Privacy Policy — PhotoBoekKeeper

PhotoBoekKeeper is an Android app by BoekSolutions for reviewing and organising photos and videos and using them in albums, collages and Photo Booth projects. This policy explains which data the app uses, where it is processed and which external services are involved.

Short summary

• Local photos and videos are processed on your own device through Android.
• PhotoBoekKeeper has no proprietary server that stores your photos, projects, Microsoft password or tokens.
• When you connect OneDrive, the app retrieves selected media and performs the cloud actions or backup uploads you request through Microsoft Graph.
• Advertising and purchases use Google services.
• A catalog snapshot contains metadata and references, without original media. Full backups and mirrors can also copy media to a destination you choose. Optional password protection encrypts the catalog, not copied media files.

Android permissions

The app does not request location, contacts or microphone access.

Local photos, videos and projects

• Local media is read and modified through Android MediaStore/ContentResolver. PhotoBoekKeeper does not use a proprietary media server.
• Deletion first uses Android trash and its system confirmation. Permanent deletion is only attempted after the configured retention period or an explicit action and requires another Android confirmation.
• Favouriting is a move within the gallery. Copying only occurs when you explicitly choose a copy operation.
• A Photo Booth capture and exported albums, collages or pages are stored on the device only when you choose to save them.
• Albums, collages and Photo Booth projects locally contain editing and layout data plus references to their photos. An original is not changed merely to display a project.

OneDrive and Microsoft Graph

OneDrive is optional. It is only used after you choose Connect and grant permission through Microsoft.

• Sign-in uses Microsoft Authentication Library (MSAL). PhotoBoekKeeper does not see or store your Microsoft password.
• The OneDrive feature requests the delegated Microsoft Graph permission Files.ReadWrite. It is required for cloud actions you confirm, such as copying, moving, restoring, and moving items to the app trash. The app uses this access only through visible features.
• After you explicitly select a folder, the app reads data in that folder and its subfolders, including file names, Microsoft item and folder IDs, size, dimensions and date fields.
• Selected media and backups may also be uploaded to your chosen OneDrive destination, including through a backup schedule or mirror you enable.
• Thumbnails and image content are retrieved over encrypted HTTPS connections directly from Microsoft when needed to display selected photos. They are not forwarded to a BoekSolutions server.
• A swipe is first stored only as a local decision. The app may move the OneDrive item only during the confirmed batch action. Permanent deletion is limited to the app's own trash after checking the item's current Microsoft location; Microsoft may subsequently retain it in the OneDrive provider bin.
• MSAL manages its account and token cache inside the app container. PhotoBoekKeeper does not manually store access or refresh tokens in its database or Preferences.
• The selected OneDrive folder name and ID and internal references to reviewed OneDrive items may be remembered locally. Signing out removes the MSAL cache accounts and the locally remembered OneDrive folder.

Microsoft processes sign-in and OneDrive data as an independent service provider under the Microsoft Privacy Statement. You can also revoke granted app access through your Microsoft account.

Catalog snapshots, full backups and mirrors

Android Auto Backup is disabled because device-specific MediaStore references could point to a different photo after an automatic device restore.

You choose the backup mode and destination:

• A catalog snapshot saves project metadata, settings, sorting status, statistics, cabinet organisation, selected OneDrive folder references and recognition data such as cryptographic hashes. It contains no original media.
• A full backup additionally copies the media covered by the chosen backup. A mirror maintains copies of selected media and catalog information at the configured destination. These operations do not move or delete originals.
• Catalog password protection is optional. With protection enabled, catalog contents are encrypted using AES-256-GCM. With protection disabled, catalog information is readable at the destination. Copied photos and videos remain ordinary files and are not encrypted by this catalog-password option.
• A configured backup password can be stored locally using Android-backed SecureStorage for subsequent or scheduled runs. It is not sent to BoekSolutions, and BoekSolutions cannot recover a forgotten password.
• Backups run when requested or under an automatic schedule or mirror that you enable. You can disable these options in the app. Background work may show progress and result notifications.
• Restore first shows a preview and only automatically links media on an exact match. Microsoft credentials and tokens are not restored from the catalog: sign in to the same Microsoft account to access its OneDrive folders.

The selected Android document provider or Microsoft OneDrive processes the files you send to it under its own terms. You control the destination and are responsible for its sharing permissions and for retaining the originals when using a catalog-only snapshot.

Data stored locally

The protected app container stores information including:

• references to reviewed, copied and pending photos;
• trash state and retention settings;
• albums, collages, Photo Booth projects and editing metadata;
• folder preferences, the selected external/OneDrive folder and language;
• session statistics and reminder settings;
• a local subscription or entitlement state used by the user interface;
• the advertising age category you selected (under 13, 13–17 or 18+), stored as a category only and never as a date of birth;
• the Google-managed advertising consent status, kept on the device by the Google SDKs.

The database does not contain its own copy of the original photo files. Uninstalling the app removes its app container. Files you exported to the gallery, Downloads, a document provider or a backup destination remain there until you delete them.

Advertising

The free version uses Google AdMob. Google may process advertising identifiers, device data, interaction data, crash logs and diagnostics for ad delivery, fraud prevention and measurement. An IP address can indicate approximate location even though PhotoBoekKeeper requests no location permission. See the Google Privacy Policy and AdMob information.

From app version 1.0.6 and later, PhotoBoekKeeper asks for an age category before ads: under 13, 13–17 or 18+. Only the category is stored locally, never a date of birth, and it is not sent to a BoekSolutions server. The advertising SDK receives the corresponding signal about whether the user is below the age of consent.

If the age is unknown or under 13, no ads are shown. For 13–17, only non-personalised ads are requested, together with the below-age-of-consent signal. The app remains intended for ages 13 and over, even though the age selector includes a safe under-13 option.

For adults, Google's User Messaging Platform (UMP) handles the required consent choices. The app refreshes that status at start-up, and ads are only requested after the check succeeds and the SDK indicates that requests are allowed. Declining means no consent for personalisation; Google may still deliver limited or non-personalised ads within the permitted settings.

Settings > Privacy and ads lets you change your age category and, where applicable, reopen the Google advertising choices. Plus shows no ads. Internal and closed test builds give testers free Plus automatically, and ad testing uses Google test ads.

PhotoBoekKeeper does not provide AdMob with a OneDrive token or photo/project content.

Subscriptions and purchases

Purchases use Google Play Billing. Google processes payment and purchase data. PhotoBoekKeeper only receives information required to determine whether a product or subscription is available and active; it does not see or store card or bank details.

Plus may be offered as a monthly subscription or as a one-time lifetime purchase; both are restored through the same Google account, and payment details remain with Google.

Analytics and crash reporting

PhotoBoekKeeper currently has no separate analytics or crash-reporting service. Integrated Google SDKs may process interactions and diagnostic information as described above. MSAL sends basic SDK, request and error telemetry to Microsoft authentication endpoints to support service reliability. This does not include your photo content. Changes to these data flows will be reflected in this policy and Google Play Data Safety information.

Retention and deletion

• Local app data remains until you remove it through available app functions, sign out where applicable, or uninstall the app.
• The retention period for photos in Android trash is configurable.
• Data processed by Microsoft and Google is also subject to those services' settings and retention periods.
• You manage and delete exported files and backups at the destination you selected.

Your rights and choices

You can remove local app data by clearing the applicable features or uninstalling the app. You can sign out of OneDrive in the app and revoke permission in your Microsoft account. For data processed independently by Microsoft or Google, use that service's privacy and account controls.

In Settings > Privacy and ads (app version 1.0.6 and later) you can change your age category and, where applicable, reopen the Google advertising choices.

For privacy requests directed to BoekSolutions, use the contact address below.

Children

PhotoBoekKeeper is intended for adults and teenagers aged 13 and over, not for children under 13. The age selector includes an under-13 option as a safe choice: in that case, and when the age is unknown, no ads are shown. For ages 13–17 only non-personalised ads are requested. Regional store age ratings may be higher. Advertising and consent settings must be appropriate for the user's age and region.

Changes

This policy is updated when features, SDKs, permissions or data flows change. The date at the top identifies the most recent substantive update.