Privacy Policy — ShakeSnap

Last updated: 11 October 2026

This Privacy Policy explains how the mobile application ShakeSnap ("the App", "we", "us") handles your information. ShakeSnap is an instant-photo camera app that lets you take or import a photo, "develop" it with a shake motion, add a caption or drawing, and save or share the result.

Our guiding principle is simple: ShakeSnap processes your photos entirely on your device. Your pictures are never uploaded to us or to any server.

1. Who is responsible (Data Controller)

The controller responsible for data processing under the EU General Data Protection Regulation (GDPR) is:

Boris Vahl
c/o IP-Management #12161
Ludwig-Erhard-Str. 18
20459 Hamburg, Germany
Email: info@shakesnap.app

If you have any questions about this policy or your data, contact us at the email address above.

2. What data is processed, and how

a) Photos and images (processed only on your device)

When you take a photo with the camera or import one from your photo library, the image is processed locally on your device only to create your instant photo. Photos, captions, and drawings are not transmitted to us and are not stored on any server we control.

Saving: If you choose "Save to Gallery", the finished instant photo is written to your device's photo library.
Sharing: If you choose "Share", your device's built-in share sheet opens so you can send the instant photo (or an undeveloped ".shakesnap" file) through an app you select — e.g. Messages, WhatsApp, email, or Instagram. What happens to the image after that is governed by the privacy policy of the service you chose. We are not involved in that transfer and receive no copy.

b) Camera, motion and device sensors

Camera: used only to show the live viewfinder and capture the photo you take.
Accelerometer / motion data: the App reads motion data to power the "shake to develop" effect. This data is used in real time on your device and is not stored or transmitted.

c) App settings and preferences

Your settings (such as chosen theme colour, font style, and your crash-reporting and analytics choices) are stored locally on your device using standard app preference storage. If you have agreed to anonymous analytics, some of these settings are also sent as described below; we never send text you entered or other content you created.

d) Anonymous usage analytics (optional, only with your consent)

We use TelemetryDeck (TelemetryDeck GmbH, Augsburg, Germany) to see which features are used and where they fail, so we can improve the App. TelemetryDeck hosts its service in the EU and is built to receive anonymized data — see its privacy notice.

Only with your consent. Analytics is switched off when you install the App, and nothing is sent. After you have shared or saved your first snap, the App asks you whether you want to share anonymous usage statistics. Only if you agree does the App start sending. If you close the question without answering, it may come back once after a later share or save.
What is sent: information about how the App is used — which screens and features are used and whether they worked — and some of your app settings (such as colour, font and app language). TelemetryDeck adds an anonymized installation identifier and basic technical data (app version, operating-system version, device model, language, time zone).
What is never sent: your photos, captions, drawings or any other content you create, file names or paths, who you share with, error messages, or any identifier of you that we control.
Your choice: you can switch analytics on or off at any time under Settings → Privacy & data → “Share usage insights”. Switching it off stops sending immediately.

Legal basis: your consent — § 25(1) TDDDG for storing and reading information on your device and, to the extent personal data is processed at all, Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future.

Processor / retention: TelemetryDeck processes the data on our behalf as a processor (Art. 28 GDPR). How long TelemetryDeck keeps the data is described in its privacy notice.

e) Crash reports (optional, only with your consent)

To find and fix bugs, ShakeSnap can send crash reports using Google Firebase Crashlytics.

Nothing is sent without your consent. If no error occurs, you are never asked. If one does, the App first keeps a crash report on your device. The next time you open the App, it asks you what to do with it:
- “Yes, send reports”: this report and future ones are sent automatically.
- “No thanks”: the report is deleted. We ask again at the earliest after 6 months, and only after a new error; reports from errors in between are deleted.
- Closing the question without answering: the report is deleted. We ask again at the earliest after 30 days, and only after a new error; reports from errors in between are deleted.
What a report contains: the type of error and a technical stack trace, the app version, device model, operating-system version, general device state at the time of the error (such as free memory and storage), the time of the error, and a random installation identifier generated by Firebase. Your IP address is used to transmit the report.
While crash reporting is on, the App also sends a small signal at each app start, which Crashlytics uses to calculate how stable the App is.
Never included: your photos, captions, drawings or file contents. We do not set a user identifier or any custom keys in Crashlytics, so we cannot link a report to you as a person (see Section 6).
Your choice: you can switch crash reporting on or off at any time under Settings → Privacy & data → “Send crash reports”. Switching it off also deletes unsent reports on your device.

Legal basis: your consent — § 25(1) TDDDG for storing and reading information on your device and Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future.

Processor / recipient: Crashlytics is provided by Google (Google Ireland Limited / Google LLC). Reports may be transferred to servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR); Google additionally relies on the EU Standard Contractual Clauses. See Google's privacy information at https://firebase.google.com/support/privacy and https://policies.google.com/privacy.

3. What we do NOT do

We do not run user accounts, logins, or profiles.
We do not upload, store, or have access to your photos.
We do not use advertising, ad tracking, or marketing analytics. The limited anonymous usage analytics described in Section 2(d) is not used for advertising or profiling.
We do not use cookies or web tracking inside the app.
We do not collect your location.
We do not sell or share your personal data with third parties for their own purposes.

4. Permissions the app requests

Permission	Why
Camera	To take photos.
Photos / Media (gallery)	To import an existing photo and to save the finished instant photo. On older Android versions this may appear as a storage permission.
Vibration	For haptic feedback while shaking to develop.

You can review or revoke these permissions at any time in your device's system settings. Some features will not work without the relevant permission.

5. Data retention

Photos and instant photos remain wherever you save or share them (your gallery, another app). Deleting them is under your control.
App settings remain on your device until you clear them or uninstall the App.
TelemetryDeck retains analytics data as described in its privacy notice.
Crash reports (if enabled) are retained by Google Crashlytics for a limited period in line with Google's policies (typically up to 90 days).

6. Your rights under the GDPR

Because we do not hold your photos or an account, most of the data described here stays on your device. In relation to any personal data we do process (e.g. crash reports or analytics you consented to), you have the right to:

access the data we hold about you;
request correction or erasure;
request restriction of processing;
data portability;
object to processing;
withdraw consent at any time (for analytics and crash reporting, simply switch them off under Settings → Privacy & data).

To exercise these rights, contact us at the email address in Section 1. You also have the right to lodge a complaint with a data protection supervisory authority.

Important note on identifiability (Art. 11 GDPR)

The optional crash reports (Section 2 e) and anonymous usage analytics (Section 2 d) contain no custom user identifier or other information that we use to identify you as a person. We are therefore generally unable to link an individual report or analytics event to a specific person.

Under Art. 11 GDPR, we are not required to collect additional data solely to make you identifiable in order to satisfy the rights listed above. In practice this means:

A request for access to, correction of, or deletion of individual crash reports or analytics events generally cannot be fulfilled by us, because we cannot attribute that data to any person. We will inform you accordingly if you make such a request.
The most effective controls, exercisable at any time, are to withdraw your consent to crash reporting or analytics in Settings. Switching analytics off stops future analytics signals; disabling crash reporting also deletes unsent reports on your device.
Crash reports are also deleted automatically by Google after a limited period (typically up to 90 days).

7. Children

ShakeSnap is a general-audience app and is not directed at children under the age required for consent in your country. We do not knowingly collect personal data from children.

8. Changes to this policy

We may update this Privacy Policy as the App evolves. The current version is always available at this address, with the "Last updated" date at the top.