Privacy Policy

PhotoMeta

Last Updated: 8 November 2026

Introduction

Binaryscript Private Limited ("we", "our", or "us") operates the PhotoMeta mobile application for Android and iOS (the "App"), a photo metadata viewer and cleaner. The App shows the metadata stored inside your photos — EXIF, GPS location, XMP, IPTC and C2PA / Content Credentials — and saves a clean copy without it, for JPEG, PNG and WebP photos. This Privacy Policy explains what information the App collects, why, where it goes, and what control you have over it.

By using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Your Photos And Their Metadata (Processed Only On Your Phone)

When you choose a photo, the App reads it on your phone to show you what it contains, including:

• EXIF data: such as the camera or phone make and model, lens and exposure settings, and the date and time the photo was taken
• GPS data: the location where the photo was taken, if it was recorded
• XMP and IPTC data: such as editing history, captions, keywords, author and copyright fields
• C2PA / Content Credentials: provenance information, including any record that the photo was made or edited with AI tools

When you clean a photo, the App writes a new copy without that metadata and saves it to your photo gallery. Your original photo is never modified.

1.2 Other Information Stored Only On Your Phone

The App also keeps, only on your phone: your app settings, how many free cleans you have used, your premium status, the identifiers of purchases already processed, and, if you have signed in, your sign-in session tokens.

Clearing the App's data or uninstalling the App deletes all of this permanently. The clean copies you saved stay in your gallery until you delete them there.

1.3 Sign-In (Only To Buy A Subscription On Android In India)

The App does not require an account. On Android in India, you are asked to sign in only when you choose to buy premium, so that your purchase can follow you to another phone. Sign-in is with Google, through Firebase Authentication. From your Google account we receive:

• Your name, as it appears on the account
• Your email address
• A Firebase user identifier (UID)

We never see or receive your Google password.

Outside India on Android, and in every country on iOS, there is no sign-in and no account: purchases are made through Google Play or the App Store.

1.4 Information Sent To Our Own Servers (Only If You Sign In)

a) At sign-in
When you sign in, the App sends the following to our backend at api.binaryscript.com in order to create or recognise your account:

• The Firebase ID token issued by your sign-in
• The App's package name and the platform
• Device and build information: device model, operating system version, App version and build number
• Your two-letter country code and language code
• A referral code, if you arrived through a referral link
• Your Firebase app instance identifier
• The approximate location described in 1.5

In return we store an account record containing an internal identifier, your Firebase UID, your name, email, country, language, approximate location and your subscription status. If you enter a phone number in connection with a payment, it is stored with that account record.

b) Subscription and payment (India)
On Android in India, premium is paid through PhonePe, with subscriptions billed by UPI AutoPay mandate, rather than through Google Play. For this the App exchanges the following with our backend: the plan you selected, the UPI app you chose to pay with, and the order and subscription identifiers returned to us, which are then used to verify the payment.

c) Purchase events reported to Google Analytics
Our backend may report sign-up and purchase events, such as a subscription started or renewed, to Google Analytics using Google's Measurement Protocol, together with your Firebase app instance identifier, so that we can measure which plans and channels work. These events contain no photo or metadata.

d) Session tokens
Our backend issues access and refresh tokens which the App stores on your phone to keep you signed in. They are removed when you log out or delete your account.

1.5 Approximate Location From Your IP Address

The App may look up an approximate location from your network (IP) address: city, state, country and their approximate coordinates, using BigDataCloud's reverse-geocoding service, which therefore sees your IP address. Only if you sign in is it sent to our server, where it is stored once with your account and helps us understand where our users are. Privacy Policy: https://www.bigdatacloud.com/privacy-and-cookie-policy

1.6 Information Collected Automatically By Third-Party Services

a) Google Analytics for Firebase
Used to understand how the App is used and where people get stuck. It collects:

• Screen views within the App
• Product events, such as a photo opened, the kinds of metadata found, the photo format, a clean copy saved or refused, the paywall viewed, a plan selected, and purchases started, completed, failed or restored
• Purchase events, containing the transaction identifier, product identifier, amount and currency
• User properties such as whether you are premium, your country code and which payment method applies to you
• Your Firebase UID as the Analytics user identifier, if you are signed in
• Device information: device model, operating system version, App version, screen and language settings
• Session information: when the App was opened and how long it was used
• Identifiers: a Firebase app instance identifier and, on Android, the advertising ID, which Google Analytics for Firebase may collect by default
• An approximate, coarse location (typically country or region) that Google derives from the IP address of the connection
• Privacy Policy: https://policies.google.com/privacy

b) Firebase Crashlytics
Used to find and fix crashes. It collects crash and error reports including the stack trace and the state of the App at the time, plus device model, operating system version, App version and a Crashlytics installation identifier. Crash reports contain no photo, file name or metadata value. Privacy Policy: https://policies.google.com/privacy

c) Firebase Performance Monitoring
Used to measure how fast the App starts and responds. It collects timings of App start-up, screens and network requests, together with device model, operating system version, App version, network type and an installation identifier. It records nothing from your photos. Privacy Policy: https://policies.google.com/privacy

d) Firebase Remote Config
Used to adjust settings such as how often the upgrade screen appears and the minimum supported App version, without an update. It fetches configuration values; it sends us no personal information about you. Privacy Policy: https://policies.google.com/privacy

e) Firebase Authentication
Manages your sign-in session and issues the identity token described in 1.4(a), only if you sign in. Privacy Policy: https://policies.google.com/privacy

f) Google Play Billing and the Apple App Store
Handle all purchases on Android outside India, and all purchases on iOS. Google or Apple processes your payment under its own privacy policy. We receive only the purchase status, the product identifier and the transaction identifier — never your card details or billing address. Privacy Policies: https://policies.google.com/privacy and https://www.apple.com/legal/privacy/

g) Razorpay SDK (Android, India)
On the India payment screen, the App checks which UPI apps on your phone support UPI AutoPay (such as PhonePe, Google Pay, Paytm, BHIM and Amazon Pay), so it can offer them for the payment. It uses Razorpay's SDK only for this check; no payment goes through Razorpay. To answer, the SDK reads which UPI apps are installed on your phone and shares this list with Razorpay. Privacy Policy: https://razorpay.com/privacy/

1.7 How The App Determines Your Country

The App needs a country code to decide whether to offer store billing or the Indian UPI payment, and to show prices in your currency. It works this out from information on your phone, such as your store country and your phone's region settings. This is a country code, not your location.

1.8 Permissions The App Requests

• Photo access — on Android, the App uses the system photo picker and the system file picker, which give it only the photo you choose and need no storage or media permission. On iOS, the App asks for access to your photo library to read the photo you choose.
• Saving to your gallery — to save the clean copy. On Android 9 and below this uses the storage write permission; on iOS it uses add-only access to your photo library.
• Internet — for analytics, crash and performance reporting, Remote Config, sign-in, subscription checks and the in-app legal pages. Your photos never use it.
• Billing — for in-app purchases through Google Play or the App Store.

The App requests no camera, location, contacts, SMS, call, microphone or telephone permissions.

1.9 What We Do Not Collect

We do not collect your photos, their file names, any metadata inside them (including the GPS location where a photo was taken), a list of the photos you opened or cleaned, your contacts, your messages, your precise location, or your card or bank details.

2. How We Use Information

We use the information described in Sections 1.3 to 1.6 only for:

• Creating and maintaining your account and keeping you signed in, if you sign in
• Determining and honouring your premium entitlement, including across phones
• Processing payments through PhonePe, Google Play or the App Store
• Understanding how the App is used — which formats and kinds of metadata people meet, where people abandon a flow, which plans convert
• Diagnosing crashes, errors and slow screens so the App works on more phones and more photos
• Protecting our services from abuse
• Deciding what to build next
• Complying with legal obligations, including tax and accounting requirements in respect of payments

We do not sell your data, we do not use it for advertising, and we do not build advertising profiles from it.

3. Advertising

On Android, Google Analytics for Firebase may collect the advertising ID, as described in Section 1.6, even though the App shows no ads. You can reset that identifier or opt out of ads personalisation at any time in Settings > Google > Ads on your phone, or at https://adssettings.google.com.

4. In-App Purchases and Subscriptions

The App is free to download. Viewing metadata is always free, and you can clean a limited number of photos for free. Premium may be offered as a monthly subscription, a yearly subscription (which may include a free trial) and a one-time lifetime purchase; the App shows what premium includes and its price before you pay.

4.1 Google Play And The App Store

On Android outside India, purchases are processed by Google Play. On iOS, in every country, purchases are processed by the App Store. We never receive or store your card details, billing address or any other payment information. We receive the purchase status, product identifier and transaction identifier so we can unlock premium features.

4.2 PhonePe (Android, India)

On Android in India, premium is billed through PhonePe, with subscriptions paid by UPI AutoPay mandate. You approve the payment inside your own UPI app. Our backend records the plan, the order and subscription identifiers, the payment status and the subscription dates so it can verify your payment and honour your entitlement. Your UPI PIN, UPI ID, card number and bank details are never seen by the App or by us.

See also our Refund Policy.

5. Data Storage and Security

5.1 Your Photos Stay On Your Phone

Your photos are read and cleaned on your phone, and the clean copy is saved to your own gallery. We hold no copy of any photo, original or clean. If your gallery is backed up to a cloud service such as Google Photos or iCloud, the clean copy is backed up there like any other photo, under that service's own terms and privacy policy.

5.2 Account And Subscription Data

If you sign in, your account record and subscription status are stored on our servers in India, and are transmitted over encrypted HTTPS connections.

5.3 Analytics, Crash And Performance Data

Transmitted over encrypted connections and stored on Google's infrastructure under Google's security practices.

5.4 Our Practices

We follow reasonable secure development practices, keep dependencies updated, and limit access to account data to the people who need it. No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data Sharing and Disclosure

6.1 We Do Not Sell Your Data

We do not sell, trade, rent or share your information with third parties for their own purposes.

6.2 Service Providers

The only third parties that receive data from the App or from our backend are:

• Google — Firebase Analytics, Crashlytics, Performance Monitoring, Remote Config and Authentication, Google Sign-In, Google Analytics (purchase events from our backend) and Google Play Billing
• Apple — App Store purchases on iOS
• PhonePe — payment processing in India
• Razorpay — the list of installed UPI apps, on the India payment screen
• BigDataCloud — your IP address, to look up an approximate location

Each processes data under its own privacy policy, linked in Section 1.

6.3 Legal Requirements

We may disclose information if required by law, court order or other legal process, or where necessary to protect our rights, safety or property, or to investigate fraud or abuse.

6.4 Business Transfers

If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction. We will update this policy if that happens.

7. Data Retention

• On-phone data (settings, free-clean count, premium status, session tokens): kept until you clear the App's data or uninstall the App.
• Clean copies in your gallery: kept until you delete them in your gallery.
• Account data: kept while your account is active, and deleted on request as described in Section 8.2.
• Payment and subscription records: retained for as long as required by applicable tax and accounting law, even after account deletion, in a form limited to what those obligations require.
• Crash reports: retained by Firebase Crashlytics for up to 90 days.
• Analytics data: retained according to our Firebase Analytics retention setting, and in any case for no longer than 14 months.

8. Your Rights and Choices

8.1 Data On Your Phone

Clear the App's data or uninstall the App to remove everything it stored on your phone. Delete clean copies from your gallery as you would any other photo.

8.2 Deleting Your Account (If You Signed In)

To have your account record on our servers erased, follow How to Delete Your Account, or email support@binaryscript.com from the address you signed in with. Settings > Delete account in the App signs you out and clears your session from the phone; the server record is erased within 30 days of a verified request, keeping only what tax and accounting law requires.

If you never signed in — which includes everyone on iOS and everyone on Android outside India — you have no account with us, and the only data held about you is the analytics and crash data described in Section 1.6.

8.3 Managing Your Subscription

• Google Play: Play Store > profile icon > Payments & subscriptions > Subscriptions
• App Store: iPhone Settings > your name > Subscriptions
• PhonePe / UPI AutoPay: manage or revoke the mandate in the UPI app you approved it in, or write to support@binaryscript.com

8.4 Rights Under Applicable Law

Depending on where you live, you may have rights to access, correct, delete, export or restrict the processing of your personal data, to object to it, or to withdraw consent. In India, the Digital Personal Data Protection Act, 2023 gives you these rights; residents of the European Economic Area and the United Kingdom have similar rights under the GDPR, and residents of some US states, such as California, under state law. To exercise any of them, or to ask us to delete analytics or crash data associated with your phone, contact support@binaryscript.com. We will respond within 30 days.

9. Children's Privacy

The App is not directed at children, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact support@binaryscript.com and we will delete it.

10. International Data Transfers

We operate from India, and our account and subscription servers are located in India. Analytics, crash and performance data is processed by Google on infrastructure that may be located in the United States or elsewhere. By using the App you consent to your information being transferred to and processed in those countries, which may have different data protection laws than your own.

11. Third-Party Links and Apps

The App opens the following outside itself:

• Our privacy policy, terms and refund policy, shown in an in-app browser
• Your photo gallery app, when you open a clean copy you saved
• Your UPI app, when you pay through PhonePe in India
• The Google Play or App Store listing, for updates and ratings
• Your email app, when you contact support

We are not responsible for the privacy practices of those third parties.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes take effect when the updated policy is published. Material changes — in particular, any change to what we collect — will be published before the version of the App that makes them is released, and the "Last Updated" date above will change.

Your continued use of the App after an update constitutes acceptance of the updated policy.

13. Governing Law and Compliance

This Privacy Policy is governed by the laws of India. Any dispute arising from it is subject to the exclusive jurisdiction of the courts in Raipur, Chhattisgarh, India.

We comply with applicable Indian data protection law, including:

• Digital Personal Data Protection Act, 2023
• Information Technology Act, 2000
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

14. Contact Us

Questions, concerns or requests about this Privacy Policy, including data access and deletion requests:

We will respond within 30 days.

Summary of Key Points