Privacy Policy
1. Introduction and who we are
The controller of your personal data is: Tarfion Ltd, Griva Digeni 59, Kaimakliotis Building, 5th Floor, 6043 Larnaca, Cyprus
Contacts: [email protected]
This Policy explains how Tarfion Ltd ("we," "us") collects, uses, and protects your data when you use Scruby Cleaner (the "App").
This Policy should be read together with our Terms of Use. By creating an account or using the Service, you confirm that you have read this Policy.
2. What we collect, what for, and our legal basis
Each permission below is optional, is requested only when the related feature is first used, and can be withdrawn at any time in your device settings.
| What data we collect | What for | Legal basis we rely on |
|---|---|---|
| Photo, video & screenshot metadata Locally on your device | Duplicate images search, clutter detection, on-device video compression | Terms of Use performance (core feature) |
| Text in screenshots Locally on your device | Sorting screenshots by type and keeping short results (codes, tickets, Wi-Fi names and passwords, addresses) in the App's notebook. The text is read on your device (Apple Vision on iOS, Google ML Kit on Android) and is never uploaded | Terms of Use performance |
| Contacts Locally on your device | Your contact list management, deduplication and incomplete entries. Contacts are processed on your device and are never uploaded | Consent; Terms of Use performance |
| Account data (optional): email address, user ID; if you use Sign in with Apple, the identifier Apple provides | Creating and keeping your account, restoring your subscription across devices | Contract performance |
| Protected folder password Locally on your device | Securing your protected folder. | Terms of Use performance |
| Device & usage data: device type, OS version, language, an app-generated install ID, feature-usage events and aggregated cleanup statistics (counts and sizes, never file names or content), and your approximate location (country and city) derived from your IP address | Operating, maintaining, and improving the App | Legitimate interest |
| Diagnostics: crash logs and error reports | Bug fixing and stability | Legitimate interest |
| Push token | Trial and subscription renewal reminders | Consent |
| Subscription and billing status: plan, status, renewal date, purchase history. Billing itself is handled by Apple and Google; we do not receive your payment details | Processing your subscription | Contract performance |
| Support correspondence | Responding to your requests | Contract performance / Legitimate interest |
Tracking. The App does not use the advertising identifier (IDFA on iOS, the Advertising ID on Android) and does not show ads. On iOS the App may ask for your permission through Apple's App Tracking Transparency prompt. Only if you allow tracking, we may share the fact that you installed the App or bought a subscription, together with pseudonymous identifiers, with our advertising partners (such as Meta) to measure our advertising. If you do not allow it, we do not share this data with advertising partners. You can change your choice at any time in iOS Settings › Privacy & Security › Tracking.
We also rely on legal obligation when processing data for tax and accounting records, age restrictions, responding to legal requests and handling complaints.
3. Who we share data with
We do not sell your personal data. We share it only with service providers, including SDKs, who process it on our behalf under the respective contract and following privacy commitments, and only as needed:
- Hosting and infrastructure — Google Cloud (Cloud Run, Cloud SQL), Cloudflare (DNS, TLS, CDN)
- Analytics and crash reporting — Sentry, Google Cloud logs and metrics, BigQuery
- Authentication — Firebase Authentication, Sign in with Apple
- Push notifications — Firebase Cloud Messaging (Google)
- On-device text recognition (Android) — Google ML Kit. Screenshots and their text stay on your device; ML Kit sends Google technical usage and performance metrics (such as the API used, processing time, SDK version and device model)
- App stores — Apple (App Store) and Google (Google Play) for purchases and subscriptions
We may also share data with:
- Law enforcement and authorities: when required by law, legal process, or to protect user safety.
- Affiliates and corporate entities: for internal operations, auditing, and in the context of mergers, acquisitions, or corporate restructuring. In such cases, the acquiring entity will be bound by the terms of this Policy.
4. How long we keep data
We keep your data only as long as needed, particularly:
- Account data - while your account is active, and deleted within 30 days of deletion request.
- Technical logs and diagnostics - up to 90 days.
- Support correspondence - up to 3 years.
We may retain certain types of Account, Technical logs and Support correspondence data beyond the periods above where we still need it for lawful purposes: to establish, exercise or defend legal claims; to handle a complaint, dispute, audit or investigation; and to comply with a legal, regulatory, or accounting obligation; or to prevent, detect and address fraud, abuse, or security incident.
We may also keep aggregated (the data that does not contain personal identifiers) for internal analytics and statistics, as well as to evaluate our products.
5. Your rights and choices
5.1 Deleting your account
You can delete your account and all associated data at any time in the app settings.
You can also delete your account by email: write to [email protected] and we will process your request.
Please note: Deleting your account does not automatically cancel a subscription. If you subscribed through Apple or Google, cancel it in your App Store or Google Play account settings. If you subscribed on our website, cancel it in your account settings on the website or by writing to support.
5.2 EU/EEA Rights (GDPR)
If you are in the European Economic Area, you have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of personal data we hold about you |
| Rectification | Request correction of inaccurate or incomplete data |
| Erasure | Request deletion of your personal data |
| Restriction | Request we temporarily stop processing your data |
| Portability | Receive your data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interest |
| Complaint | Lodge a complaint with a supervisory authority |
| Withdraw Consent | Withdraw consent at any time |
5.3 UK Citizens Rights Under UK GDPR Addendum
This section provides details about individuals residing in the United Kingdom and details additional rights they have under the United Kingdom Data Protection Act 2018 (DPA) and the EU General Data Protection Regulation (GDPR) which is retained EU law after Brexit. Therefore, this section applies only to UK residents.
Your Rights and Choices in the UK
As a UK resident, You have the rights in relation to Your Personal Data under this Privacy Notice, including:
Right to be informed: You have the right to be provided with clear, transparent, and easily understandable information about how we use your personal data and your rights. This is why we’re providing you with the information in this Addendum.
Right of access: You have the right to obtain access to your personal data (if we’re processing it) and certain other information (similar to that provided in this Privacy Notice). This is so you’re aware and can check that we’re using your personal data in accordance with data protection law.
Right to rectification: You are entitled to have your personal data corrected if it’s inaccurate or incomplete.
Right to erasure: This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there’s no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.
Right to restrict processing: You have the right to ‘block’ or suppress further use of your personal data in certain circumstances. When processing is restricted, we can still store your personal data, but may not use it further.
Right to data portability: You have the right to obtain and reuse your personal data in a structured, commonly used, and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.
Right to object to processing: You have the right to object to us processing your personal data for our legitimate interests or for direct marketing purposes (including in each case any related profiling).
Right to withdraw consent: If we have obtained your consent to process your personal data for certain activities (for example, for optional features that rely on your consent), or consent to market to you, you may withdraw your consent at any time.
Rights related to automated decision-making and profiling: You have the right not to be subject to a decision when it’s based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for entering into, or the performance of, a contract between you and us.
To exercise any of these rights at any time, please contact our Customer Support.
5.4 US Rights (CCPA/CPRA and State Privacy Laws)
If you are a resident of California or another US state with applicable privacy legislation, you have the following rights:
Right to Know — request details about categories and specific pieces of personal information we collect, purposes, sources, and third-party recipients.
Right to Delete — request deletion of your personal information, subject to certain legal exceptions.
Right to Correct — request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing — opt out of the "sale" or "sharing" of your personal information as defined under applicable law.
Do Not Sell or Share My Personal Information
We do not sell your personal information and do not share it for cross-context behavioral advertising, as these terms are defined under the CCPA/CPRA and similar state laws. If you have questions about this, contact our Customer Support with the subject line "CCPA Request".
California also provides its residents with additional access rights. Under Shine the Light law, the residents may ask companies once a year what Personal Data they share with third parties for those third parties' direct marketing purposes.
To obtain this information from us, please send an email message to our Customer Support, which includes “Request for California Shine the Light Privacy Information” on the subject line and your state of residence and email address in the body of your message. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing will be included in our response.
These rights also apply, to the extent provided by their respective laws, to residents of: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and Oregon (OCPA).
6. How we secure you data and transfer it
6.1. Security
When you give us to process your personal data, we take steps to make sure that it’s treated securely.
Non-sensitive details (such as your email address) are sent normally over the Internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect personal data, we cannot guarantee the security of any personal data user transmit to Us, and You do so at Your own risk. Once we receive personal data, we make our best effort to ensure its security on our systems.
We use industry-standard encryption to protect personal data in transit. This is commonly referred to as transport layer security (“TLS”) or secure socket layer (“SSL”) technology.
Once we receive personal data, we protect it on our servers using a combination of technical, physical, and logical security safeguards.
6.2. Data Transfer mechanisms we rely on
In most cases, your data is processed within the territory of the European Economic Area (EEA). When we transmit your personal data beyond the EU/EEA, we rely on Standard Contractual Clauses approved by the European Commission, or, where a recipient is certified under it, the EU-US Data Privacy Framework, together with contractual confidentiality obligations. Your photos, videos, contacts and the text in your screenshots are processed on your device and are not transferred anywhere.
All and any transfer of the personal data is done only for the purposes specified in this Policy and the Terms of Use.
7. Age
The App is suitable for all ages and can be used without an account. The optional account is intended for users aged 16 and over (or the age of digital consent in your country, if higher). We do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us at [email protected] and we will delete it.
8. Changes to this Policy
We will notify of material changes via the App and by email where appropriate.