Privacy Policy

1. Scope and contact

This Privacy Policy applies to the Vignetra mobile application, this website, and related support and account services (together, the “Service”). In this policy, “Vignetra,” “we,” “us,” and “our” refer to the operator of the Vignetra Service.

Questions, privacy requests, and complaints can be sent to privacy@vignetra.com. Please do not email photos, face images, passwords, authentication codes, or other sensitive media. The legal name, postal address, and governing establishment of Vignetra’s operating entity will also appear in the applicable app-store listing and will be added here before general commercial release.

This policy does not govern the privacy practices of Apple, Google, Firebase, OpenStreetMap, your device manufacturer, your mobile carrier, or other independent services you choose to use.

2. Vignetra’s privacy architecture

Vignetra separates sensitive library intelligence from account metadata:

• On-device processing. Authorized media, thumbnails used by the app, local media references, visual embeddings and labels, face feature representations and groups, person names, search indexes, and card rendering are processed and stored locally.
• Optional account sync. If you sign in, profile information and selected organizational metadata—such as titles, notes, corrected locations, hidden or viewed state, and preferences—can be stored in Firebase so supported details can follow you to another device.
• Self-declared account boundary only at authentication. The private local guest experience begins without age collection. Immediately before account creation or sign-in through Apple, Google, or email/password, a date entered in the app is evaluated on the device to determine whether the declaration is under 13 or 13+; the date is not stored by Vignetra. This is a warning and self-declaration, not proof of age, and the declaration relies on information supplied by the person and does not independently verify identity or guarantee accuracy. An under-13 declaration cannot create or enter an online account and returns to the private local guest experience. A declaration of age 13 or over may continue to authentication and account, cloud, and social features. Vignetra does not operate a guardian-approval override for an under-13 account.
• Explicit encrypted sharing. Vignetra never uploads your library automatically. When you choose a moment or create a photo card and select an audience, the app creates an encrypted copy and uploads only that ciphertext to Firebase Storage. Private shared metadata, face labels, image descriptions, card messages, and notes are likewise encrypted on the device.

Because your original media and local indexes are not backed up by Vignetra, they may be unavailable if you lose access to the device or remove the media from its photo library.

3. Information Vignetra processes

3.1 Information you provide

• Account and profile details: first name, unique username, optional 33-character About line, optional profile photo, friend count, email address or private relay address, Firebase account identifier, Apple or Google provider account identifier where applicable, and authentication status. Your first name, username, About line, profile photo, and friend count are social profile data visible to eligible signed-in users in account search, profiles, requests, friendships, and sharing surfaces. Your friend list and moments are not public.
• Email/password authentication: people who pass the 13+ eligibility boundary can create or enter an account with email/password, and can request a password-reset message. Firebase Authentication handles those credentials and reset messages. Vignetra does not receive, store, or log the raw password or send it to its callable backend.
• Account age-eligibility status: an under-13 or 13+ result, the self-declaration method, the check date, and online-access status. Vignetra does not store the date of birth entered in the app. This status is not proof of age. An under-13 declaration cannot be used to create or enter an online account; no guardian-approval override is offered.
• Moment and social details: titles, notes, location corrections or labels, hidden state, viewed state, friend requests, friendships, blocks, hearts, selected audiences, card layouts, card image descriptions, private Favorite and moment-alert choices, recent friend-interaction timestamps used to order your Relevant feed, reports, and other choices you make. Vignetra does not inspect encrypted card messages, notes, titles, or media to rank that feed.
• Preferences: settings needed to preserve your chosen experience, such as feature and display preferences.
• Communications: the email address, message, and any information you voluntarily include when contacting support.
• Purchase information: if paid features are introduced, the applicable app store handles payment credentials. Vignetra may receive a transaction identifier, product, entitlement, price region, purchase status, and validation result, but not your full payment-card number.

3.2 Information processed on your device

Depending on the permissions and features you enable, Vignetra may process the following locally:

• photos, videos, thumbnails, and media identifiers you authorize through system photo permissions;
• capture dates, media type, dimensions, duration, favorites or album-related state made available by the platform, and embedded location coordinates;
• calendar event titles, times, and locations when you separately authorize calendar access;
• visual embeddings and machine-generated scene, object, and color signals used to match natural-language searches;
• detected face regions, numerical face feature representations, similarity groups, review state, and the person names you choose to add;
• card layouts and crops, card rendering, and the photos or moment thumbnails you choose to place in a card;
• voice-search transcripts returned by the operating system’s speech-recognition service and placed into the Ask Your Life field for your review;
• local database records, caches, viewed history, and operational state used to make indexing and swiping responsive.

These local results are used to organize and search the library on that device. Face vectors, face crops, persistent face identifiers, visual embeddings, and thumbnails of unshared media are not synced to your Vignetra account. When you explicitly share, Vignetra may upload a small encrypted preview protected by the same audience access and content key so an authorized friend can see the moment in your private friend profile without first downloading the full-resolution media. If you explicitly share a moment that contains a name, the app can include a share-scoped label and display position inside the encrypted payload; it does not upload the local recognition profile used to find that face.

3.3 Voice input

Ask by voice is optional and activates only when you tap the microphone. Vignetra asks the operating system to convert a short spoken question into editable text. Depending on the device, language, network, and system settings, Apple, Google, or another platform speech provider may process audio and transcription data under its own privacy notice. Vignetra does not intentionally record, upload, or retain a voice recording. The returned transcript appears in the Ask Your Life field so you can review or edit it before searching your authorized library.

3.4 Siri and Shortcuts

Siri and Shortcuts are optional. When you use a supported Siri phrase, a Shortcut, or a system in-app search to invoke Vignetra, the operating system gives Vignetra the search text so it can open Ask Your Life and run the requested search. Vignetra uses that text only to provide the requested search of the photos, places, and details you have authorized it to use.

Vignetra does not provide Siri with your photo library, photo metadata, local visual indexes, face data, or search results through this feature. If the app interface is not ready when a request arrives, the search text is temporarily held on your device only until Vignetra can deliver it to Ask Your Life; it is then cleared, and it is also cleared by Vignetra’s account and local-data erasure controls. Apple’s independent handling of Siri and Shortcuts requests is governed by Apple’s privacy terms.

3.5 Information stored with an account

If you sign in, Vignetra may store the following in Firebase:

• your Firebase user identifier, sign-in provider, first name, email or private relay email, unique username, optional About line, friend count, optional profile-photo path, and the profile photo you choose to upload;
• your self-declared 13+ eligibility result, declaration method, and online-access status;
• moment titles, notes, corrected place or country names, coordinates you authorize as a correction, hidden state, viewed state, and related timestamps;
• account-safe derived keys used to associate metadata with the corresponding library item where the app can resolve it on another authorized device;
• friend requests and connections, block relationships, shared-moment membership, hearts, notification records, device push tokens, and safety reports. A report ordinarily contains account identifiers, a category, optional details, and an optional share identifier. Account and friend-request reports are metadata-only. A report about a moment, card, or note includes that exact reported item as private evidence;
• public encryption keys, device-credential metadata, encrypted private-key recovery envelopes, and short-lived encrypted device-approval requests. A random wrapping secret is prepared automatically and stays in that device’s protected storage. These secrets and the decrypted private key are not sent to Vignetra. An existing signed-in device can approve a new device by encrypting the same identity directly to it;
• ciphertext for the moments and cards you explicitly share, encrypted titles, locations, share-scoped face labels, card images, image descriptions, messages and nested notes, and per-recipient encrypted key envelopes. Firebase can also observe operational information such as object size, media category, sender and recipient account identifiers, audience type, and timestamps;
• app settings, preferences, usage allowances, entitlement state, username-change timestamps, temporary prior-username holds, rate-limit counters, and other anti-abuse or account-integrity records.

If you begin as a guest and then complete your first sign-in on that device, Vignetra automatically associates the clean guest namespace with that account. Supported local titles, notes, locations, and viewed history can then participate in the account’s normal metadata sync. Face names, face vectors, crops, groups, and recognition data stay on the device. If local data is already bound to a different account, Vignetra erases that account-bound local namespace before opening another account rather than merging identities.

3.6 Service, network, and advertising information

When you use online account, map, support, or website features, Vignetra and its service providers may automatically process standard request information such as IP address, approximate region derived from IP, device and operating-system type, app or browser version, timestamps, language, requested endpoint or map tile, authentication and App Check tokens, and security or error logs.

The mobile app creates a random, pseudonymous installation identifier kept in that device’s protected storage and sends a limited foreground-activity heartbeat while the app is open. Vignetra uses it only to calculate internal operational totals: distinct active app installations in the last 30 days, distinct active installations in the last 24 hours, and installations recently foregrounded. This applies whether or not you sign in. The private administrator dashboard does not receive your account identity, photo library, moments, notes, search text or results, face data, advertising identifier, device name, precise location, or country from this measurement. Vignetra does not request location permission for it and does not use it for advertising, profiling, or cross-app tracking.

Vignetra may initialize Google’s User Messaging Platform and Google Mobile Ads SDK for designated, non-sensitive surfaces without an account or sign-in age check. Vignetra does not use login-age eligibility to classify, enable, disable, or reconfigure advertising. Google Mobile Ads age-treatment flags remain unspecified or at their default for every user, and Vignetra applies a global G content ceiling. On iOS, App Tracking Transparency is a separate advertising-consent choice and is not age verification. Google may process an IP address (which can estimate general location), device and advertising identifiers, ad-impression and other ad-interaction information, app-interaction information, crash logs, and performance data for ad delivery, measurement, fraud prevention, analytics, and—where permitted by the independent UMP and ATT choices—ad personalization. Vignetra does not send Google your photo library, local face data, visual-search text or results, account profile details, friend graph, notes, location corrections, or encrypted moment and card content for advertising.

4. Advertising and privacy choices

Ads help fund Vignetra. Ad delivery is available regardless of whether login-age eligibility is unknown, under 13, or 13+, and declining a privacy choice never limits your moments, friends, or privacy controls. Login-age eligibility controls only provider authentication and account, cloud, social, and account-notification access. It does not classify, enable, disable, personalize, or otherwise reconfigure ads or ATT. Google Mobile Ads age-treatment flags remain unspecified or at their default for everyone, and all requests use a global G content ceiling.

On iOS, ATT remains integrated while Vignetra includes advertising, and no login-age or account state suppresses the request. Vignetra asks through Apple’s system App Tracking Transparency dialog whenever its status is not determined: after the Photos choice while the final onboarding step remains visible, or later when Home appears if the choice is still undetermined. The operating system, region, account settings, or device restrictions determine whether the prompt is available and can appear; Apple may not present it again after it is answered or restricted. ATT is not part of sign-in: it controls tracking permission, does not verify age, and does not make someone eligible for an online account. If you choose “Ask App Not to Track,” or the system denies or restricts permission, Vignetra does not access that identifier. Ads continue under the resulting consent state, so you may still see non-personalized, limited, or technically delivered ads as permitted by applicable law and Google’s ad-serving controls.

For users in places where advertising consent or opt-out choices are required, Vignetra uses Google’s User Messaging Platform to present the applicable message before requesting ads. When Google requires an ongoing choice entry point, you can return to Privacy → Ad privacy choices in the app to review or change that choice. Google’s own information about how it uses data when you use its partners’ apps is available at How Google uses information from sites or apps that use its services.

5. How information is used

Vignetra uses information to:

• provide moments, timeline, map, typed or voice-assisted visual search, local familiar-face grouping, private friend sharing, photo cards, nested notes, hearts, notifications, titles, and other features you request;
• create and secure an optional account, display your public profile basics, enforce first-name, About, unique-username, protected-name, and change-limit rules, sync supported metadata, and help restore private-sharing access on a compatible device without displaying a recovery code;
• show relevant dates, locations, and calendar context where authorized;
• process account deletion, privacy requests, subscription validation, and customer support;
• serve, measure, secure, and—only where permitted by the applicable consent and platform choices—personalize advertising;
• maintain security, prevent fraud and abuse, diagnose failures, and protect the Service and its users;
• understand aggregated app-installation activity and current foreground availability for service operations, capacity planning, and reliability; and
• comply with legal obligations and enforce the Terms of Use;
• improve performance and reliability using aggregated or de-identified information where reasonably possible.

Vignetra does not sell your photo library, local face data, or encrypted private moment content, and does not use those materials to train a general-purpose model or target ads. Where personalized advertising is permitted by the applicable consent and platform choices, Google’s ad technology may use advertising-related data as described above.

6. Legal bases for processing

Where laws such as the GDPR or UK GDPR require a legal basis, Vignetra relies on:

• Performance of a contract to provide requested app, account, metadata-sync, support, and purchase features.
• Consent for system permissions, optional people grouping, and other processing where the law requires consent. You can withdraw consent through the app or system settings, although this does not make earlier lawful processing unlawful.
• Consent or opt-out choices for advertising where applicable, including the Apple App Tracking Transparency choice and Google consent messages. Google may use other lawful bases for strictly necessary ad delivery, security, and fraud prevention where law permits.
• Legitimate interests in securing the Service, preventing abuse, troubleshooting, enforcing rights, and improving reliability, balanced against your rights.
• Legal obligations when processing is necessary to comply with applicable law, a valid legal request, tax, accounting, or consumer-protection duties.

7. When information is disclosed

Vignetra does not disclose your information to data brokers. Information may be disclosed in these limited circumstances:

Service providers may use information only to perform services for Vignetra under contractual or legal restrictions. Open-source libraries running locally do not receive your information merely because their code is included in the app.

8. Face-related and potentially biometric data

When “People in your moments” is enabled, Vignetra uses platform face-detection technology and a local similarity model to detect face regions, create numerical feature representations, and group faces that appear similar. You can review a group and assign a name, ignore it, or remove a name.

• This feature is for organizing your own authorized library, not for authentication, surveillance, or identifying a person against a public or shared database.
• Face images, feature representations, similarity groups, persistent local identifiers, and the local name directory remain on the device and are not synced to Vignetra accounts. A name you deliberately include with a shared moment may be copied into that moment as an encrypted, share-scoped label for its chosen audience.
• Vignetra does not sell, rent, disclose, or use this data to identify anyone for another user.
• Choosing Turn off stops finding and grouping new faces while keeping saved local groups and names available for private search. Choosing Turn off and remove also erases the saved face groups, feature data, and names from Vignetra’s local database. Neither option changes your original photos or videos.

Depending on where you live, face feature representations may be treated as biometric or sensitive information. Only enable this feature for media you are entitled to process, and do not add a person’s name where doing so would violate their rights or applicable law.

9. Retention and deletion

• Local app data remains until it is replaced through normal indexing, you use a relevant deletion or feature-off control, clear app data, or remove the app. The operating system may preserve certain device backups according to your system settings.
• Account metadata generally remains while your account is active. Using “Delete account” requests deletion of the Firebase account and associated Vignetra cloud metadata, and clears Vignetra’s local indexes on that device.
• Anonymous installation activity uses a random installation identifier separate from an account. The current installation record is deleted after 31 days without a heartbeat. A daily activity marker containing that same pseudonymous identifier is deleted after 93 days. The private dashboard retains only the resulting limited date-range counts while the markers exist; it does not show per-installation histories.
• Age-eligibility records contain only an under-13 or 13+ result, declaration method, and check date—not the entered birth date. The result is a self-declaration rather than proof of age and is scoped to the person using the device; ordinary provider logout does not by itself change that person. A 13+ result expires after 365 days, and an under-13 result expires after 31 days. Device erasure, account deletion, and detected fresh-install recovery also clear it. A legacy result that does not establish 13+ eligibility is never accepted for sign-in and must be checked again.
• Encrypted shares remain until the owner deletes the share, removes a recipient, the account is deleted, or an operational retention period expires. Owners choose whether Vignetra permits recipients to save or export a copy. Deleting a share removes the encrypted service copy and access records, but cannot remove copies a recipient previously saved with permission or captured using device or external tools.
• Safety reports contain the reporting and reported account identifiers, reason category, optional description, and optional item identifier. Account and friend-request reports are metadata-only. A report about a moment, card, or note includes that exact reported item as private evidence and immediately removes it from the reporter's feed and access while it is reviewed. Evidence is copied into an isolated encrypted safety-evidence store, can be opened only by authorized verified reviewers for a recorded case reason, and is normally deleted 30 days after case closure unless a documented extension of up to one year, legal preservation obligation, or active investigation requires longer. Evidence access, case opening, and review outcomes are logged. To protect the reporting system, we also store reporting-rate, duplicate-report, and reviewer-confirmed misuse records; a report that is not upheld alone does not establish misuse. When a reviewer explicitly confirms a policy violation, we keep a reviewer-only repeat-offender record containing the linked case, action, escalation level, and internal note. Account deletion remains available while a restriction or closure is active. Ordinary account and product data is deleted, while narrowly limited safety or fraud-prevention records may be retained separately where lawful. To prevent deletion from bypassing an active action, Vignetra may retain one-way Apple or Google provider-identity fingerprints, a separately keyed one-way verified-email fingerprint, and the minimal action state. The retained record does not contain the provider subject, deleted account UID, raw email, name, photos, or ordinary profile content. Temporary-action fingerprints are deleted when the action expires; closure records remain only for the duration reasonably necessary and legally permitted to enforce the closure.
• Security, legal, and backup records may remain for a limited period where technically necessary, required by law, or reasonably needed to prevent fraud, resolve disputes, enforce agreements, or document compliance. They are isolated from ordinary product use where feasible.
• Support communications are retained only as long as reasonably necessary to address the request, maintain support history, comply with law, and protect legal rights.

Deleting a Vignetra account or local index never deletes original media from your system photo library. Deleting an Apple or Google account, or changing an email-account password, does not automatically delete the separate Vignetra account; use Vignetra’s in-app deletion control or contact us.

10. Your choices and privacy rights

In-app and device controls

• Use Vignetra as a guest without creating an account.
• Complete the neutral, self-declared 13+ eligibility warning before online sign-in. The entered date of birth is not stored by Vignetra, and the declaration is not proof of age.
• Choose full or selected photo access and change permissions in system settings.
• Authorize or deny calendar access separately.
• Turn People off while retaining saved names for private search, or choose Turn off and remove to erase local face-related data.
• Allow or deny microphone and speech-recognition access in system settings, and use typed search without voice input.
• Choose whether to invoke Vignetra with Siri or Shortcuts; typed Ask Your Life search works without either feature.
• On iOS, choose whether to allow app tracking in Apple’s system prompt or later in iOS Settings. Where shown, open Privacy → Ad privacy choices to review or change the Google advertising consent choices that apply to you.
• Add, crop, replace, or remove a profile photo; edit your About line; and change your first name or an available username subject to displayed cooldown and anti-abuse limits.
• Edit or remove titles, notes, names, and corrected locations.
• Accept, ignore, or block friend requests; privately review your friend list; remove, silence, resume, or block friends; choose All friends or Selected friends for each share; allow or prevent saving and export; change access; delete a shared moment or card; edit or delete your own shared notes; and turn hearts on or off.
• Log out and choose the local-data behavior offered by the app.
• Delete your account and associated Vignetra metadata from the Privacy section.
• Request correction of an age-eligibility error or deletion of associated information through privacy@vignetra.com. Vignetra does not provide a guardian-approval override for an under-13 account.

Legal rights

Depending on your location, you may have rights to access, know about, correct, delete, restrict, object to, or obtain a portable copy of personal information; withdraw consent; opt out of certain sales, sharing, profiling, or targeted advertising; and appeal a refusal. Vignetra does not use your photo library, local face data, or encrypted sharing content for advertising or conduct legally significant automated decision-making. You can use the advertising controls described above, and can contact us to exercise other applicable rights.

Send a request to privacy@vignetra.com. Describe the right you want to exercise and the account email or username involved. We may need to verify that you control the account. Authorized agents must provide proof of authority, and we may verify the request directly with the account holder. We will not discriminate against you for exercising a privacy right.

You may also complain to your local privacy or data-protection authority. California residents may request the categories and specific pieces of personal information Vignetra holds, sources, purposes, recipients, correction, and deletion as provided by law. EEA, UK, and Swiss residents may contact their supervisory authority and may object to processing based on legitimate interests.

11. Security

Vignetra uses safeguards intended to protect information, including platform permission controls, local app storage, secure token storage, Firebase Authentication, Firebase App Check, deny-by-default Firestore and Storage rules, server-side validation, abuse limits, and client-side encryption for selected private shares. Each recipient receives a separately wrapped content key. Explicitly submitted safety evidence is segregated from ordinary shared-media storage; its decryption key is protected by Google Cloud Key Management Service, reviewer access requires a verified authorized account, and each access is audited.

End-to-end encryption protects shared content in transit and while stored, but it cannot prevent an authorized recipient from saving, photographing, or otherwise copying what they can see. No storage or transmission method is perfectly secure. Protect your device and sign-in account or credentials, install updates, and contact us promptly if you believe your Vignetra account has been compromised. Because Vignetra does not possess the plaintext private-sharing secret, access to existing encrypted shares may need to be re-established when secure device data is unavailable.

12. International processing

Vignetra and its providers may process account and service information in the United States and other countries where they operate. Those countries may have different data-protection laws. Where required, Vignetra relies on approved contractual safeguards, adequacy decisions, provider certifications, or another lawful transfer mechanism. Mandatory local rights remain available.

13. Children

Vignetra’s online account, cloud, and social features are intended for people age 13 or over. The private local guest experience begins without collecting age or creating an account. Immediately before account creation or sign-in through Apple, Google, or email/password, Vignetra evaluates a date entered on the device only to determine whether the declaration is under 13 or 13+; Vignetra does not store the entered date. This is a self-declared eligibility warning, not proof of age, and the declaration relies on information supplied by the person and does not independently verify identity or guarantee accuracy.

An under-13 declaration cannot create or enter an online account, use cloud sync or social features, or register account notifications. The authentication attempt ends and the person returns to the private local guest experience; no account is created through that attempt. A person who declares they are age 13 or over may continue to authentication and online features. Vignetra does not operate a guardian-approval override for an under-13 account.

Advertising and ATT operate independently of that login-age result and remain available whether eligibility is unknown, under 13, or 13+, subject to the user’s privacy choices and system or regional availability. Google Mobile Ads age-treatment flags remain unspecified/default for every user, and a global G content ceiling applies. Google’s User Messaging Platform and, on iOS, Apple’s App Tracking Transparency choice independently govern advertising consent and permitted personalization. Those choices are advertising consent, not age verification.

Do not provide a false birth date or use another person’s account session to bypass the online-account gate. If you believe a child under 13 created an account or provided information, or an age-eligibility result is incorrect, contact privacy@vignetra.com so we can investigate, disable online access, correct the record, and delete information where appropriate. See the Age Requirement page for a concise summary. Local laws may impose a higher age or additional consent requirements; Vignetra may restrict online features where required while those requirements are assessed.

14. This website and cookies

This landing site is hosted on Firebase Hosting. At launch, Vignetra does not place advertising cookies, analytics cookies, or cross-site tracking pixels on this site. The hosting service may process standard request logs such as IP address, user agent, requested URL, response status, and timestamp for delivery, reliability, abuse prevention, and security.

Email links open your selected email service, whose privacy practices are independent. If Vignetra later adds optional analytics, a mailing-list form, or non-essential cookies, this policy and any required consent controls will be updated before those tools are enabled.

15. Changes to this policy

We may update this policy as Vignetra evolves or legal requirements change. The “Last updated” date will change, and material changes will be highlighted in the app, on this site, or by another appropriate notice before they take effect where required. Continued use after the effective date is subject to the updated policy, but Vignetra will request fresh consent where law requires it.

For questions or requests, email privacy@vignetra.com. You can also review the Terms of Use, Accessibility Statement, or Support page.