or "Show in device search" (Android) is on unless you turn it off in Settings → Search: a screenshot's title, some of its text and a few keywords go into the operating system's on-device search index. Documents and anything you moved to Personal never do. That index stays on your phone and is removed when you turn the switch off or delete the app.
• Deleting the app deletes the database, the cache, your Vault items, any pack not yet saved and everything the app learned. Packs saved to your folder stay there.

4.1 Where a photo was taken

Many photos carry the place they were taken inside the file (EXIF GPS). The app reads it only while "Keep photo locations" is on in Settings → Photos & privacy (it is on unless you turn it off), and then keeps the coordinate in the local database so photos can be grouped by place. It is never turned into a place name, never used for advertising, and never sent anywhere by the app. Turning the switch off removes every location the app has stored and stops it reading them.

What the app does with it: it works out roughly where your phone usually is — as a wide grid cell covering tens of kilometres, never a street address — and puts photos taken well away from there on the Places shelf. That is the only use. The app never turns a coordinate into a place name: doing so would mean sending it to a mapping service, and the app never sends a coordinate anywhere. Any name a place has is one you gave it.

4.2 Space saver (packs)

Space saver packs photos you choose into a pack: one zip file. With smaller copies (offered when they save space), the pack keeps a re-saved, smaller copy of each photo and each video — a video at its own size or, if you pick it, at 1080p or 720p — instead of the original; with Keep originals, the originals themselves. The app checks every copy, then the pack is saved as a file to the folder you choose, and only then does the app ask the operating system to remove those photos from your library. The system's own delete dialog is the only thing that removes them, and you see it every time. Unpack puts the pack's copies back in your library. Once the originals are gone from the system's Recently Deleted, a pack of smaller copies cannot give the full-size originals back.

• A pack goes only where you save it. The app never sends a pack to us or anyone else. iOS: you save each pack through the share sheet — Save to Files, AirDrop or a cloud drive's own app — into the folder you made, "Rollshelf Packs (do not delete)", on your iPhone or in iCloud Drive. Android: the app writes each pack to the folder you allowed once (it makes "Rollshelf Packs (do not delete)" in Documents), reads it back and checks it. Where you keep it, and that place's own terms, are yours.
• What the app keeps. Once a pack is saved, the app deletes its own copy of the zip and keeps small previews and the pack's list of photos, so it can show you the pack and unpack it. To unpack, it reads the pack back from your folder (Android) or asks you to pick the file (iOS), and checks it first.
• Deleting a pack's file deletes the photos in it. Neither the app nor we can bring them back. The names end in "(do not delete)" to warn.
• A pack not saved yet stays in the app's own storage for up to seven days, and nothing has left your library for it; then it is discarded. On iOS it is in your iPhone backup and kept when the app is offloaded; on Android, Google's backup does not carry it, and "Keep app data" in the uninstall dialog keeps it. Deleting the app deletes it.

4.3 The Vault and Documents

Move to Vault copies a photo or video into the app's own storage, checks that the copy opens, and only then asks the operating system to remove the original from your library — on Android a real delete, on iPhone into Recently Deleted, which the app cannot skip. Only your phone's own lock opens the Vault (Face ID, Touch ID, fingerprint or passcode); the app keeps no PIN of its own and never sees or stores your biometrics — the operating system only tells it whether the unlock succeeded. Other apps cannot see it. Put back returns an item to your library.

• iOS: like a pack, the Vault is included in your iPhone backup, and deleting the app deletes it.
• Android: Android's backup does not carry it, and uninstalling the app deletes it. Put things back before you uninstall or change phones.

Documents are photos the app recognises as identity cards or other important documents. They stay in your library; the app shows them behind your phone's lock (on unless you turn it off in Settings → Photos & privacy, on a phone with a passcode set), masks their numbers to the last few characters before anything is written down, and keeps them out of search, Spotlight and device search.

5. What leaves your phone

From the app to us: anonymous usage counts and crash reports (§5.6), and, only if you invite friends or join a friend's invite, a random invite code and its joins (§5.7). There is no account system and no over-the-air update mechanism. The app never sends us your photos, the text read from them, your searches, file or album names, places, or anything about the Vault or Documents. Anything more reaches the developer only if you write to us yourself (§5.5).

These things do involve the network:

5.1 Purchases

Buying Pro goes through Apple's App Store or Google Play. Apple or Google handles payment and sends the app a receipt that confirms your entitlement. The app never sees your card details. Apple's and Google's privacy policies apply to the purchase.

5.2 Ads on the free plan

On the free plan the app shows three kinds of ad. A banner sits above the tab bar on the app's main screens, and at the foot of the screen that appears when a job finishes. An ad box on the Compress video working screen, for a free video only: a native ad on iPhone, or a 300 × 250 banner (on Android always, and on iPhone when no native ad is available). A rewarded ad, offered only in Compress video, Space saver and when moving photos into the Vault, after the free allowance (3 videos, 3 packs, 25 Vault items): you choose to watch it, and the extra video, pack or 10 Vault items is granted when you watch it to the end (closing a loaded ad early grants nothing). If no ad can be loaded within about 5 seconds, the use is granted without one, at most once a day for each of Compress video, Space saver and the Vault, so a missing ad never blocks the task. No ad is shown on the purchase screens, inside the Vault or Documents, over a photo, or during onboarding, and Pro shows none of them. Ads are served by the Google Mobile Ads SDK (AdMob). When an ad is requested, Google receives standard ad-request data: a device identifier (on iPhone, not the advertising identifier, which the app never asks to use), your approximate location inferred from your IP address, the ad's size and placement, basic device and app information, the ads shown and whether they were tapped, and performance and crash diagnostics about the SDK itself.

• Ads are requested in non-personalised mode, with a maximum content rating of G. The app does not ask for tracking permission and does not track you across other companies' apps or websites.
• In the EEA, the UK and Switzerland, the app shows Google's consent form (UMP) before the first ad request, as required. Where Google's messages apply — including US states with privacy laws — Settings → Ads → Ad preferences reopens your choices.
• Your photos and anything read from them are never part of an ad request.
• The ad SDK is loaded only on the free plan: when an ad is about to be requested, or when Settings checks whether "Ad preferences" must be offered. It is never loaded for Pro.
• To report an ad that looked wrong, use Settings → Ads → Report an ad, or the ad's own AdChoices mark.
• Buying Pro stops all ad requests.
• For the ad boxes on the Compress video working screen and the rewarded ad, the app counts, in its anonymous usage counts (§5.6), that an ad of a given kind (native, 300 × 250 banner or rewarded) was shown or tapped there, and nothing about the ad itself.

Google's collection is described in Google's privacy policy and how Google uses information from apps that use its services, and in the "Data safety" section and App Store privacy details for this app, which declare the SDK's data for every user because a single build serves both free and Pro users.

5.3 Google Play services and ML Kit (Android)

On Android, Google Play services and the bundled ML Kit text recognition library send their own diagnostics to Google: device and app information, per-install identifiers, how long recognition took and error codes — never the pictures or the text. This is part of the Android platform and is outside the app's control; the app's "Data safety" section declares it.

5.4 The complete list of who the app can talk to

• Google AdMob and Google's User Messaging Platform — on the free plan only (§5.2).
• Apple's App Store (iOS) or Google Play (Android) — for purchases, for restoring them, and for the occasional "rate this app" prompt, which the store draws itself.
• Apple's iCloud Photos (iOS only) — when you open, play or share a photo or video whose original is kept in iCloud rather than on the phone, or save an edited copy of such a photo, iOS downloads it for the app; for screenshots, while "Download originals from iCloud" is on (off unless you turn it on); and, while the phone is charging, for a photo that, from the small copy iOS keeps on the phone, looks like a document, such as an ID card or a letter, so its text can be read: at most 30 a day, while photo access is granted (this version has no separate switch for it; revoking photo access in System Settings stops it). This brings your own photos down; the app uploads none of it.
• Google Play services and ML Kit (Android only, §5.3) — platform diagnostics we do not control.
• Google Firebase (Google Analytics for Firebase and Firebase Crashlytics) — anonymous usage counts and crash reports, on both plans, unless Share anonymous usage is off (§5.6).
• Our invite service (Firebase Authentication and Cloud Functions, run by Google for us) — only once you open Invite friends or tap Join on a friend's invite (§5.7).

The app checks a public file on our own site to learn whether our store listing is live; the request carries nothing about you or your photos.

The app itself makes no other network request. The invite service is the one server of ours.

5.5 What you send yourself

Some things leave your phone because you send them: a photo, a PDF or a pack you share or save through the share sheet, a pack the app saves to a folder you chose (§4.2), an "Export my data" archive, the Diagnostics log (Settings → About → Diagnostics → Share), an email from Contact or Report an ad, and a calendar event from "Add to Calendar" (your calendar app may sync it). They go only where you send them. If you email us, we receive your address, your message and anything you attach, use them only to reply, and delete them when you ask.

5.6 Usage counts and crash reports (Google Firebase)

To find crashes and to learn which parts of the app are used, the app uses two Google services, Google Analytics for Firebase and Firebase Crashlytics, which process this data for the developer.

• Usage counts. Which screen is open, by the screen's name only (for example "photo", never which photo); that a tool was started or finished and which tool; which clean-up, pack or done screen was completed or shown; that an ad box on the Compress video working screen was shown or tapped, and its kind (native, 300 × 250 banner or rewarded); which action a multi-selection was used for; where the Pro screen was opened from and which plan was bought; that an invite link was shared, that three friends joined your invite, or that this phone joined a friend's invite; that a rewarded ad did not load, or that a use was granted without one; and that onboarding finished. Each is a word from a fixed list written into the app; anything else the app hands over is dropped before it leaves. Google's SDK adds the events it records in any app — the app's first open, updates and sessions, and a purchase with its price — and, on the free plan, the ad SDK's own record of each ad asked for, shown or tapped. With them go a random identifier for this installation, the app's version, the phone model and operating system, and the approximate location Google works out from the IP address.
• Crash reports. When the app crashes: where in the code it happened and the type of error, the app's state at that moment, and the phone model and operating system. For an error in the app's JavaScript, the message is left out unless it is the language's own wording, because a message can carry anything; a crash in the phone's native code keeps the system's own description of the error. The app adds no custom keys, logs or user ID.
• The app never sends: your photos or videos; anything read from them — text, titles, merchants, amounts; file names, album names or places; anything you type or search for; whether you use the Vault, Documents or Personal, and how much they hold.
• Not used for advertising and not tracking. No advertising identifier: on iPhone the app never reads it and the identifier for vendors is not collected; on Android the advertising ID and the Android ID are not collected. No user ID, no account, and Analytics' advertising signals are off.
• Your choice. Settings → Photos & privacy → Share anonymous usage (on unless you turn it off) stops both at once and discards crash reports not yet sent. In the EEA and the UK, usage counts are sent only once you have agreed, in the consent form the free plan shows, to information being stored on your device and to content being measured; until a phone has answered, they wait. Crash reports follow the switch alone.
• How long. Google keeps usage counts for the retention period the developer sets in Google Analytics (2 months) and crash reports for 90 days. Privacy and security in Firebase describes Google's side.

5.7 Invites (only if you use them)

Invite three friends and, when they install Rollshelf and join, you get a year of Pro. Sharing your link earns nothing by itself, and nothing in the app is locked behind inviting. It runs on a small service of ours on Google Firebase (Firebase Authentication and Cloud Functions, in the United States). Nothing is sent until you open Invite friends, or tap Join on a friend's invite.

• What it keeps. A pseudonymous identifier made for this installation — a random ID with no name, no email and no account behind it, which the invite records are kept against; your random invite code; for each friend who joins, their own pseudonymous identifier, the time, and whether the phone is an iPhone or an Android phone; and, once three have joined, when your year of Pro ends. On an iPhone, once three have joined, we also keep the App Store offer code we gave you for that year, against the same identifier; a code we have not given to anyone holds no personal data, and once you delete your invite data it no longer says whom it was given to. So that invites count for new installations only, a join also sends when the app was first opened on that phone; it is checked and not kept.
• What it never receives: your photos or anything read from them, your contacts, your name, or who you sent the link to. Sharing the link happens in your phone's own share sheet; the app is not told where it went.
• The link is dinosdev.com/i/ and your code. The page it opens reads the code from the address in your browser and sends it nowhere.
• On your phone. The identifier, your code and whether you joined a friend's invite are kept in the app's own storage. "Delete all app data" removes them (an Android year already earned stays until it ends; an iPhone year you have redeemed is an App Store subscription on your Apple ID and is not touched); deleting the app removes everything. On an Android phone a year of Pro from invites belongs to that phone: a reinstall, or a new phone without a restore of its backup, loses it. On an iPhone the year is redeemed through Apple's own redemption sheet and is then an App Store subscription on your Apple ID, which Apple restores; a code you have not redeemed is lost with a reinstall.
• How long, and deleting it. There is no automatic expiry and no clean-up job: these records are kept while the invite programme runs, or until you delete them. On Android the end date of a year already earned is part of your code's record, so it is deleted with it (on your phone the year stays until it ends). Delete it here: Settings → About → Delete invite data removes at once your code and its joins, your own join, and the pseudonymous identifier. What your friends' phones did stays theirs: a friend keeps a year your join helped earn, and their own record of having joined. An Android year of Pro you already earned stays on your phone until it ends; an iPhone year you have redeemed is an App Store subscription on your Apple ID and is not affected. On an iPhone, a code you have not redeemed is deleted with your invite data, so redeem your free year first. Or write to us with your code and we delete them; because nothing carries your name, we cannot find your records without it. Like any web request, Google's servers see your phone's network address; our service does not store it, and Google's request logs keep it for up to 30 days.

6. Notifications and calendar

All notifications are created and delivered on your phone: reminders you set, deadline reminders (never for a bill in this version), and the monthly Space saver reminder if you use it. The app never uses a push service. If you tap "Add to Calendar", the app asks for permission to add an event and writes only that event; it does not read your calendar.

7. Children

The app is not directed at children under 13 and is not intended for them. We do not knowingly collect data from children; the app asks no one for a name, an email or an account, its usage counts and crash reports carry no identity (§5.6), and its ads are limited to content rated G.

8. Your controls

Apart from the anonymous usage counts and crash reports of §5.6, and invites if you use them (§5.7 — Settings → About → Delete invite data deletes them, or write to us with your code), the app keeps no data off your phone, so there is nothing else for us to access, correct or delete on your behalf; the controls above do all of it locally. Usage counts and crash reports carry no name or account, so we cannot pick yours out to show or delete it: Share anonymous usage stops them, and Google deletes them after the periods in §5.6.

9. How long things are kept, and who else is involved

Everything the app stores is kept on your phone (and in your phone's own backup, where you use one) until you delete it with the controls above or delete the app. The developer keeps nothing but the anonymous usage counts and crash reports Google holds for it (§5.6), invites if you use them (§5.7), and an email you choose to send (§5.5).

The only third parties that receive data from the app are Google, as the ad provider on the free plan and as the processor of usage counts and crash reports (Firebase), and Apple or Google, for purchases. We work only with providers whose own terms and privacy policies commit them to protecting that data at least as well as this policy does. You can ask Google about the data its SDK received through Google's privacy controls.

10. Legal basis and your rights

Where data protection law applies (for example the GDPR in the EEA and UK, US state privacy laws, or India's Digital Personal Data Protection Act), the app's own processing of your photos happens on your device and is under your control. The developer processes two kinds of data about your use of the app, both with Google Firebase as its processor: the pseudonymous usage counts and crash reports of §5.6, and, if you take part, the invites of §5.7, whose legal basis is running the invite programme you chose to use. In the EEA and the UK the legal basis for usage counts is your consent, given in the consent form, and for crash reports the developer's legitimate interest in keeping the app from crashing; Settings → Photos & privacy → Share anonymous usage withdraws or objects to both at any time. The ad SDK's processing on the free plan is carried out by Google under Google's privacy policy; the legal basis for it in the EEA and UK is your consent, given through the consent form, or Google's legitimate interest for non-personalised ads where allowed. You can withdraw consent or opt out from Settings → Photos & privacy → Ad preferences, or by buying Pro.

11. Changes to this policy

If this policy changes, the new version is published at this address with a new effective date and a line in the change log below. The app never changes what leaves your phone without a store release and a note here.

12. Contact

dinosdev1986@gmail.com · dinosdev.com/rollshelf/support

Based in: Chandigarh, India

Change log