Privacy Policy

Effective 3 September 2026 · Last updated 3 September 2026

1. What this policy covers

This policy covers the Undupe iPhone app and this website at undupe.products.ripeseed.io.

It does not cover the Apple App Store, which has its own privacy policy and is where your purchase actually happens; nor Google, whose handling of the diagnostics described in section 5 is governed by Firebase's own terms; nor anything you do with a photo after you have taken it out of the app yourself.

2. Who we are

Undupe is made by RipeSeed LLC, a limited liability company formed in the State of Delaware, United States. For the purposes of the UK and EU GDPR, RipeSeed LLC is the data controller for the small amount of personal data described below.

You can reach us at support@ripeseed.io, which is a monitored mailbox and the fastest route to a person. We will provide a postal address on request. We have not appointed a data protection officer, because the scale and nature of what we process does not require one.

3. What stays on your phone

Almost everything. The comparison that makes Undupe work is arithmetic done on your own device, and the results of it live in the app's sandbox, where only Undupe can read them.

• Your photographs. Undupe reads them through the iOS Photos framework in order to compare them. It does not copy them, move them, or write them anywhere of its own. They stay exactly where they are, in your library.
• The analysis cache. A single database file inside the app's own container (Application Support/dupekit/descriptors.sqlite). It holds compact numerical descriptors — the fingerprints Undupe compares — and the identifiers iOS uses for the photos they came from. It exists so that a second scan does not have to redo the first one's work. It contains no images. You can see how large it is and delete it outright from Settings → Clear cache inside the app.
• Your settings and counters. A handful of values in the app's own preferences: whether you have seen the introduction, your chosen sensitivity, the thumbnail detail level, and the date and running total behind the free daily deletion allowance. That is the whole list.

None of this is sent to us and none of it is readable by another app. If you delete Undupe, iOS deletes the lot with it. Note that if you have iCloud Backup or an encrypted device backup turned on, that backup may include the app's container — that arrangement is between you and Apple, and we have no access to it.

4. What leaves your phone

Exactly two things do, and here they both are.

Neither of them contains a photograph. No image, no thumbnail, no crop, no compressed copy, no file name, no album name, no caption, no date a photo was taken, no location a photo was taken, and no fingerprint or descriptor computed from one. Nothing that could be used to reconstruct, identify or count any specific picture in your library ever leaves the device. That is a property of what the app sends, not a promise about what we do with it afterwards.

5. Analytics and diagnostics, in detail

Undupe uses three Google Firebase products. They are the only third-party SDKs in the app.

Google Analytics for Firebase

Tells us how the app is actually used — which screens people reach, whether a scan completed or was abandoned, how often someone runs into the free daily deletion limit, and whether the paywall is understood. That last one matters more than it sounds: the free allowance is set at sixty photos a day, and the only way we can tell whether sixty is a fair number is by seeing how often people hit it.

Firebase Crashlytics

Reports crashes. When Undupe stops unexpectedly it sends the stack trace, the state of the app's threads and memory at that moment, and a short trail of the app's own log messages leading up to it.

Firebase Performance Monitoring

Measures how long things take — app start, screen rendering, and the duration of the app's own network calls to Google. On a phone that has to compare tens of thousands of photos, "it got slower" is a bug we would otherwise only hear about anecdotally.

What all three send

Between them, the following leaves the device:

• Identifiers that are not you. A Firebase app instance ID and a Crashlytics installation UUID. These are random values generated on your device for this installation of this app. They are not your Apple ID, not your email address, not your phone number and not the iOS advertising identifier. Deleting and reinstalling the app produces new ones.
• Technical properties of the device: model, iOS version, language, region, the app version and build, screen dimensions, and available memory and storage class.
• Events: automatic ones the SDK records without being asked (first open, app opened, app in the background, session start, app update, crash-free session), and our own — a scan started, a scan finished and roughly how many groups it produced, a group opened, a keeper overridden, a deletion confirmed and roughly how many photos it covered, the free daily allowance being reached, the paywall opened, a purchase completed or restored, the cache cleared.
• Counts and durations, never contents. Where an event carries a number — "the scan produced 214 groups", "the deletion covered 60 photos" — that number is the whole payload. There is no accompanying list, no identifiers for the photos involved and no way to work backwards from it to a picture.
• An approximate location derived from your IP address, at roughly the level of a country or region, worked out by Google. Firebase does not store the full IP address for Analytics. This is not the location a photo was taken at — the app never reads that, and never sends it.
• Crash detail, as described above.

What analytics never contains, in the app's own nouns: a photo, a thumbnail, a burst, a screenshot, a group, a keeper, a file name, an album name, a photo's capture date, a photo's capture location, a descriptor or perceptual hash, or the iOS local identifier of any photo. The events above describe the app, not your library.

Legal basis. Where the UK or EU GDPR applies, we rely on our legitimate interest (Article 6(1)(f)) in keeping the app working and in understanding how it is used. We have weighed that against your interests and consider it proportionate, because the data is not linked to a person, contains nothing about your photographs, and is the only practical way for a small team to find bugs it cannot reproduce. You can object at any time by writing to support@ripeseed.io, and we will honour it.

6. Purchases

Every payment is handled by Apple through the App Store. Undupe uses Apple's own StoreKit framework and no third-party purchase or subscription SDK, which means the app never sees and never receives your card number, your billing address, or your Apple ID.

What the app receives back from Apple is a signed transaction saying that a particular product was purchased and, for the yearly subscription, whether it is still active. We use that solely to decide whether to apply the free daily deletion limit. What Apple collects to process the payment is covered by Apple's privacy policy, not this one.

7. Permissions

That is the only permission Undupe asks for, and iOS lets you grant it for your whole library or only for photos you select. If you choose a limited selection, Undupe can only ever see what you picked.

Undupe never asks for your location, your contacts, your calendar, your microphone, your camera, your health data, Bluetooth, your local network, or permission to track you across other companies' apps. There is no App Tracking Transparency prompt in Undupe because there is nothing in it that would need one.

8. Notifications

Undupe sends no push notifications, and this is structural rather than a matter of policy: the push notification entitlement is not present in the app at all, so no push token is ever generated for it and there is no channel through which we could send you one even if we decided to.

9. What we never collect

• No advertising. There are no ads in Undupe, no ad SDK, and we never read the iOS advertising identifier (IDFA).
• No tracking across apps or websites. Nothing in Undupe is shared with a third party for advertising or measurement about you elsewhere.
• No sale or sharing of personal information, as those terms are defined by the California Consumer Privacy Act. We have never done this and we do not intend to.
• No data brokers. We do not buy, sell, rent or enrich data about you.
• No accounts. There is no sign-up, no password, no profile and no email list.
• No precise location. Not from the device, and not from the metadata attached to your photographs.
• No session replay or screen recording. Nothing in the app captures what your screen looked like.
• No contacts, messages, files or other apps' data.

10. Things that do not exist yet

A privacy policy that describes only today is one that has to be rewritten the moment anything ships. So, plainly:

• There is no cloud sync, and no backup of your library to us. If we ever build something like that it will be a feature you deliberately switch on, and this policy will be updated before it ships, not afterwards.
• There are no accounts. Same commitment: if that ever changes, you will be told in the app before it does.
• The diagnostics in section 5 may not be in your build yet. They are described above as though they are, because that is safer than describing them later.

What will not change: your photographs are not ours to upload, and we are not going to start.

11. How long anything is kept

• On your phone: for as long as you keep the app. The analysis cache is clearable at any moment from Settings, and deleting the app removes everything.
• Analytics: Google retains the event and device data for 14 months, after which it is deleted automatically. Aggregate counts that identify nobody may be kept longer.
• Crash and performance reports: 90 days, which is Firebase's retention period for both.
• Support email: we keep correspondence for up to 24 months so we can follow up on a recurring problem, then delete it. Ask us to delete a thread sooner and we will.

12. Children

Undupe is not directed at children under 13, or under the age of digital consent in your country where that age is higher. We do not knowingly collect personal data from a child. The app has no account, no profile, no messaging and no content anyone else can see, which means there is very little for it to collect from anyone. If you believe a child has provided us with personal data, write to support@ripeseed.io and we will delete what we have.

13. Your rights

Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable form, and to complain to your data protection authority — in the UK, the Information Commissioner's Office; in the EU, your national supervisory authority. Exercise any of them by writing to support@ripeseed.io. We will not charge you and we will not treat you differently for asking.

Two honest limits are worth stating rather than burying:

• Most of "your data" is already in your hands. Your photos are in your own library, and the app's cache and settings are on your device where you can inspect and delete them. There is no copy on our side to send you.
• We usually cannot find you in the analytics. The diagnostics in section 5 are keyed to a random per-installation identifier that we cannot connect to a name, an email address or a device. Where that is genuinely so, the GDPR does not require us to collect more data about you purely to make you identifiable, and we are not going to. If you can give us the app instance ID from your installation we will do what we can with it; otherwise, objecting under section 5 stops future collection.

14. California

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to have it deleted, to have it corrected, to opt out of its sale or sharing, and not to be discriminated against for exercising any of those rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising. There is no opt-out link on this site because there is nothing to opt out of.

In the last 12 months the only categories we have collected are identifiers (the random per-installation IDs in section 5), internet or other electronic network activity (the app events and crash reports in section 5), geolocation data only at the coarse country-or-region level derived from an IP address, and commercial information in the sense that Apple tells the app which product you bought. We collect no sensitive personal information as the CPRA defines it.

15. International transfers

RipeSeed LLC is in the United States, and Google processes Firebase data on servers in the United States and elsewhere. If you are in the UK, the EEA or Switzerland, that means your diagnostics data is transferred outside your country.

Those transfers rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, which Google incorporates into the Firebase Data Processing and Security Terms we are bound by. Apple's handling of your payment is covered by Apple's own arrangements.

16. Security

The app's data sits inside the iOS application sandbox, which stops other apps reading it, and is covered by the device encryption iOS applies when your iPhone is locked. The single most useful thing you can do to protect it is to set a passcode, since device encryption depends on one.

Diagnostics travel to Google over TLS. We are a small team and we do not pretend to perfection: no service is impossible to breach, and anyone who says otherwise is selling something. What we can say is that the material most worth protecting — your photographs — is never in our custody in the first place, which is a stronger protection than any promise about how well we would guard it.

17. This website

This site is four static pages on Amazon CloudFront. It sets no cookies, runs no analytics, loads no fonts, scripts, images or styles from anyone else, and has no forms — which is why you were not asked to accept anything when you arrived. There is nothing here to opt out of.

Amazon Web Services necessarily handles the request that delivered this page, as any host would. We have access logging switched off on the distribution, so there is no record of your visit for us to read, keep or be asked for.

18. Changes to this policy

The dates at the top of this page are the authoritative record of when it last changed. If we make a material change — a new recipient of data, a new category collected, a new purpose — we will say so inside the app and not only here, and we will do it before the change takes effect rather than after. Changes are never applied retrospectively to data already collected.

19. Contact

Questions, objections, or a request to exercise any right in section 13: support@ripeseed.io.

RipeSeed LLC · Delaware, United States. A postal address is available on request.