Privacy policy

Siftlo is built so that your photos, documents and the faces in them never leave your phone unless you ask for a specific cloud job. This policy explains the small amount we do hold, why, and what you can do about it. The plain-language version is our privacy promise.

The short version

Who we are

Siftlo is a product of Donukaps Ltd, a company registered in England and Wales under number 17437306, with its registered office at 4 Moss Bank, Cambridge, CB4 1UR, United Kingdom. We are the controller of the personal information described here. For anything about your data, including the rights below, email help@siftlo.com.

What stays on your phone

Scanning, indexing, finding duplicates, compressing, resizing, converting, reading text inside PDFs, and finding and grouping faces all run on your device. The results (the index, face groups and the names you assign) are stored only on that phone. We never receive them, so we cannot see, share or hand them over. Using Siftlo with no account and no internet connection is fully supported.

Siftlo only reads the photo library and the folders you grant it access to. You can change this at any time in your phone's settings or in Siftlo under Settings, Folders Siftlo can see, and you can mark folders Siftlo must never touch.

Optional cloud jobs

A few jobs are too heavy to run on a phone: summarising documents, reading difficult scans, and transcribing audio or video. These use our cloud AI service and only happen when:

• you have switched on cloud AI (Settings, Privacy and processing), and
• you confirm each job, after Siftlo shows you exactly which files would be sent.

Files sent for a cloud job are used once to produce the result you asked for and deleted from our servers straight after, within 24 hours at most. They are not used to train any AI model and not used for any other purpose. The AI work is done by Anthropic (the Claude API) on our behalf. Only what the job needs is sent, for example the text Siftlo has already read on your phone. Anthropic does not use it to train its models. Anthropic deletes API data within 30 days, and keeps none where zero data retention applies to our account, except data flagged for breaking its usage policies, which it may keep longer.

Your account

You do not need an account to use Siftlo Free. If you create one, or subscribe to Plus, we hold your email address, your plan and its renewal date. We use these to run your account, restore purchases across your devices, and send essential service messages such as billing notices. We will only send product news if you opt in.

Payments are handled by Apple (App Store) or Google (Google Play). We never see your card details; the store tells us only that a subscription is active.

Crash reports and app usage

Both are off until you switch on Anonymous crash reports and app usage (Settings, Privacy and processing). With it on, Siftlo sends technical details when the app crashes (device model, operating system version, app version and the error) to Sentry, and counts of which screens and features are used to PostHog, with an anonymous id rather than your name or email. Neither ever contains file names, file contents, photos, faces, the names you give people, your searches or anything from your index: the app cannot attach them. Switching it off stops both straight away.

This website

siftlo.com does not use advertising cookies or cross-site tracking. To count visits and see which articles lead to installs, we use Umami Cloud with its data stored in the EU. Umami does not use cookies, does not collect personal data and does not track you across websites; what we see is anonymous, aggregate counts. The language you pick is stored in a cookie so the site remembers it.

Links to the App Store and Google Play include a campaign code showing which page you came from. The stores use it to report installs to us in aggregate; it does not identify you.

Support and bug forms. When you write to us, we receive what you type (your name if you give it, your email address, and your message or bug report, plus any screenshot you attach) by email so we can reply. A Cloudflare Turnstile check runs on the form to stop spam; Cloudflare processes technical signals from your browser for that check only.

The waitlist

Before Siftlo is in the stores, you can join a waitlist to hear when it launches. We ask you to confirm by tapping a link in an email, and only then add you. We keep only your email address and the date you confirmed, and use it for one thing: a single email on launch day. After that email is sent, your address is removed from the list. Every email has an unsubscribe link, and unsubscribing removes you straight away.

Our lawful basis

• Contract: your email and plan, to provide the account and subscription you asked for.
• Consent: cloud jobs (asked each time), crash reports and app usage, marketing emails and the waitlist. You can withdraw consent at any time in Settings, or for the waitlist with the unsubscribe link.
• Legitimate interests: replying to messages you send us through the support forms.
• Legitimate interests: keeping the service secure and preventing fraud.
• Legal obligation: keeping records we are required to keep, such as tax records for payments.

How long we keep it

• Cloud job files: deleted from our servers as soon as the job completes, and never kept longer than 24 hours.
• Waitlist email: until the launch-day email is sent or you unsubscribe, whichever comes first.
• Messages to support: up to 24 months after the conversation ends, then deleted, unless we need them for a legal claim.
• Account email and plan: while your account is open, then deleted within 24 hours of you closing it.
• Records we must keep by law: as long as the law requires, then deleted.

Who we share it with

We do not sell or rent personal information, and we do not share it for advertising. We use these service providers, each under contract to process data only on our instructions:

Where a provider processes data outside the UK and the EEA, we rely on these safeguards. Vercel, Sentry, PostHog, Cloudflare and Resend are certified under the EU-US Data Privacy Framework and its UK Extension. Anthropic and Supabase use the European Commission's Standard Contractual Clauses with the UK Addendum in their data processing agreements, and RevenueCat relies on contractual safeguards in its data processing terms. Providers in the EU are covered by the UK's adequacy regulations for the EEA.

Your rights

Under UK GDPR you can ask to access, correct, delete or receive a copy of your personal information, object to or restrict how we use it, and withdraw consent. In the app, Settings, Your data lets you download a copy of what we hold (sent as JSON by email), clear what Siftlo learned on that phone, and delete your account. You can also email help@siftlo.com; we reply within one month.

Deleting your account cancels Plus at the end of the current period and removes your email from our records within 24 hours. It does not touch a single file on your phone.

If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.

Security

Account data is encrypted in transit and at rest. Cloud job files travel over encrypted connections and are deleted after processing. Because your files and index stay on your phone, they are protected by your device's own passcode and encryption.

Children

Siftlo is not directed at children under 13 (or 16 where local law requires), and we do not knowingly collect their personal information. If you believe a child has given us their details, tell us and we will delete them. Siftlo keeps privacy-protective defaults for everyone: processing stays on the phone, there is no profiling or advertising, and cloud jobs and analytics are off until you switch them on.

Changes to this policy

If we change how we handle personal information, we will update this page and the date at the top. For significant changes, we will tell you in the app before they take effect.