Privacy

Your data stays with you

Photos, ratings and marks are stored only locally on your phone (in an index database). No photo is uploaded to a server or shared with third parties.

Local network only

To curate from the laptop, Kustos runs a small web server on your phone. Only browsers you confirm on the phone can connect to it, and you can disconnect them again at any time in Settings. Image data is transferred directly between your phone and laptop, never over the internet.

Place names

When you open a photo’s details and it shows where the shot was taken, Kustos asks your phone’s own map service to turn the coordinates into a place name. iOS and Android resolve that through Apple and Google, so those coordinates leave your device. Results are cached per area, so the same place is looked up only once. No photo and no identifier is sent along.

Deletion

Deleting photos is always confirmed by iOS / Android; the photos go to the system trash (recoverable for 30 days). Kustos never deletes anything without your explicit confirmation.

Anonymous usage statistics

Kustos collects anonymous, aggregated usage statistics (e.g. how many photos were curated or deleted and which mode was used) to improve the app. No personal data, no device identifiers, no profiles, no ads and no accounts. Your photos are never affected. Each event also carries your OS and its version, your app version and build number, your language setting, and whether you have unlocked Pro. When a laptop browser connects, Kustos also reports its browser family and desktop operating system as rough labels, such as “Chrome” and “macOS”, without versions. If an error occurs, Kustos also reports a short technical identifier for it: the error's class name, plus the platform error code when that code is a plain identifier. Codes in any other shape are dropped, and the error message is never read, because either can contain file names. You can switch all of it off under Settings; Kustos then stops collecting and discards anything still queued.

Which system we use for this

For these anonymous statistics we use Aptabase, a privacy-friendly analytics service whose servers are located in the EU. Aptabase uses no cookies and stores no persistent device identifiers; instead it derives a daily, anonymous and non-traceable identifier from a random value and coarse app information. It cannot be linked back to you as a person, and no cross-device profile is created.

Aptabase privacy policy ↗

This website

For kustos.one we use Plausible Analytics, a web analytics service whose servers are located in the EU. Plausible sets no cookies and stores nothing on your device, so no profile is built and you are not recognised across visits or across sites. Your IP address is processed only briefly and is never stored. We record the page you opened, the referring address, coarse information about country, device type and browser, and clicks on the store buttons (whether iOS or Android, and which spot on the page the button sits in). No consent banner is needed for this, because no cookies are set and nothing is stored on your device. The legal basis is our legitimate interest in measuring reach without tracking (Art. 6(1)(f) GDPR).

Plausible privacy policy ↗

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Because Kustos has no accounts and the usage statistics are anonymous, a single record cannot be traced to a person — so we are technically unable to answer an access request about it. You can switch the collection off at any time in the app settings. The legal basis is our legitimate interest in improving the app (Art. 6(1)(f) GDPR). You may also lodge a complaint with a supervisory authority; ours is the Data Protection Commissioner of Lower Saxony, Germany.