Privacy

Privacy Policy

Last updated: 6 May 2026

This Privacy Policy describes how TheEditor handles data on your device. It applies to the iOS / iPadOS app TheEditor, distributed via the Apple App Store.

1. What data the app processes

Photos. When you import a photo (USB card reader, FTP, the Photos app picker, the Files / iCloud Drive picker, the built-in FTP server, or a watched folder you've selected), it is stored locally in the app's Documents directory. The app reads, edits, and exports those photos on-device. Photos are sent over the network only when you actively trigger an export to a destination you configured: an FTP profile you entered, the Files app, AirDrop, e-mail, or the iOS Photos library.

IPTC metadata. You can edit IPTC metadata (caption, creator, location, keywords, persons-shown, etc.) inside the app. This is stored locally with the photo and is included in the file you export.

Face recognition (optional, opt-in). If you enable face recognition in Settings:

• Apple's Vision framework runs on your device and produces a numeric "fingerprint" (embedding) of each detected face. This is biometric data under GDPR Article 9.
• Embeddings + the small reference thumbnail photos you add are stored in your iCloud private database. They sync across devices signed in to the same Apple ID. They are not visible to anyone else, including the developer.
• No part of the recognition pipeline talks to a third-party server.
• You can withdraw consent and delete every embedding (locally and in iCloud) via Settings → Face recognition → "Delete all face data".
• You can export your face library to a passphrase-encrypted backup file (AES-256-GCM with a key derived from your passphrase via PBKDF2). The file is encrypted on-device; we cannot read it, and we cannot recover the passphrase if you lose it.

You are responsible for ensuring you have a lawful basis (e.g. a team agreement, individual consent) for processing biometric data of the people you add as references. If you store an encrypted backup outside TheEditor (Files, iCloud Drive, USB) you are responsible for protecting that file.

Settings & cached state. UserDefaults holds your preferences (export defaults, IPTC quick-menu, FTP credentials, last-used filter, watched-folder bookmark, debug flags). This is stored in the app's sandbox and never transmitted.

Subscription state. Subscription validation runs through Apple's StoreKit framework. The developer does not receive a copy of your purchase receipt beyond what App Store Connect already shows.

2. Permissions the app may request

• Photo Library — to import photos from the iOS Photos app and to save exports there.
• Local network — for the built-in FTP server, FTP export, and mDNS discovery on your LAN.
• Notifications — only to surface export completion and FTP receive events.
• Location — only when you explicitly opt in to geotag-on-import.

The app uses the out-of-process Photo picker where possible so it does not need full Photo Library access.

3. Third parties

• Apple iCloud (when face recognition is enabled): your reference library syncs through Apple's CloudKit infrastructure. Apple is the platform — there is no parallel storage operated by us.
• Apple StoreKit for subscription processing.
• Your own configured destinations: an FTP server you entered, the Files app, AirDrop targets, e-mail recipients, the iOS Photos library, watched folders you selected.

We do not use Google Analytics, Firebase, Crashlytics, AppsFlyer, Adjust, or any other third-party SDK that collects user data.

4. We do not track or sell your data

We do not track you across apps and websites owned by other companies. The app does not call App Tracking Transparency because it has nothing to track — there are no advertising identifiers, no cross-app analytics, no tracking pixels, no fingerprinting.

We do not sell, rent, trade or share your data with anyone. Not for advertising, not for analytics, not for "partners". The only data flows that ever leave your device are the ones you trigger explicitly: an export to an FTP server you configured, an AirDrop you initiated, an e-mail you composed, a backup you saved, or your own iCloud sync.

5. How to delete your data

Because nothing is stored on our servers, you have full local control. To remove your data:

• Individual photos — delete them from the library grid (long-press → Delete).
• IPTC fields on a photo — clear them in the IPTC tab and save.
• Metadata templates / IPTC quick-menu / code-replacement lists — delete entries in Settings → Metadata.
• FTP profiles & credentials — delete in Settings → FTP Profiles (also removes the iOS Keychain entry).
• Watched folder bookmark — Settings → Watched folder → Stop watching this folder.
• Face library (locally and from iCloud) — Settings → Face recognition → Delete all face data. CloudKit propagation across your other devices takes ~30 seconds.
• Everything at once — uninstall TheEditor from your iPhone or iPad. iOS removes the entire app sandbox (Documents, Caches, UserDefaults, Keychain entries scoped to the app). Face-library records you've already synced to iCloud remain in your iCloud private database until either you reinstall + delete-all, or you remove the data via iCloud.com → Account Settings → Manage.
• Subscription — manage via iOS Settings → Apple ID → Subscriptions → TheEditor → Cancel subscription. We have no power to cancel on your behalf — Apple is the merchant of record.

6. Subscription terms

TheEditor offers TheEditor Pro as an auto-renewing monthly subscription, with a 7-day free trial for first-time subscribers.

• Payment is charged to your Apple ID account at confirmation of purchase.
• The subscription automatically renews unless auto-renew is turned off at least 24 hours before the end of the current period.
• Your account is charged for renewal within 24 hours before the end of the current period at the price displayed in the App Store.
• Subscriptions can be managed and auto-renewal turned off at any time in iOS Settings → Apple ID → Subscriptions.
• Any unused portion of a free trial period is forfeited when you purchase a subscription, where applicable.
• Refunds are handled by Apple — request via reportaproblem.apple.com.

Full subscription & usage terms: Terms of Use.

7. Data retention

• Photos, edits, and IPTC metadata stay until you delete them.
• Face references stay until you remove them via the face library or "Delete all face data".
• Settings stay until you uninstall the app.
• Cached export files are removed automatically after 24 hours.

8. Your rights (GDPR / AVG)

You have the right to access, rectify, delete, restrict, and port your personal data. Because everything is stored on your own device + your own iCloud, you exercise these rights directly:

• Access — open the app; everything is visible.
• Rectify — edit IPTC fields, replace face references, etc.
• Delete — delete photos / references in-app, or uninstall the app.
• Port — export photos with embedded IPTC; export your face library as an encrypted backup; back up your iCloud account.

If you have questions about this policy, contact: tom@tombode.nl.

9. Children's privacy

TheEditor is rated 17+ on the App Store and is not directed at children. The face-recognition consent flow includes an explicit attestation that you will not process face data of children under 13.

10. Changes to this policy

We will update this page when material changes happen. Substantive changes will be announced inside the app.

11. Privacy manifest

In line with Apple's privacy framework, the app's PrivacyInfo.xcprivacy declares only the use of UserDefaults (Required Reasons API CA92.1). No other required-reason APIs are used. NSPrivacyCollectedDataTypes is empty — the developer collects nothing through the app.