PicDiary Your personal photo journal

Privacy Policy

Effective date:

Introduction

This Privacy Policy explains which personal data (referred to below simply as “data”) I process when you use PicDiary, and for what purpose. It’s meant to give you a clear overview of what happens with your data — and what doesn’t.

Controller

The controller responsible for data processing within the meaning of the GDPR is:

Benedikt Kehl-Waas
Email: benedikt@picdiary.app

My full contact details, including a postal address, can be found in the Imprint.

A data protection officer is not legally required and has therefore not been appointed.

My Promise

A diary is something deeply personal. That’s exactly why protecting your data is my top priority. In concrete terms:

  • Privacy comes first — especially with content this personal and sensitive.
  • Your content (photos, text, voice recordings, and so on) stays on your device only, at first. You’re the only one with access to it.
  • Only once you create a PicDiary account yourself does PicDiary store your data on Google servers in the EU for backup and synchronization. Your data is never sold, never used for advertising, and never shared with third parties for advertising purposes. There is no advertising tracking and no profiling beyond the app. Your data leaves your device only through a deliberate action on your part, and is shared only for the relevant feature with the service providers working on PicDiary’s behalf (see “Third-Party Services”).
  • If you delete your account, all associated data is deleted from the server.
  • If you delete the app, all your data is deleted from your device.

Overview of Processing

The overview below shows you at a glance which data I process, for which purposes, and whom it concerns.

What data I process

  • Contact data (e.g. your email address when you create an account or write to me).
  • Content data (e.g. photos, text, voice recordings).
  • Usage data (e.g. features used, interaction with content, access times).
  • Meta and communication data (e.g. technical information about app usage).

Whose data I process

  • Users of the app.
  • People who get in touch with me.

Why I process data

  • To provide the app and its features to you and to support you.
  • To answer contact requests and communicate with you.
  • To ensure the security of the app and your data.
  • To understand how the app is used and improve it accordingly.
  • To gather feedback.
  • To operate and maintain my technical infrastructure.

I base the processing of your data on the following legal bases under the GDPR:

  • Consent (Art. 6(1)(a) GDPR): You have consented to the processing for a specific purpose.
  • Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR): Processing is necessary to provide the app to you or to handle a request from you.
  • Legitimate interests (Art. 6(1)(f) GDPR): Processing serves my legitimate interests or those of a third party — such as the secure and stable operation of the app — provided your interests and fundamental rights do not override them.

For special categories of personal data (see the next section), I additionally base the processing on your explicit consent under Art. 9(2)(a) GDPR.

In addition to the GDPR, national data protection rules in Austria apply, in particular the Data Protection Act (Datenschutzgesetz, DSG). Among other things, it governs your rights to access, rectification, and erasure, as well as the transfer of data to third countries.

Special Categories of Personal Data

A diary can contain particularly sensitive data within the meaning of Art. 9 GDPR — for example information about your health, your religious or philosophical beliefs, your political opinions, or your sexual orientation. What you record in PicDiary is entirely up to you, and your content stays on your device only, at first.

Such data leaves your device only through a deliberate action on your part, and that action is your explicit consent under Art. 9(2)(a) GDPR:

  • Creating an account: This is your active decision to transfer your content to the servers for backup and synchronization. During registration, you confirm this processing via a dedicated checkbox that links to this Privacy Policy; this is how you give your explicit consent.
  • Requesting a transcription: This sends a single voice note to a service provider to be converted into text. The first time, I obtain your consent directly in the app before anything is sent.

You can withdraw your consent at any time, for example by deleting the content in question or your account.

Encryption and Access to Your Account Content

If you use an account, it’s important to me that you understand the actual scope of protection:

  • The transmission of your data to the servers is encrypted (TLS).
  • At Google, the stored data is encrypted at rest.

This encryption protects your data during transmission and while it is stored. However, this does not mean that your content is technically unreadable to me: As the data controller, I generally have access to the content stored in your account. I strictly limit this access to what is necessary, do not analyze your content, and only access it when it is absolutely necessary for operation, troubleshooting, or processing a request from you. In practice, however, such access has never been necessary so far.

End-to-end encryption, which would completely prevent me from accessing your data, is not currently in place. So far, I have decided against it due to the complexity involved and the associated risk of data loss (for example, if a user’s private key were to be lost). This is also standard practice for similar apps. If you would like this feature in the future, please feel free to let me know via feedback. Of course, if you don’t create an account in the first place, the data will remain stored exclusively on your device, as described above.

Security Measures

I take technical and organizational measures to protect your data. Local content stays on your device. Synchronized data is transmitted in encrypted form and stored encrypted at rest on the server side. I limit access to the servers to what is necessary and secure it; technically, I am the only person authorized to access them, in my capacity as the controller. On top of this come safeguards for the integrity and availability of your data, as well as privacy-friendly default settings.

Sharing of Data and Processing on My Behalf

I share data only where this is legally permitted or contractually necessary.

The service providers named in this policy process data predominantly as processors on my behalf and according to my instructions. Data processing agreements under Art. 28 GDPR are in place with them. These providers receive only the data they need for their respective task and are not allowed to disclose it or use it for their own purposes.

Where data is processed in third countries, I comply with the requirements of the GDPR (see “International Data Transfers”).

In-App Purchases

For in-app purchases, PicDiary processes only the data needed for them — essentially a pseudonymous user ID along with your purchase and subscription history. The payment itself is handled by Apple or Google. I don’t receive your payment details (more on this under “Purchases and Subscriptions”).

Data Retention and Deletion

I store your data only for as long as it’s needed for the purposes described here or required by law:

  • Account data (diary content in Google Firestore and Google Storage): kept until you delete the respective entry or your account. After account deletion, the associated data is removed within 7 days.
  • Crash data (Google Crashlytics): automatically deleted by Google after 90 days.
  • Analytics data (Matomo): automatically deleted after 180 days.
  • Voice note transcription (Deepgram, Mistral): audio or text is processed solely to carry out the transcription you requested and is not stored beyond that. The result (the text) becomes part of your entry and is therefore subject to the retention period for account data.
  • Feedback (EmailJS): I keep your feedback only for as long as needed to handle and respond to your request, and delete it afterwards, at the latest 12 months after the request has been concluded.

Data stored only locally on your device stays there until you delete the respective content or uninstall the app.

No Automated Decision-Making

There is no automated decision-making or profiling that produces legal effects concerning you (within the meaning of Art. 22 GDPR). Where content is processed automatically — such as the linguistic smoothing of a transcription — this serves the respective feature only and makes no decisions about you.

Children’s Privacy

PicDiary is not intended for children under the age of 14. I do not knowingly collect data from children under 14. Should I become aware of such a case, I will delete the data immediately. If you are a parent or guardian and believe that your child has provided me with data, please get in touch with me.

Where I base processing on your consent and a higher age limit for children applies in your country (in the EU this may be between 13 and 16 years depending on the country, Art. 8 GDPR), consent from a parent or guardian is required for users below that limit.

Your Rights

Under the GDPR, you have the following rights, among others:

  • The right to confirmation as to whether I process data about you.
  • The right of access to your data.
  • The right to rectification.
  • The right to erasure (“right to be forgotten”).
  • The right to restriction of processing.
  • The right to data portability.
  • The right to withdraw consent at any time — without affecting the lawfulness of processing carried out up to the withdrawal (Art. 7(3) GDPR).
  • The right to lodge a complaint with a supervisory authority.

To exercise these rights, contact me using the details given above. Before handling a request, I may verify your identity. You also have the right to lodge a complaint with the competent supervisory authority — in Austria, this is the Austrian Data Protection Authority (www.dsb.gv.at).

Right to Object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of your data that is based on legitimate interests (Art. 6(1)(f) GDPR) (Art. 21 GDPR). Where I rely on a legitimate interest, I will no longer process the affected data following your objection, unless I can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims.

Third-Party Services

For individual features I use external service providers — for example to operate the app, to provide it on my behalf, or to analyze how it’s used. These providers receive only the data they need for their respective task and are not allowed to disclose it or use it for their own purposes. Where they act as processors, data processing agreements under Art. 28 GDPR are in place with them. Below you’ll find them organized by function.

App Analytics

To understand how PicDiary is used, I use Matomo — an open-source analytics platform that I self-host on my own servers in Germany. All data is stored there securely and in compliance with the GDPR. No data is shared with third parties.

Matomo is run cookieless: no persistent identifier is stored on your device, and there is no cross-device or long-term re-identification. For analysis, Matomo only forms short-lived, non-persistent references on the server side; your IP address is anonymized in the process.

To support handling of support requests, I use a session identifier that is generated solely in your device’s memory, is created anew on each app start, and is not stored persistently on your device. It is attached as an attribute to the analytics events; if you send me feedback, it is included so that I can trace the course of that one session and help you more effectively. This does not allow personal re-identification across multiple sessions.

If the app transmits an error report to Matomo in the event of a fault, it is limited to the technical type of error (e.g. the exception type) and deliberately contains no content from your entries.

Legal basis: legitimate interest in improving and stabilizing the app (Art. 6(1)(f) GDPR); thanks to cookieless operation without device-side storage, no consent is required for this. Retention: automatically deleted after 180 days. More info: https://matomo.org/privacy-policy/

Crash Reports

To detect crashes and improve the stability of the app, I use Google Crashlytics. The service reports technical details about crashes that occur.

Legal basis: legitimate interest in a stable, error-free app (Art. 6(1)(f) GDPR). Retention: automatically deleted by Google after 90 days. Crashlytics processes technical device and diagnostic data and may process data outside the EU (see “International Data Transfers”); for transfers to the USA, Google LLC is certified under the EU-US Data Privacy Framework. For more on Google’s privacy practices, see “Google – Privacy & Terms”: https://policies.google.com/privacy

Account, Backup, and Synchronization

An account is optional. You can use PicDiary fully without an account — all features are available to you even then, with the sole exception of cross-device backup and synchronization. Registration and login are handled via Google Firebase Authentication, which processes your email address and login credentials in order to create and secure your account. Only once you create an account does PicDiary store your content in Google Firestore and Google Storage (servers in the EU), in order to back up your data and synchronize it across your devices. For the actual scope of encryption and access, see the section “Encryption and Access to Your Account Content”.

Legal basis: performance of the usage contract, i.e. providing backup and synchronization (Art. 6(1)(b) GDPR); insofar as special categories of data are involved, additionally your explicit consent (Art. 9(2)(a) GDPR). Retention: until you delete the respective entry or your account; after account deletion, removal within 7 days. For more on Google’s privacy practices, see “Google – Privacy & Terms”: https://policies.google.com/privacy

Voice Note Transcription

With PicDiary you can attach real audio recordings as voice notes to your entries. These recordings stay on your device only, at first. If you use an account, they are backed up and synchronized securely just like your other content (see “Account, Backup, and Synchronization”).

A voice note is sent to the transcription services named below only when you actively request a transcription for it — this never happens automatically. The transfer then runs via PicDiary’s own cloud functions, hosted in Germany. The first time, I explicitly point this out in the app and obtain your consent before anything is sent.

  • Transcription (Deepgram): The audio of the selected voice note goes to Deepgram, which converts your spoken words into text. This text is then inserted into your entry. I use Deepgram’s EU endpoint, so that processing takes place within the EU. More info: https://deepgram.com/data-security
  • Enhanced transcription (Deepgram + Mistral): Here, Deepgram first transcribes your audio as described above. The resulting text is then sent — together with the relevant existing entry — to Mistral AI, which smooths it linguistically, structures it clearly, and weaves it appropriately into your diary entry. Mistral is a French company and processes the data in the EU. More info: https://mistral.ai/terms/#privacy-policy

Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which you give by actively requesting the transcription and can withdraw at any time. Retention: Both services process your data solely to carry out the transcription or enhancement you requested, and do not store it beyond that (for Mistral, the “Zero Data Retention” option is enabled for this purpose; for Deepgram, the use of your data to improve the services or train models is disabled). The finished result becomes part of your entry.

Purchases and Subscriptions

To manage in-app purchases and subscriptions, I use RevenueCat. For this, the service processes data such as a pseudonymous app user ID, your purchase and subscription history, and device information, in order to verify, restore, and manage your purchases.

The payment itself runs exclusively through Apple (App Store) or Google (Google Play) and is subject to their own privacy policies. Your full payment details (such as your credit card number) are processed solely by Apple or Google — I don’t receive them.

Legal basis: performance of the purchase contract and management of your purchases (Art. 6(1)(b) GDPR). Retention: for as long as your purchase entitlement exists and statutory retention obligations require. Where RevenueCat processes data outside the EU, this is done on the basis of appropriate safeguards (see “International Data Transfers”). More info: https://www.revenuecat.com/privacy/ · https://www.apple.com/legal/privacy/ · https://policies.google.com/privacy

Feedback

When you send me feedback, I transmit it to myself via EmailJS. This lets me reliably receive and respond to your feedback.

Legal basis: legitimate interest in handling and responding to your request (Art. 6(1)(f) GDPR). Retention: only for as long as I need it to handle your request, at the latest 12 months after conclusion. For more on EmailJS’s privacy practices: https://www.emailjs.com/legal/privacy-policy/

International Data Transfers

I try to process your data within the EU as much as possible. Your diary content (account, backup, synchronization) is stored on EU servers, analytics via Matomo runs on my servers in Germany, and the transcription of your voice notes is processed within the EU as well.

For some technical services, however, processing outside the EU can’t be ruled out — in particular crash reports via Google Crashlytics, account sign-in via Google Firebase Authentication, purchase management via RevenueCat, and the transmission of your feedback via EmailJS. Where data is transferred to a third country (e.g. the USA), this is done on the basis of appropriate safeguards within the meaning of the GDPR, namely the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework. This keeps your data adequately protected even when it’s transferred to third countries.

Visiting This Website

This Privacy Policy primarily concerns the app. When you visit this website, my hosting provider automatically processes so-called server log files that your browser transmits, in order to deliver the site technically. These typically include the IP address, the date and time of access, the page requested, the amount of data transferred, and the browser and operating system type. This data is technically necessary to display the website, ensure its stability and security, and prevent misuse.

To improve the website, I additionally use Matomo — the same open-source analytics platform that I host myself on my own servers in Germany (matomo.picdiary.app) and also use for the app. This helps me understand which content (in particular which blog articles) resonates and whether the website serves its purpose. No data is shared with third parties.

Here too, Matomo runs cookieless: no persistent identifier is stored in your browser, and no cross-device or persistent recognition takes place; your IP address is anonymised. What is recorded is essentially the pages visited, time on page, the referring page, and your browser and device type; in addition, I track individual interactions, such as clicks on the app-store buttons and the language switch. Beyond that, the website works without any further cookies, without externally loaded fonts, and without third-party tracking services; a consent banner is therefore not required.

Legal basis: legitimate interest in improving and understanding the use of the website (Art. 6(1)(f) GDPR); because it runs cookieless without storing anything in your browser, no consent is required for this. Retention: automatic deletion after 180 days. More at: https://matomo.org/privacy-policy/

Hosting provider: netcup GmbH, data and server location Germany; the company processes the log files as a processor on my behalf. Legal basis: legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). Retention: the log files are deleted after 30 days at the latest, unless they are needed longer in an individual case to investigate a specific security incident.

Changes to This Privacy Policy

I may update this Privacy Policy to reflect changes in the law or developments in my services and data processing practices. I will inform you of any significant changes directly or via the app.

Contact

For questions or support requests, I need your email address so that I can reply to you. I use it solely to handle your request. If you have questions about this Privacy Policy, you can reach me by email at: benedikt@picdiary.app