Privacy Policy
Gallery: Photo Vault & Cloud (package com.glim.gallery) · Effective date: 7 October 2026
This Privacy Policy explains how Virnit Automation ("we", "us") handles information when you use the Gallery: Photo Vault & Cloud app (the "App"). We built the App so that your photos stay yours: they are processed on your phone, and anything you choose to back up is encrypted on your phone before it leaves, so we cannot open it.
- Your photos and videos stay on your device. The App does not upload anything unless you choose Cloud Backup.
- Cloud Backup is end-to-end encrypted: photos and videos are encrypted on your phone with a key that only your password unlocks. Our servers store only encrypted data, so we cannot see, open or analyse your photos and videos.
- Smart features (search inside photos, people, objects) run entirely on your phone.
- Items you lock in the Private Vault are encrypted with AES-256 on your device; only your PIN, pattern or fingerprint opens them.
- We never sell your personal data.
- The App shows ads (Google AdMob, with the ad partners Meta Audience Network, Pangle and Liftoff Monetize) and uses Google Firebase for app stability, usage statistics and notifications, as described below.
1. Information that stays on your device
Photos and videos
To show your gallery, the App reads the photos and videos on your device through Android's media permissions. Browsing, albums, favourites, editing, the recycle bin, the cleaner, memories and slideshows all work on the device. None of these files are sent to us.
Smart features
Text search inside photos, face grouping ("People") and object labels use Google ML Kit models that run on your device. The results are stored only in the App's private storage on your phone and are deleted when you uninstall the App.
Location in photos
If you allow it, the App reads the location saved inside your photos (EXIF data) to show them on the "Places" map and in photo details. This is done on your device; we do not collect your location or the location of your photos.
Private Vault
Files you move to the Vault are encrypted on your device with AES-256. The encryption key is protected by the Android Keystore and unlocked by your PIN, pattern or biometrics. We cannot open Vault files, and we cannot recover them if you forget your PIN and recovery answer.
2. Cloud Backup (optional)
Cloud Backup is off until you create an account and choose files to upload.
| What we receive | Why |
|---|---|
| Email address, name and password, or your Google account email and name if you choose "Continue with Google" | To create and secure your account, verify your email and reset your password. Passwords are stored only in hashed form. With Google sign-in we receive only the basic profile Google shares (email, name); never your Google password. |
| The photos and videos you choose to upload and their thumbnails, encrypted on your phone, plus the file name, size, type and dates in readable form | To store them for you and let you list, search, view, download and manage them from the App. |
| Your encryption key, locked with your password (or backup password), plus a second copy locked with your recovery key | So your other devices can open your backups after you sign in. We cannot unlock either copy. |
| Device sign-in records (device name, last used) | So you can see and sign out the devices that use your account. |
End-to-end encryption: before a photo or video leaves your phone, the App encrypts it (AES-256) with a key that belongs to your account. That key is itself locked with your password before it is stored on our servers, so only you, signed in with your password, can unlock it. Our servers only ever receive and store encrypted data, and connections additionally use HTTPS/TLS. Your sign-in token and key are kept encrypted on your phone with the Android Keystore.
We cannot look at your files. Because we never have your key, we cannot view, scan, analyse, train models on or share the content of your photos and videos, even if asked to. We can see only the information needed to run the service: file names, sizes, types, dates and how much storage you use.
Recovery key: when you set up Cloud Backup the App shows you a recovery key once. Keep it safe: it is the second way to unlock your backups. We never see it and cannot show it again; you can create a new one in Cloud → Account.
Google sign-in: a Google account has no Cloud password, so the App asks you to create a backup password that locks your key in the same way.
Forgotten password: because we cannot unlock your key, a password reset does not unlock earlier backups by itself. On a phone where you used Cloud before, the App keeps them readable automatically. On a new phone it asks once for your previous password or your recovery key; if you have neither, you can start fresh, and files backed up before the reset can no longer be opened. Changing your password while signed in keeps all your files readable.
Uploading is free of charge. Before an upload starts, the App may offer an optional rewarded video ad; watching it is your choice.
3. Advertising
The App is free and is supported by ads served by Google AdMob. AdMob may also fill ads through its mediation partners Meta Audience Network (Meta Platforms), Pangle (ByteDance) and Liftoff Monetize (Liftoff / Vungle). To show and measure ads, AdMob and these partners may collect your device's advertising ID, IP address, approximate location derived from the IP, device and app information, and ad interactions. In the European Economic Area, the United Kingdom and Switzerland we ask for your consent through Google's consent form (a certified consent management platform) before personalised ads are shown; you can change your choice at any time in Settings → Privacy options. You can also reset or delete your advertising ID in your device settings.
Ads are never placed on top of your photos in a way that shares their content; ad networks do not receive your photos or videos.
When ads are enabled, the App checks at start-up that it can reach the ad service; it may ask you to turn on the internet or turn off an ad blocker. This check happens on your device and nothing about it is sent to us.
Learn more: Google · Meta · Pangle · Liftoff.
4. App statistics, crash reports and notifications
- Firebase Analytics collects pseudonymous usage events (for example, app opens and screens viewed), device model, OS version, app version and an app instance ID, so we can understand how the App is used and improve it.
- Firebase Crashlytics collects crash reports (stack traces, device model, OS version) so we can fix bugs.
- Firebase Remote Config downloads App settings; it does not collect personal content.
- Firebase Cloud Messaging uses a device token to deliver push notifications about news and updates.
- Reminders (memories, new photos, cleanup suggestions; at most 3 a day and only after a day without opening the App) are created on your device from your own gallery; their content is never sent to us. You can turn them off in Settings or in Android's notification settings.
None of these services receive your photos or videos. See Firebase privacy information.
5. Permissions the App asks for
| Permission | Used for |
|---|---|
| Photos and videos (all or selected) | Showing, organising, editing and, only if you choose, backing up your media. |
| Media location | Reading the location saved in your photos for the Places map and photo details, on the device. |
| Manage media (optional) | Moving, renaming and deleting files with fewer confirmation pop-ups. |
| Notifications | Upload progress, reminders and news. |
| Biometrics | Unlocking the Vault and app lock with your fingerprint or face. |
| Internet, network state, foreground service (data sync) | Cloud Backup uploads and downloads, ads and app settings. |
| Run at start-up | Restoring the optional quick-access notification after your phone restarts. |
6. Sharing
We do not sell or rent your personal information. We share data only with the service providers named in this policy (Google AdMob and its mediation partners Meta Audience Network, Pangle and Liftoff Monetize, Google Firebase, Google Sign-In and our cloud hosting provider), who process it on our behalf, and when required by law. When you use "Share" in the App, the file goes to the app you pick; that app's privacy policy applies.
7. Data retention and deletion
- Data on your device is removed when you delete it in the App or uninstall the App.
- Cloud files you delete in the App are removed from our servers.
- Deleting your account: in the App go to Cloud → Account → Delete account, or use storage-api.thehmv.com/account/delete (works without the App). Your account, every backed-up file, folders, signed-in devices and your encryption key are deleted permanently. You can also email support@virnitautomation.top from the address you signed up with.
- Analytics and crash data are kept for no longer than 14 months; advertising data is handled under Google's retention policies.
8. Children
The App is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect personal information from them. If you believe a child has created a Cloud account, contact us and we will delete it.
9. Your rights
Depending on where you live (for example under the GDPR, the UK GDPR or the CCPA/CPRA), you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent. To exercise these rights, contact us at the email below. You may also complain to your local data protection authority.
Our legal bases are: performing our contract with you (Cloud Backup), your consent (personalised ads, notifications) and our legitimate interest in keeping the App secure and working (crash reports, statistics).
10. Security and international transfers
We use end-to-end encryption for Cloud Backup, encryption in transit (HTTPS/TLS), access controls and the Android Keystore to protect your data. No method of storage or transmission is 100% secure, but we work to protect your information. Our service providers may process data in countries other than yours; when they do, they use safeguards required by law, such as Standard Contractual Clauses.
11. Changes to this policy
We may update this policy. We will change the effective date above and, for important changes, tell you in the App.
12. Contact
Virnit Automation
Email: support@virnitautomation.top