Privacy in Flashbackz

There are two entirely separate data stories in this app. Your photographs, which are read on the device, analysed on the device, and never leave it. And advertising, which talks to Google's servers and knows nothing whatsoever about your photographs.

1. Your photographs

What is read

Flashbackz asks for read access to the photo library. With it, the app reads creation dates and moment metadata, image pixels in memory to run Apple's on-device Vision framework, EXIF fields for a targeted subset of assets (camera make and model, and coordinates where present), the favourite flag, and Apple's media subtypes. The app cannot write to your library.

Where it goes

Nowhere. There is no network code anywhere in the photo pipeline. The app has no account system, no backend, no telemetry endpoint, no crash reporter and no analytics SDK. All classification runs through Apple's Vision framework, on the device, offline — no cloud vision API and no model download.

What is stored, and where

Two files, both inside the app's own sandboxed document directory, both deleted when you delete the app: a semantic cache of Vision labels, image statistics and metadata keyed by asset id, and a progress file holding your best streak, games played and recent run ids. Neither file ever contains image data — image caching is set to memory only, never disk, specifically so that no copy of a photograph is written into the app container.

iCloud

A photo that lives only in iCloud is fetched on demand through Apple's own Photos framework, for an image you already own, so that it can be analysed locally. That request goes from your device to your own iCloud account. Nothing is uploaded, and nothing is sent to us — there is no "us" to send it to.

Location

Coordinates are read from EXIF where an asset has them, and are used for exactly one thing: inferring which grid cell you were in most often in a given year, so that photographs taken away from it can be ranked slightly higher. That computation is local and produces a number. There is no reverse geocoding and no place-name lookup, and the app does not use Core Location or ask for location permission.

2. Advertising

The provider

Flashbackz shows a full-screen advertisement occasionally — after a completed run, never during one, never on the first four runs of a new install, and then roughly one run in five. The provider is Google AdMob. One advertising SDK, and no mediation partners. Google's own privacy disclosures apply to the ad request itself.

Non-personalised, and why

Every ad request sets non-personalised ads only. Flashbackz does not present the App Tracking Transparency prompt and does not link the tracking-transparency library, so the advertising identifier is not available to it: personalised advertising is not merely declined, it is unavailable. Non-personalised inventory earns less, and that is accepted deliberately — a prompt asking to track someone in an app whose entire proposition is that their photographs never leave the phone is a worse trade.

Regional consent (GDPR and similar) is handled by Google's User Messaging Platform, which is asked on launch whether a form is required and shows one only where it is. If consent cannot be resolved for any reason, the app requests no advertising at all — the failure direction is always fewer ads, never ads anyway. Maximum ad content rating is set to G.

What the advertising SDK is told about you

Nothing that Flashbackz knows. The SDK receives what Google's SDK collects for itself on any iOS device — device and OS characteristics, coarse network information, an IP address, and the install-attribution signal Apple mediates. Flashbackz passes it no parameters of its own.

The boundary, stated precisely

No photograph, and nothing derived from a photograph, reaches the advertising subsystem. Not photo library contents, thumbnails, asset identifiers, filenames, EXIF, GPS coordinates, Vision classifications, memory scores, face counts, event clusters, the identity of any photograph shown in a round, the streak, the answer given, or how a run ended.

This is enforced structurally rather than by convention. The advertising code imports nothing from the photo, memory, game or storage code and imports no media or Vision module; every exported advertising function takes zero arguments, so there is no parameter through which photo data could travel, correctly or by accident; and the pacing decision is computed from two integers. A release verification script asserts all three by reading the source as text, and widening any of them fails the build.

3. What Flashbackz does not do

No accounts. No backend. No cloud AI or external inference API. No analytics or crash-reporting SDK. No tracking. No advertising identifier. No sharing, social features or push notifications. No reverse geocoding. No photo uploads, and no photo copies persisted anywhere. No data collected from children.

4. Data deletion

Deleting the app removes the sandbox, and with it the semantic cache and the progress file. There is nothing held anywhere else, because nothing was ever sent anywhere else. Settings → Reset game stats clears streak history without removing the cache.

Contact

Email contact@webbifystudio.com.