Privacy Policy

Last updated: September 15, 2026

This Privacy Policy describes how Felix Thron ("we", "us", or "our") collects, uses, and protects your information when you use the Relivio mobile application (the "App") and the relivio.io website.

Data controller (GDPR Art. 4(7)): Felix Thron, Kuglerstraße 22, 10439 Berlin, Germany. Contact: info@relivio.io.

1. Information We Collect

1.1 Anonymous Identity (No Account)

No account is required. Relivio is fully anonymous. The App uses Apple's AppTransaction API to obtain an appTransactionId - a stable, anonymous identifier Apple provides for your Apple Account / app pair. It persists across device switches and reinstalls but is not tied to any email, name, or other personal identifier. We do not collect names, email addresses, phone numbers, or other personal details, except when you write to us yourself (see Writing to us from inside the App below).

When you buy credits, we derive an appAccountToken (a UUID generated from your appTransactionId) and attach it to the App Store transaction so purchases and refunds can be matched to your anonymous identity for credit delivery. It contains no personal data.

Our backend keeps an anonymous record keyed by your appTransactionId. That record holds your credit balance, your Apple push token (so we can tell your device when processing has finished), whether that token is a sandbox token, and the times the record was created, last updated, and last seen. It is written each time you open the App.

Refund enquiries from Apple. If you ask Apple for a refund for an in-app purchase, Apple may ask us for information to assess your request. We send Apple the anonymous purchase token for that transaction, a band describing how much of the purchased credit you had used, how long your anonymous identity has existed, and confirmation that the credits were delivered. We do not send photos, Memories, or any of your content, and we do not send any monetary figures. We rely on our legitimate interest in defending against refund abuse (Section 4).

Writing to us from inside the App. If you email us from the App's Settings screen, the message we receive includes a Support ID - the letters REL- followed by the first eight characters of your device's vendor identifier - and your app version, so we can match your message to what happened. Your email address reaches us because you chose to send the email, and we use it to answer you.

1.2 Photos You Submit for Processing

When you use our restoration, colorization, or animation features:

• Your photo is uploaded over an encrypted connection to our servers (Google Cloud, EU region)
• We do not send the photo file itself to our AI processing provider (Replicate). We send a temporary link that lets Replicate fetch the photo from our cloud storage. That link stays valid for up to 7 days from the moment we create it, so anyone holding it - including through Replicate's own logs - can fetch the photo during that window
• Replicate states in its own terms that it deletes prediction inputs and outputs after one hour. That is Replicate's own practice under its terms: we do not instruct it and we do not verify it (replicate.com/privacy)
• The uploaded and generated files in our own cloud storage are deleted on the schedule set out in Section 6
• The processed result is downloaded to your device and stored locally

We do not use your photos to train AI models, and we do not analyze their content beyond producing the result you requested.

1.3 iCloud Sync (Apple CloudKit)

If you are signed in to iCloud, Relivio uses Apple's CloudKit to sync your Relivio content across your own Apple devices. This includes your original photos, restored and colorized results, and animated videos; the people, relationships, and face tags in your family tree (Section 1.5); your Memories - audio recordings, transcripts, and summaries (Section 1.6); and on-device photo-analysis results (Section 1.7). This content is stored in your private iCloud database, which belongs to your Apple Account and is governed by Apple's iCloud terms and privacy policy. We cannot read it; Apple processes it on your behalf.

These iCloud copies persist until you delete the item in the App, with one exception: deleting a memory moves it to Recently Deleted, and the record and its audio recording stay in your private iCloud database until you delete it permanently there (Section 1.6). They are not covered by the deletion schedule that applies to our cloud-processing pipeline (Section 6), which is a separate store. This sync follows your device's iCloud setting; disabling iCloud (or signing out of iCloud) stops it.

Erase iCloud Data. The App has an Erase iCloud Data control under Settings > Data. It removes Relivio's data from your private iCloud database. It does not delete anything on your device, and because your device keeps syncing afterwards, content that is still on the device is uploaded again into the fresh iCloud store. To remove something everywhere, delete it in the App first - and, for a memory, delete it permanently from Recently Deleted - and then erase the iCloud data.

1.4 Usage and Diagnostic Data

We collect anonymous usage and diagnostic data through Firebase and Google Analytics 4 (see Section 3):

• Screen views and feature usage
• App crashes, errors, and performance traces
• Device type, operating system version, and app version
• General location (country/region), derived from your IP address by Google; we do not store precise location
• A trail of recent app events attached to crash reports. Those lines can contain internal identifiers, such as a photo's random identifier. They never contain photo content, names, transcripts, or captions
• An app-instance identifier that Firebase assigns so that crash and usage data from the same installation can be grouped. It is not tied to you, and it is reset when you delete the App

Usage analytics are collected only if you turn them on; crash and performance diagnostics are on by default and can be turned off - both in the App under Settings > About (Sections 4 and 7).

We do NOT collect through our analytics: photo content, precise location, contacts, or other device data. The on-device People, Memories, and photo-organization features (Sections 1.5-1.7) are processed entirely on your device; the data they produce - face tags, voice recordings, transcripts, and captions - is never sent to Firebase, Google Analytics, or our servers.

1.5 Face Data and the People / Family-Tree Feature

Relivio's People feature lets you organize the people in your photos into a private family tree. To support this, the App uses Apple's Vision framework on your device to detect where faces appear in your photos - it computes a rectangular bounding box around each face so you can tap a face and assign a name. This runs when you open a photo to tag it, and also as a short background pass over photos you have not opened, so the App can tell which of your photos contain faces. That background pass keeps only a count of the faces it finds; it stores no face rectangle.

This is face detection (locating where faces are), not facial recognition. Relivio does not compute facial geometry, face landmarks, face embeddings or "face-prints", or any other biometric template, and it does not automatically match or identify anyone. Grouping a face to a person is done manually by you when you type a name. Because no biometric template is created and no automated identification takes place, this feature does not produce biometric data used to uniquely identify a person.

The data this produces - face bounding boxes, and the names and relationships you assign - is stored on your device and, if you use iCloud, in your private iCloud database (Apple CloudKit), synced across your own Apple devices. It is never uploaded to our servers, to Replicate, to Firebase, or to any third party, and it is used only for your own organization of your own photos. Removing a name from a face removes the name. The detected rectangle stays with the photo, with no name attached, until you delete the photo itself.

Separately, when you submit a photo for restoration or animation, the complete image is processed as a whole by our AI service provider (Section 1.2); no face-specific data is extracted, isolated, or stored separately from the photo in that flow.

1.6 Voice Recordings and Transcripts (Memories)

The Memories feature lets you record spoken memories. When you record, the App asks for microphone access.

• Transcription happens on your device. Relivio uses Apple's on-device speech recognition to turn your recording into text. Your voice recordings are not sent to our servers or to any third party for transcription. The on-device language model for your language is downloaded from Apple on first use. For some languages without an on-device model, Relivio offers to transcribe with a related language model or lets you simply type your memory instead.
• Optional summaries and titles are generated on your device. Where your device supports Apple Intelligence, Relivio can generate a short summary and title from your transcript using Apple's on-device foundation models. This runs locally; your transcript is not sent to a cloud AI. Where Apple Intelligence is unavailable, the feature is skipped and you keep your transcript and your own title.
• Details picked out of what you said. When your device generates a summary, it also picks out structured details from the recording - the names of people and places you mentioned, a rough timeframe, and the transcript broken into timed sections - and stores them with the memory. Some of the people named that way have never used Relivio. Their names stay on your device and, if you use iCloud, in your private iCloud database; they are never sent to our servers, to Replicate, to Firebase, or to any third party.
• Recordings shared from another app. You can share an audio recording into Relivio from another app, such as Voice Memos. Relivio copies the file into its own storage on your device and imports it as a memory, using the name the other app suggested as the memory's title. From that point it is handled exactly like a recording you made in the App, including the on-device transcription described above, and nothing about it is uploaded to our servers.
• Storage. Your audio recordings, transcripts, summaries, and the details picked out of them are stored on your device and, if you use iCloud, synced to your private iCloud database (audio as an Apple CloudKit asset). They are never uploaded to our servers, to Replicate, to Firebase, or to any third party.
• Deleting a memory. Deleting a memory moves it to Recently Deleted. Until you delete it permanently there, it stays on your device and, if you use iCloud, in your private iCloud database, including the audio recording. Nothing removes it automatically after a period of time.

1.7 On-Device Photo Analysis

To help you find and organize photos, Relivio can analyze a photo entirely on your device - using Apple's Vision framework (to recognize scenes and read any text in the image) and, where supported, Apple's on-device foundation models (to suggest a short caption or name). This works even in airplane mode; the analysis is never sent to our servers, to Replicate, to Firebase, or to any third party. Before anything is saved, recognized text is screened to remove obvious personal data such as phone numbers, addresses, emails, and ID numbers.

The results - scene tags, recognized text, and a suggested caption or name - are stored on your device and, if you use iCloud, synced to your private iCloud database. This on-device analysis is separate from the restoration and animation flow in Section 1.2, which sends whole images to our AI provider.

All photo data (which may incidentally contain faces) follows the same retention and deletion schedule described in Sections 1.2 and 6.

1.8 Taking Your Data Out of the App

Relivio lets you take your own data out of the App. Four things can leave: your family tree as a GEDCOM file (.ged); the same tree as a GEDZIP archive (.gdz), which additionally carries one cropped profile photograph per person; your Memories as audio files; and individual photos and videos that you share or save to your Photos library. You start each of these yourself; nothing is exported automatically.

What rides along. A family-tree export carries the names you recorded, including birth and maiden names; gender; birth and death dates; places; marriage and divorce dates and places; and who is related to whom. It also re-emits, unchanged, whatever was carried in a family-tree file you previously imported, which can include notes, occupation, and religion. A .gdz additionally carries a cropped image of each included person's face, named after that person's internal identifier. An exported memory recording carries its title, the on-device summary, a date, and a place name written into the audio file itself, where the file format supports it; the transcript is not exported, and neither are the names picked out of it (Section 1.6).

Living people are included by default. A family-tree export includes people who are not recorded as deceased, unless you turn on the option to leave them out in the export screen before the file is built. Even with that option turned on, a person with no recorded birth year is still included.

Where this runs. Building an export happens on your device, and nothing is uploaded to produce one. This is separate from the restoration and animation flow in Section 1.2, which sends whole images to our AI provider.

What happens once you export. An exported file is written wherever you send it - to the Files app, to Mail, to another app, or to someone else's device - and we never see it and keep no copy of it. From that moment the security of the exported file is your responsibility and that of whatever service, app, or device you put it into, because it is no longer protected by us or by Apple. Deleting the data in the App, erasing your iCloud data, or uninstalling Relivio does not reach a file you have already exported, and neither can an erasure request under Section 7.

Sharing a photo or video, and saving one to your Photos library. The same three points apply, with their own specifics. Sharing a photo sends the stored file itself, with whatever EXIF and GPS information that file already carries; we do not strip it. Saving a still to your Photos library writes EXIF into the saved image, including a "Restored by Relivio" credit, and sets the saved item's date and location. A Live Photo saved from an animated result also carries the photo's GPS latitude and longitude. Metadata is stripped only from the face crops inside a .gdz, which are re-rendered without EXIF or GPS; that is not a general rule about what leaves the App. Once a file is shared or saved, deleting the photo in Relivio does not remove the copy you already put somewhere else.

Importing a family tree. You can also import a GEDCOM file into Relivio. It may describe people who have never used Relivio; what it describes is stored on your device and, if you use iCloud, in your private iCloud database, and the parts Relivio does not otherwise use are re-emitted unchanged when you export.

2. How We Use Your Information

We use collected information to:

• Provide the photo restoration, colorization, and animation services
• Sync your library across your own devices via iCloud, if you have iCloud enabled
• Detect faces on your device so you can build a private family tree of the people in your photos
• Record, transcribe on your device, and optionally summarize on your device your spoken Memories
• Analyze your photos on your device to suggest captions and names and help you organize your library
• Process in-app purchases and manage your credit balance
• Send silent notifications to your device when processing completes or fails, or when a refund is issued, so the App can download results or update your balance (no marketing push)
• Diagnose crashes and improve app performance and features

3. Third-Party Services and Recipients

3.1 Apple

• AppTransaction / StoreKit 2 - anonymous identity and in-app purchases. Payment details are handled entirely by Apple; we never see them.
• CloudKit / iCloud - private cross-device sync of your library, family tree and face tags, Memories, and photo-analysis data (Sections 1.3, 1.5-1.7)
• Apple on-device frameworks (Vision, Speech, Foundation Models) - face detection, speech transcription, and content suggestions run locally on your device; they do not send your photos, audio, or transcripts to Apple or to us
• Apple Push Notification service (APNs) - silent notifications that wake the App to download finished results

3.2 Firebase and Google Analytics 4 (Google)

We use Firebase Analytics (which reports into Google Analytics 4) and Firebase Crashlytics for anonymous, aggregate usage statistics and crash diagnostics, in a privacy-hardened configuration:

• No advertising identifier (IDFA); the AdSupport framework is not linked
• No Firebase vendor identifier (IDFV) reporting. This describes what Firebase receives; it is separate from the Support ID in Section 1.1, which is derived from the same vendor identifier and which you send us yourself when you write to support
• No App Tracking Transparency prompt and no cross-app or cross-site tracking
• No user identifier is set. Firebase still assigns the app-instance identifier described in Section 1.4, which groups data from one installation rather than from a person
• Ad personalization, ad user data, and ad storage are disabled at the SDK level
• Your photos are never sent to Firebase or Google Analytics

You control both of these in the App under Settings > About: Usage Analytics stays off until you turn it on, and Crash Reports is on by default and can be turned off there.

This data is declared in our App Store privacy label as "Not Linked to You" and "Not Used to Track You". Google's data handling: firebase.google.com/support/privacy. Legal bases, withdrawal of consent, and your right to object: Sections 4 and 7.

3.3 Replicate

• AI Processing - photo restoration, colorization, and animation
• We send Replicate a temporary link to your photo in our cloud storage rather than the photo file itself, and that link stays valid for up to 7 days from the moment we create it
• Replicate states in its own terms that it deletes prediction inputs and outputs after one hour. That is Replicate's own practice: we do not instruct it and we do not verify it

Privacy Policy: replicate.com/privacy

3.4 Google Cloud Platform

• Cloud Storage - temporary photo storage (EU region, Belgium)
• Cloud Run - backend services (EU region)

We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR (Cloud Data Processing Addendum).

4. Legal Bases (GDPR Art. 6)

• Providing the App, photo processing, purchases, credit management, iCloud sync, and the on-device People / Family-Tree, Memories, and photo-organization features: performance of a contract with you (Art. 6(1)(b)).
• Analytics (Firebase Analytics / Google Analytics 4): your consent - § 25(1) TDDDG (the German act governing data protection in digital services) together with Art. 6(1)(a). Analytics is off until you turn it on. You can switch Usage Analytics on or off at any time in the App under Settings > About, and withdrawing your consent there is as easy as giving it; withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3); Section 7). Processing takes place only in the hardened, non-identifying configuration described in Section 3.2.
• Crash reporting and performance diagnostics: strictly necessary to deliver the service you asked for - § 25(2) No. 2 TDDDG - together with our legitimate interest in operating, securing, and improving the App (Art. 6(1)(f)), again only in the hardened, non-identifying configuration described in Section 3.2. Crash Reports is on by default and can be turned off at the same place, Settings > About; turning it off takes full effect the next time you open the App. You may object at any time (Section 7, Art. 21).
• Website operation and security (server logs): our legitimate interest in a secure, functional website (Art. 6(1)(f); Section 10).
• App backend operation and security (server logs): our legitimate interest in operating and securing the service (Art. 6(1)(f); Section 5).
• Responding to Apple's refund enquiries: our legitimate interest in defending against refund abuse (Art. 6(1)(f); Section 1.1). We do not collect consent for this and we do not claim any.

5. Data Storage and Security

• Photos and backend data are stored in the European Union (Belgium)
• Your synced library is stored in your private iCloud, controlled by your Apple Account
• We use industry-standard encryption in transit (HTTPS/TLS) and rely on platform encryption at rest
• We implement appropriate technical measures to protect your data

Server logs from our app backend. Two Google Cloud Run services in the EU carry the App's traffic: our backend and the media processor that optimizes finished results. Handling a request produces standard server-log data - the IP address the request came from, the date and time of the request, the requested URL, the HTTP status code, and the client's user-agent string - and application log lines that we do not redact. Those log lines can contain an internal photo identifier, an Apple transaction identifier, the anonymous purchase token described in Section 1.1, and error text returned by our AI provider. They do not contain photo content, face data, memory recordings, transcripts, or captions. The legal basis is our legitimate interest in operating and securing the service (Art. 6(1)(f)). These logs are retained for 30 days. This is separate from the website server logs in Section 10.

No method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

Each row below answers one question. Where a period appears, it says what it measures, because the same number does not mean the same thing in two different rows.

7. Your Rights

EU / EEA (GDPR)

You have the right to Access (Art. 15), Rectification (Art. 16), Erasure (Art. 17), Restriction (Art. 18), Data portability (Art. 20), Objection (Art. 21), and Withdrawal of consent (Art. 7(3)). Deleting the App removes your local data; to delete server-side data tied to your anonymous identity, contact info@relivio.io. Content synced to iCloud is managed by you through your Apple Account.

Withdrawing your analytics consent (Art. 7(3)): analytics runs only on your consent, so it is withdrawn rather than objected to. Turn Usage Analytics off in the App under Settings > About and further collection stops. Withdrawing is as easy as giving consent, and it does not affect the lawfulness of the processing carried out before you withdrew.

Right to object (Art. 21): crash reporting and performance diagnostics continue on our legitimate interest, so you may object to them at any time - turn Crash Reports off in the App under Settings > About (this takes full effect the next time you open the App), email info@relivio.io, or uninstall the App, which stops further collection.

Files you have already exported (Section 1.8): a GEDCOM or GEDZIP file, an exported memory recording, or a photo you shared or saved to your Photos library is outside our reach. We cannot retrieve it, correct it, or delete it for you, and an erasure request cannot reach it.

Right to lodge a complaint (Art. 77): the supervisory authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany; mailbox@datenschutz-berlin.de; datenschutz-berlin.de.

United Kingdom (UK GDPR)

UK residents have the same rights as in the EEA section above. The competent supervisory authority for the UK is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF, UK; ico.org.uk.

California (CCPA / CPRA)

We do not sell your personal information and do not share it for cross-context behavioral advertising. The Firebase and Google Analytics SDKs run with ad personalization, ad user data, and ad storage disabled, and no advertising identifier is collected. You have the right to know what we collect and to request its deletion (info@relivio.io).

8. Children's Privacy

Relivio is not directed to children. We do not knowingly collect personal data from children. In the EU, the digital age of consent is 16 in several Member States, including Germany (GDPR Art. 8); users below the applicable age in their country should obtain parental consent before using the App. If you believe a child has provided us with personal data, contact info@relivio.io and we will delete it.

9. International Data Transfers

Your photos and backend data are processed in the European Union. Analytics and crash data may be processed by Google in the United States. This transfer is covered by the EU-US Data Privacy Framework, under which Google LLC is certified (a European Commission adequacy decision under Art. 45 GDPR); the European Commission's Standard Contractual Clauses (Art. 46 GDPR) apply as a fallback safeguard.

10. Website (relivio.io)

Sections 1-9 describe the Relivio app. The relivio.io website hosts informational and marketing pages and serves its assets from our own domain. The site is hosted on Google Cloud Run, operated in the EEA by Google Cloud EMEA Limited (70 Sir John Rogerson's Quay, Dublin 2, Ireland), in the europe-west1 region (Belgium). To deliver each page and protect against abuse, the hosting infrastructure processes standard server-log data: your IP address, the date and time of the request, the requested URL, the HTTP status code, the referrer URL, and your browser's user-agent string. The legal basis is our legitimate interest in operating a secure, functional website (Art. 6(1)(f) GDPR). These logs are retained for up to 30 days and are not used to identify you. You may object on grounds relating to your particular situation (Art. 21 GDPR; see Section 7). Where log data is accessed from outside the EEA, the transfer is safeguarded by Google's EU-US Data Privacy Framework certification and, as a fallback, the European Commission's Standard Contractual Clauses.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy in the App and updating the "Last updated" date above. We encourage you to review it periodically.

12. Contact Us

For any questions about this Privacy Policy, or to exercise your rights, contact us:

Felix Thron Kuglerstraße 22 10439 Berlin Germany Email: info@relivio.io