AI Cleaner — Privacy Policy

1. Who we are

AI Cleaner: Phone Storage Max (also listed as CleanUpX AI: Storage Cleaner) ("the App") is published by Almavira Labs ("we", "us", "our"). Almavira Labs is a trading name of sole proprietor (FOP) Yevhenii Krysiuk, registered in Ukraine (Unified State Register record No. 22230000000028141). This Privacy Policy explains what data the App accesses on your iPhone, how it is processed, and your rights.

2. What data the App accesses

2.1 Photos and videos

The App requests permission to read your iOS Photo Library. All photo and video analysis (duplicate detection, similarity grouping, blur detection, best-shot selection) runs entirely on your device using Apple's Vision framework. Your photos and videos are never uploaded to our servers or any third party.

The App may store technical fingerprints derived from your photos (Apple Vision feature prints) in a local cache on your device to speed up repeated scans. This cache stays on your device and is removed when you uninstall the App.

2.2 Contacts (optional, when feature is enabled)

If you use the Contacts Cleanup feature, the App requests permission to access your iOS Contacts via Apple's CNContactStore framework. All contact analysis runs on your device. Contact data is never uploaded to our servers.

When you confirm a merge or deletion of duplicate contacts, the App modifies or deletes those entries in your iOS Contacts directly on your device. Unlike photos, deleted contacts cannot be recovered from a "Recently Deleted" folder — always review the list before confirming.

2.3 Device storage information

The App reads your device's storage statistics (used and available space, media library size) to show storage insights and give cleanup recommendations. These statistics stay on your device, except as aggregated values included in AI Assistant requests and analytics events described below.

2.4 AI Assistant queries

When you use the AI Assistant feature (available to Pro subscribers), the questions you type and your chat history are sent to our backend proxy and forwarded to our AI provider, Google Gemini (via Google Cloud) — the only AI service the App uses. The AI provider returns a response, which is displayed to you.

Starting with version 2.2.6, before the first question is sent the App asks your permission in a dialog that names Google Gemini, lists what is sent and has the buttons "Allow" and "Don't Allow". If you tap Don't Allow, the assistant answers with its built-in replies and nothing is sent to the AI provider. You can change your choice at any time in More → Settings → Privacy choices.

Along with your question, we include aggregated, non-identifying device context (device model, iOS version, app version, language, battery level and state, device heat, network type and speed, storage statistics, and counts of duplicates, blurry photos, large videos, etc.) so the AI can give context-aware suggestions. We do not send your photos, contact details, or any personally identifying information.

We do not store your AI queries or responses on our servers beyond the time required to process the request. Google processes queries on our behalf under the Google Cloud Data Processing Addendum, which requires protection of your data equal to or greater than described in this policy; it does not use them to train its models and may keep a request for a limited time only to detect and prevent abuse (see Section 4).

2.5 Subscription and purchase data

All purchases and subscriptions are processed by Apple via StoreKit. We do not see or store your payment details (such as your card number or billing address).

Our subscription management provider, Adapty, receives the transaction information Apple makes available for purchases in the App (for example the product, price, currency, store country, trial and renewal status, and transaction identifiers) so that we can verify your Pro entitlement and manage subscriptions. Adapty links this information to the random user identifier described in Section 2.6, and also receives the attribution information AppsFlyer reports for your install (for example the advertising source and campaign) and identifiers of our analytics and attribution tools (the Firebase app instance ID and the AppsFlyer ID), so that subscription reporting can be split by campaign.

Adapty forwards subscription events — trial starts, subscriptions, renewals and the related revenue — from its servers to our attribution partner AppsFlyer, where they are used and shared as described in Section 2.7.

2.6 Analytics and diagnostics

We use Firebase Analytics (Google) and PostHog to record usage events — such as which screens are viewed, onboarding progress, permission prompt results, when scans start and complete, cleanup actions (counts and megabytes freed, never content), paywall views, and purchase events. Events include technical context: device model, iOS version, app version, locale, session identifiers, and subscription tier. Events do not include your photos, contacts, or any content from them.

We also use other Firebase services (Google): Crashlytics receives crash and error reports (the stack trace, device model, iOS version, app version and an installation identifier) so we can fix problems; Remote Config delivers app settings and the variant of a screen you are shown, using an installation identifier; and Cloud Messaging delivers push notifications if you allow notifications, using a device push token. None of these receive your photos, contacts, or any content from them.

To connect events belonging to the same user, the App generates a random user identifier and stores it in the iOS Keychain. Because of how the Keychain works, this identifier may persist across app reinstalls, and if you use iCloud Keychain it may be synced to your other Apple devices, so the App on those devices uses the same identifier. It is not your Apple ID, name, email address, or phone number, and we cannot identify you personally from it. We use it with Firebase, PostHog, Adapty and AppsFlyer (as the AppsFlyer "customer user ID"). To request its deletion from our systems and providers, contact us (see Section 11).

To deliver notifications and keep subscription and notification state consistent, the App registers your installation with our backend. The registration contains a random installation identifier generated by the App, your device push token (if you allow notifications), your Adapty profile identifier, your tracking-permission and notification-permission status, your notification setting, your time-zone offset and the app version. When you receive or open a notification, the App also reports that event to our backend. We keep these records until you ask us to delete them; to request deletion, write to privacy@almaviralabs.com (see Section 6.2).

2.7 Tracking, attribution and advertising measurement

To understand how users discover the App and to measure the performance of our advertising, we use a mobile measurement partner, AppsFlyer. The AppsFlyer SDK in the App reports your install and app opens, and certain in-app purchase-flow events (such as starting, cancelling or failing a purchase, with the product and currency). Trial, subscription and renewal events, with their revenue, reach AppsFlyer from our subscription provider Adapty (see Section 2.5). AppsFlyer collects technical device data with these events, including your IP address, user agent, device model, iOS version, and the identifier for vendor (IDFV — an identifier Apple assigns to all apps of one developer on a device).

Sharing with advertising platforms. AppsFlyer sends ("postbacks") install and purchase events to the advertising platforms we work with, so that they can measure and optimise our ad campaigns. In particular:

• Meta (Facebook and Instagram ads). AppsFlyer sends Meta the events trial started, subscription, purchase, and subscription revenue measured through SKAdNetwork, together with the revenue amounts. The trial started, subscription and purchase events are sent for all installs — including installs not attributed to a Meta ad and organic installs (people who found the App without clicking an ad). We have enabled AppsFlyer's "advanced data sharing" with Meta, which means these postbacks include device-level identifiers and may include your IP address, the identifier for vendor (IDFV) and your user agent, for all devices, including devices whose advertising identifier (IDFA) is not available because tracking was not allowed. Meta uses this data under its own terms and privacy policy. We do not send Meta your name, email address, phone number or any content from your device.
• Google Ads. AppsFlyer reports installs and trial and subscription events to Google Ads for installs attributed to our Google Ads campaigns.

Your tracking permission (App Tracking Transparency). iOS asks for your permission before the App can access your device's advertising identifier (IDFA). If you allow tracking, AppsFlyer may also collect the IDFA and include it in the data described above. If you do not allow tracking, the App remains fully usable and the IDFA is not collected or shared; however, AppsFlyer still collects the other data described above (including the IDFV and IP address) and still shares it with Meta as described. Your tracking choice therefore controls the advertising identifier only, not the measurement sharing described in this section. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking.

SKAdNetwork. The App also supports Apple's SKAdNetwork, a privacy-preserving attribution framework. Apple sends aggregated install postbacks, which do not contain device identifiers, to the advertising network that showed the ad (for example, Meta) and a copy to AppsFlyer. AppsFlyer and Meta use a shared conversion value schema, and Meta shares its SKAdNetwork postback data with AppsFlyer for our aggregated reports.

Apple Search Ads. We also advertise the App through Apple Search Ads. When you install the App, AppsFlyer receives from Apple (through Apple's AdServices framework) the attribution of your install to an Apple Search Ads campaign, if there was one, so that we can measure those campaigns.

Earlier versions of the App (up to version 2.2.4) also included the Meta SDK, which reported installs and app opens to Meta together with technical device information; the advertising identifier was passed only if you allowed tracking.

2.8 Secret Space

The App includes an optional Secret Space — a PIN-protected local vault for photos and videos you choose to move there. Vault content is stored only on your device inside the App's private storage, protected with iOS file-level encryption; your PIN is stored in the iOS Keychain. We never see, upload, or back up your Secret Space content or PIN. If you forget the PIN or delete the App, the content cannot be recovered by us.

3. How we use that data

• To provide the App's features: photo analysis, contacts cleanup, video compression, AI assistance — all as described above.
• To improve the App: we use aggregated analytics to understand which features are used, where users encounter errors, and how to improve user experience.
• To measure and improve our marketing: attribute installs and purchases to advertising campaigns, and share install and purchase events with advertising platforms such as Meta so that they can measure and optimise our campaigns, as described in Section 2.7.
• To process subscriptions: verify Pro entitlement, enable Pro features.
• To send notifications you have allowed.
• To respond to your inquiries: if you contact us by email, we keep that correspondence to respond and improve our support.

We do not sell your data for money. We share data with advertising platforms only for the advertising measurement described in Section 2.7. As described there, this sharing includes technical device data (such as IP address, user agent and the identifier for vendor) and happens whether or not you allow tracking; the advertising identifier (IDFA) is shared only if you allow tracking.

Where the GDPR or UK GDPR applies, we process personal data on the following legal bases: performance of a contract (providing the App features you request and managing your subscription); consent (access to your device's advertising identifier, which iOS only allows after you agree in the App Tracking Transparency prompt, and optional iOS permissions such as Photos, Contacts and Notifications); and legitimate interests (analytics, security, fraud prevention, improving the App, and measuring the effectiveness of our advertising, including the sharing of install and purchase events with advertising platforms described in Section 2.7, balanced against your rights and freedoms). You have the right to object at any time to processing based on legitimate interests (see Section 8).

4. Third parties

The App relies on the following third-party services:

• Apple (App Store, StoreKit, SKAdNetwork, Apple Search Ads, Photo Library and Contacts frameworks) — governed by Apple's Privacy Policy.
• Adapty (subscription management and paywalls; forwards subscription events to AppsFlyer) — governed by Adapty's Privacy Policy.
• Google (Firebase Analytics, Crashlytics, Remote Config and Cloud Messaging) — governed by Google's Privacy Policy.
• PostHog (product analytics) — governed by PostHog's Privacy Policy.
• AppsFlyer (mobile measurement / install attribution; shares install and purchase events with advertising platforms as described in Section 2.7) — governed by AppsFlyer's Privacy Policy.
• Meta Platforms (receives install and purchase events from AppsFlyer to measure our advertising on Facebook and Instagram; the App does not include a Meta SDK) — governed by Meta's Privacy Policy.
• Google Ads (receives install and purchase events from AppsFlyer for installs attributed to our Google Ads campaigns) — governed by Google's Privacy Policy.
• Google Gemini via Google Cloud Vertex AI (the only AI provider for the AI Assistant) — governed by the Google Cloud Data Processing Addendum and Google's Privacy Policy.
• Cloudflare (backend for the AI Assistant proxy and device registration) — governed by Cloudflare's Privacy Policy.

5. Refund requests

If you ask Apple for a refund of an in-app purchase or subscription made in the App, we may share information about your use of the app with Apple to help Apple review the request. This may include your purchase and subscription history in the app, how long and how often you have used the app, and whether you used the content or features you paid for. We share this information only in response to a refund request, it is not used for advertising, and it is transmitted on our behalf by our subscription management provider, Adapty. If you do not want this information to be shared, contact us at support@almaviralabs.com and we will turn sharing off for your account.

6. Storage and retention

6.1 On your device

• Vision feature print cache — removed when you uninstall the App or clear local data.
• Secret Space content and PIN — stored locally (content in the App's private storage, PIN in the iOS Keychain); removed when you uninstall the App.
• App preferences, cached scan results, and subscription state — removed on uninstall.
• Random analytics user identifier — stored in the iOS Keychain; may persist across reinstalls and may be synced to your other devices through iCloud Keychain.

6.2 On our servers and service providers

• AI Assistant requests — processed ephemerally; we do not store request bodies or responses beyond the processing window.
• Device registrations and notification events on our backend — kept until you ask us to delete them; deletion on request to privacy@almaviralabs.com.
• Analytics events — retained for up to 14 months in Firebase; PostHog and AppsFlyer retain event data per our configuration and their policies, used for aggregated reporting and attribution.
• Data shared with advertising platforms (such as Meta) — once received, it is retained and used by that platform under its own policies.
• Email correspondence with our support — retained as long as required to provide ongoing support and comply with applicable laws.

7. International data transfers

Our service providers (Google, PostHog, AppsFlyer, Adapty, Cloudflare, Google Gemini) and the advertising platforms we share measurement data with (such as Meta) may process data on servers located in the United States and other countries outside your own. Where the GDPR or UK GDPR applies, such transfers rely on appropriate safeguards, such as the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses maintained by those providers.

8. Your rights

Depending on your jurisdiction (EU/EEA, UK, Australia, California, and others), you may have rights including:

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate or incomplete data.
• Erasure — request that we delete data we hold about you.
• Restriction or objection — request that we limit how we use your data, or object to processing based on legitimate interests, including the advertising measurement described in Section 2.7.
• Data portability — receive your data in a structured, commonly used format.
• Withdrawal of consent — withdraw consent for any processing based on your consent.
• Complaint — lodge a complaint with your local data protection authority.

You can revoke Photos, Contacts, Notifications, or Tracking permissions at any time in iOS Settings. To remove local data, uninstall the App (the random analytics user identifier may remain in the iOS Keychain, see Section 6.1). To request action on data we hold on our servers or in our analytics and attribution providers, contact us at privacy@almaviralabs.com.

9. Children's privacy

The App is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective" date at the top of this page. Material changes will be highlighted in the App or by email if you have provided one.

11. Contact

For any privacy-related question or request:

• Email: privacy@almaviralabs.com
• Postal: FOP Yevhenii Krysiuk, Vasylievska St., build. 121B, fl. 4, office 12, Kamianske, Dnipropetrovska region, 51900, Ukraine