Privacy Policy

Last updated: March 23, 2026 · Effective: March 23, 2026

ScreenVault ("we", "our", "us") respects your privacy. This policy explains what data we collect, how we use it, and your rights under GDPR and other privacy laws.

1. Data We Collect

Data Type	What	Purpose	Retention
Account	Apple ID identifier (anonymized), email (optional)	Authentication, account management	Until account deletion
Screenshots	Images you upload for classification	AI classification processing	See Section 3
Classifications	Category labels, confidence scores, AI descriptions, OCR text	Core app functionality, search	Until account deletion
Usage Data	Classification count, chat query count	Subscription limit enforcement	Reset monthly (paid) or lifetime (free)
Subscription	Subscription tier, status, Apple transaction ID	Access control, billing	Until account deletion

2. How We Process Your Images

• Images are uploaded over TLS 1.3 encrypted connections.
• Images are stored with AES-256 server-side encryption (MinIO SSE).
• Images are processed by the Anthropic Claude AI API to generate classification labels, descriptions, and extracted text.
• The AI processes each image independently (stateless, single-turn) with no conversation history.
• EXIF metadata is stripped from images before AI processing. Only structured fields (GPS coordinates, timestamp, device model) are extracted separately.

3. Image Retention & Data Improvement

• Opt-out users: Images are deleted from our servers immediately after classification is complete (typically within 60 seconds).
• Opt-in users (default): Images are retained in encrypted storage and may be used for model improvement. Images are disassociated from user accounts before any training use.
• Classification metadata (labels, descriptions, text) is retained regardless of image retention preference for core app functionality.

4. Legal Basis (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): Processing images for classification — this is the core service you signed up for.
• Legitimate interest (Art. 6(1)(f)): Anonymized data for service improvement, with opt-out available.
• Consent (Art. 6(1)(a)): Optional features like push notifications.

5. Sub-Processors

Processor	Purpose	Location	Privacy Policy
Anthropic (Claude AI)	Image classification via API	USA	Link
Hetzner Online GmbH	Server hosting	Finland, EU	Link
Apple Inc.	Authentication (Sign In with Apple), payments	USA	Link
Let's Encrypt (ISRG)	TLS certificates	USA	Link

Note on Anthropic: Under Anthropic's API terms, inputs sent through the API are not used for model training. Anthropic may retain API inputs for up to 30 days for trust and safety purposes.

6. International Data Transfers

Our servers are located in the EU (Hetzner, Finland). Image classification requests are sent to Anthropic's API in the USA. This transfer is covered by Anthropic's Standard Contractual Clauses (SCCs) and their commitment to data protection equivalent to GDPR standards.

7. Your Rights

Under GDPR, you have the right to:

• Access your data — Settings → Data → Export My Data (JSON format)
• Delete your data — Settings → Data → Delete All Data
• Rectify incorrect data — reclassify screenshots or contact us
• Restrict processing — opt out of data improvement
• Port your data — export as JSON
• Object to processing — opt out or delete account
• Withdraw consent at any time without affecting prior processing

To exercise any right, use the in-app settings or email privacy@screenvault.pics. We respond within 30 days.

8. Cookies

The ScreenVault website does not use cookies or tracking technologies. The admin dashboard uses a session cookie for authentication only (strictly necessary, no consent required).

9. Children

ScreenVault is not intended for children under 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us data, contact us for deletion.

10. Data Security

• TLS 1.3 for all data in transit
• AES-256 server-side encryption for stored images
• SSH key-only server access (no password authentication)
• Firewall (UFW) restricting access to necessary ports only
• fail2ban intrusion prevention
• Automatic security updates (unattended-upgrades)
• Database credentials and API keys stored outside web-accessible paths

11. Data Breach Notification

In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR Art. 33-34.

12. Changes to This Policy

We may update this policy. Material changes will be communicated through the app and/or email. Continued use after changes constitutes acceptance.

13. Contact

Data Controller: ScreenVault
Email: privacy@screenvault.pics
Data Protection: privacy@screenvault.pics

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.