Privacy notice

Who is responsible

Firelet.Media, of Islamabad, Pakistan, is the controller of the personal data described here — an individual rather than a company, so the person answering a request under this notice is the same person responsible for it. Questions, and any request under this notice, go to support@firelet.media or through the support form.

Payments are a separate matter. Paddle is the merchant of record for purchases made here and is its own controller for the payment. Paddle collects and holds the card details and the billing address; we never see them, and never hold them. Paddle's privacy notice is at paddle.com/legal/privacy.

The gallery, on your own PC

Nothing from your library is uploaded. The gallery reads folders you point it at and builds an index beside itself, under your own user directory. Your photographs, the index, the thumbnails and the picture-understanding model all stay on your machine. There is no account to make, no cloud to be on, and no upload step that could be left switched on by accident. The program searches nothing on the internet.

Five things do travel, and this is all of them:

• Activating and re-checking a licence. The program sends your licence key, the product family, the version it is running, an optional name you gave the machine, and a 64-character hash that identifies the machine. That hash is computed and salted on your own PC: it tells us that this is the same machine as last time and nothing else about it. The re-check happens about once a month.
• Asking for the trial rules. While the gallery is on its free trial it asks firelet.media for the trial's length and the current time. Nothing about the machine or your library goes with it; like every request, it arrives from your IP address with the program's name and version, and those are recorded — see Security and fraud prevention.
• Checking for a new release. The version you are running, so the server can say whether a newer one exists.
• A crash report, when it crashes. The program version, the platform, the Windows version, the architecture, the kind of failure, the module it happened in, the error message and a stack trace. No file names from your library, no image data and no account details are attached.
• Counters, if you switch them on. Usage counters are off unless you turn them on, and they are counts of things done rather than a record of what you did. The switch is in your account and takes effect immediately.

The gallery on your Android phone

The phone app uploads nothing of yours to us. It reads the photos and videos already on the phone, through Android's own media permission, and keeps its index, thumbnails, albums, marks and edits on the phone. It has no account, no analytics and no advertising, and no crash reporting apart from the camera effects' problem reports while those effects are in beta. It talks to this site's servers only about those reports, a subscription or a licence key, as described below.

These leave the phone, and each goes straight to the service named, never to us:

• Place names, if you switch them on. Off until you turn on "Look up place names" in Settings. When it is on, the coordinates of your photos, as they store them or as you corrected them — rounded to a coarse grid, with no image and no file name — go to BigDataCloud (api.bigdatacloud.net), which answers with a city and a country. Answers are kept on the phone so the same place is never asked twice. Turning the switch off stops it at once.
• Map tiles, when you open the map. The map is drawn from OpenStreetMap's tile servers, which see the address the request comes from and which part of the map is being shown, as any map does.
• The picture-understanding models, once each. When the AI search is set up, the first time the object eraser is used, and when you choose the open-source models for the smart tools, the phone downloads the model's files from Hugging Face and GitHub. Nothing is sent with those downloads beyond an ordinary request for the file.
• Music for memory reels, when you ask for a track. The phone downloads that track from firelet.media, once, with an ordinary request for the file.
• Google's ML Kit, for the smart tools, unless you choose otherwise. By default, reading the text in photos, scanning documents, lifting a subject out of a picture and the camera's warning about closed eyes use Google's ML Kit, through Google Play services. For that warning ML Kit only finds faces and whether their eyes are open; it does not recognise anyone, and nothing about the faces is kept. The pictures are processed on the phone and are not sent to Google. Play services downloads these tools from Google the first time they are needed, and ML Kit sends Google figures about how they perform and are used — details of the device and the app, never your pictures or what is in them — under Google's ML Kit terms. In Settings → Privacy you can choose open-source models instead, which run on the phone and send Google nothing; a phone without Google Play services uses them anyway. Reading the text in photos can be switched off there too.
• Google's effect engine, for the camera's effects, unless you choose otherwise. With the same setting on Google (the default), the camera's effects that follow faces, bodies and hands run on Google's MediaPipe library, which Google Play delivers the first time you use one. MediaPipe sends Google figures about how the engine performs and is used (which part ran, how long it took, errors, details of the device and the app), never your pictures, your video or anything found in them, under Google's MediaPipe terms. The camera tells you this and asks before the first such effect. With the open-source models chosen, the same effects run on the app's own code and send Google nothing. Either way, the effects' model files are downloaded once from Google's model storage, with an ordinary request for each file.

Only these come to us, and only when you use them:

• Your subscription, if you subscribe in the app. Google Play takes the payment; we never see your card. The phone then sends us the purchase token Google gave it, we check it with Google, and we answer with a licence key for your computers. We keep that token, the key, and the subscription's state as Google reports it (active, renewing, cancelled, ended), and Google tells us when that changes.
• A licence key, if you type one. The phone sends the key, a random number that identifies the phone to us and nothing else, and the phone's model name, and we answer with a signed unlock. We keep those and when the phone last checked in, so that one key cannot unlock an unlimited number of phones.
• Your email address, only if you ask for the key by email. We send the key to it and open an account for it, exactly as for a purchase on this site (see below).
• Problem reports from the camera's effects, while they are in beta. The camera sends us a report by itself when an effect fails; when a part of an effect engine will not download, install or start; when the open-source engine has to fall back to its slower way of working on your phone; when effects run very slowly; or when the app crashes or freezes while effects are on, in which case the report goes the next time the app starts. A report holds the app's version, the phone's make and model, its Android version, its processor type and graphics chip, which engine and which effects were on, how fast they were running, and the error with its technical trace — and, when Google Play could not deliver a part of the engine, the error code Play gave. It never holds a picture or a video, the points found on faces, bodies or hands, the outline of a person, a file name, or your account, your licence or any identifier of the phone, and it is not linked to an account. We delete each report 180 days after it reaches us. To stop them, turn off "Effect problem reports" in the camera's own settings (the settings panel on the camera screen); the same switch is in the "Effects are in beta" sheet that opens when you tap the BETA label on the effects tray.

The Wi-Fi link stays on your own network. Pairing the phone with firelet on your PC, browsing one from the other and sending files between them happen directly between the two devices over an encrypted connection — nothing goes through the internet or through us. Backing up the phone's photos and videos to your PC goes the same way, to that PC only, along with their stars, albums and any date or place you corrected on the phone. What the phone keeps about a paired PC (its name, its key, and whether its licence or trial is current) stays on the phone and is forgotten when you remove the pairing. A pairing code that reaches the app from a web page or another app pairs only after you confirm it. The camera is used to scan the pairing code, and by Google's document scanner when you scan paper (with the open-source models, by your phone's own camera app); the pages are saved on the phone.

Corrections and location files stay on the phone. A date or place you correct is saved in the app; the photo file changes only if you choose to save it into the file. A location file you choose to match photos against (a GPX file, or a Google Timeline or Takeout export) is read on the phone, is not kept afterwards and is not sent anywhere. Only the places you accept are kept, and they are then treated as above: used for place names if that is on, and sent to your PC if you back up.

The camera saves to the phone, and goes further only when you send it. Photos and videos you take with the app's camera are saved in the phone's DCIM/Firelet folder, like any other camera's. The microphone is used only while you record a video, and only if you allow it. Where a photo or video was taken is stored in the file only if you switch on "Save location" in the camera, which is off until you do; then the phone looks for its position only while the camera is open, and that position goes wherever the file goes. Reading a QR code, reading text and finding similar pictures from the camera all happen on the phone, from a picture that is kept in memory and never saved or sent.

Camera effects work on the phone and forget what they see. Effects that follow you (stickers, beauty and makeup, costumes, a blurred or swapped background, the shutter that waits for a smile or a raised hand) find points on faces, bodies and hands, and the outline of the people, in each frame on the phone, only to draw the effect. Those points and outlines are not used to recognise anyone, are not saved with the photo or anywhere else, and are never sent. The camera says so and asks before the first of these effects. A picture you choose as a background is copied, made smaller, into the app's own storage on the phone and stays there until you choose another.

Your PC sees the camera only when you open it for that PC. In the camera's Computer mode the phone sends its live picture to the one paired PC you chose, as that PC's webcam or for tethered shooting, directly over your own network and encrypted. Nothing is sent until you open that mode on the phone: a PC can ask, but only a notification you tap opens it. It stops when you leave the camera, and no sound is sent. A photo taken from the PC is saved on the phone as usual and sent to that PC. On the PC, the picture goes only to the apps Windows lets use its cameras, through Windows's own camera service.

Live streams go to the service you choose. When you go live, the camera's picture and the microphone's sound go to the streaming server you set up (YouTube, Twitch, Facebook, Kick or any other), and that service's own terms and privacy policy apply to the stream and to anyone watching it; we never see or receive it. The server address and stream key you paste are kept only on the phone, locked with the phone's own hardware key, and sent only to that server. If you switch on "Keep a copy", the stream is also saved as a video in DCIM/Firelet on the phone.

Casting to a TV stays on your own network too. When you cast, the phone offers the TV you chose only the picture or video on screen, at a private address that stops working when you stop. Pictures go as a copy with their details removed. A video goes as its file; from Android 12 the phone asks Android to hide its location first, and on older versions anything stored inside the file reaches that TV.

The app is installed and updated by Google Play, which also handles a subscription's payment, renewal and cancellation, under Google's own privacy policy.

The account on this site

Buying creates an account to hold what you bought. It stores:

• Your name and email address.
• Your licences and the machines each is activated on, by that salted hash.
• Your orders — what was bought, when, and for how much. The receipt and the payment itself sit with Paddle.
• Support tickets you open and anything you attach to them.
• Sign-in records, kept so that you and we can spot access you did not make.
• A consent ledger: which optional things you turned on or off, when, and from where. It exists so that a permission can be shown to have been given and withdrawn, which is the point of asking for one.
• Where a purchase came from, if you told us: the tag on the link you followed (for example reddit), a code you used, and your answer to the optional "How did you hear about us?" at the checkout. These name a post or a code, never you.

The two optional email lists

The download page offers trial tips, and the Mac waitlist offers one email when the Mac version is ready. Both are optional — the download never needs an address — and both are double opt-in: we send a link to confirm before anything else, and an address nobody confirms is never mailed again. The trial list sends three tips over the first week, one reminder before the trial ends and a last note on the day; if you then buy, two short notes follow (a request for a review and your referral code). Every one has a one-click unsubscribe. We keep the address, the list, the tag on the link you arrived by, and when you confirmed or left. Legal basis: your consent, which you withdraw by unsubscribing.

The legal basis is the contract between us for everything needed to sell you a licence and let you use it; consent for anything optional; and our legitimate interest in keeping the service secure and free of fraud for the sign-in records and the security records described below.

Sync for the firelet.media player

This does not apply to the gallery. The same account can also sync the library of our separate media player between your own devices, for people who use that program. It is off until you switch it on, separately and explicitly, and switching it off is one click on the same screen. When it is on, the entries you sync and the thumbnails that go with them are stored for you; when it is off, none of it is collected at all.

Cookies

This marketing site sets no cookies and runs no analytics. The only things stored in your browser are the light-or-dark choice you made with the theme button, which never leaves it, and the site's language. The language is kept exactly like the theme — in your browser, not in a cookie, and never sent anywhere — whether you picked it from the language menu or it was set on your first visit from the language your browser asks for.

Downloading the installer adds one to a daily total for that version, and the download is also recorded with the address it came from — see Security and fraud prevention.

Links to this site can carry a tag saying which post sent you — ?ref=youtube, say. The site keeps the tag in the address as you click around, so a download or an order can be counted by the post that led to it. It is never stored in your browser, and it names the post, never you.

The account area sets one session cookie, which is what keeps you signed in. There is no advertising cookie anywhere, and nothing here is shared with an advertising network.

Security and fraud prevention

Licences are worth stealing and trials are worth faking, so a few moments are written down: downloading the installer, the gallery asking for the trial rules, opening a checkout, and signing in. Each record holds the IP address it came from, the browser's or the program's description of itself (its "user agent"), the country Cloudflare reports for the address, the time, and what it was about — which installer, or which order and the email address it was placed under.

The IP address alone is then checked with an IP-intelligence provider, which says what kind of network it belongs to: the provider and its network number, whether it is a home, mobile, business or hosting connection, its approximate location, and whether it is known as a datacenter, VPN, proxy or Tor exit or as a source of abuse. Nothing else about you is sent to it — not your name, not your email address, not what you did.

This is used only to spot fraud and abuse — a stolen card, a key passed around, a trial reset over and over — and only a person looks at it. Nothing is decided about you automatically: no download, trial, purchase or sign-in is refused because of it. The legal basis is our legitimate interest in protecting the service and its buyers from fraud. These records and what the provider said are deleted after 180 days.

Who else sees any of it

Paddle, as merchant of record, for the payment. The company that hosts the service, as the machine the data sits on. Cloudflare, which answers for the firelet.media name and carries every visit to this site, your account and the installer download through its network — like any network in the path, it sees the address a request comes from; it holds nothing else about you, and we receive nothing from it. An IP-intelligence provider, which is sent an IP address and nothing else, as described under Security and fraud prevention. On the phone, the three services named above. Nobody else: we do not sell personal data, we do not share it for advertising, and there is no third-party tracker on this site, in the program or in the phone app.

How it is kept safe

Everything between your browser and this site, and between the gallery and this site, travels over an encrypted connection. Passwords are stored hashed rather than encrypted, which is to say nobody here can read one, us included — a password you forget is reset, never recovered. The database is not reachable from the internet; the application in front of it is.

The administrative side is granted from the server console and never by signing up, every administrative action is written to an audit log, and your own sign-ins are recorded so that access you did not make is something either of us can spot. None of that is a guarantee — no honest security section claims one. If something goes wrong in a way that puts your data at risk, you will hear it from us, and so will the authority we are obliged to tell.

How long it is kept

Your account and licences are kept while the account exists — a perpetual licence is a long relationship by design, and a key you can no longer be shown is a key you have effectively lost. Orders and the records behind them are kept as long as tax and accounting law requires, which is usually several years and is not ours to shorten. Crash reports, and the problem reports from the phone camera's effects, are deleted 180 days after they reach us; counters are kept for a limited period and then dropped. The daily download totals say nothing about anybody, so they are simply kept; the security records — addresses, user agents and what the IP-intelligence provider said about them — are deleted after 180 days. An address on one of the email lists is kept while it is on the list; after it leaves, it is kept marked as unsubscribed, so it is never mailed again unless you ask. Delete the account and the rest goes with it.

What you can do about it

Most of it is self-serve, deliberately — a right you have to ask permission to exercise is not much of a right:

• Export everything. Your account pages produce a full machine-readable copy of what is held about you, including your devices, consents, synced entries and thumbnails.
• Delete the account, from the same place.
• Turn the optional things on and off, individually, with withdrawal exactly as easy as granting.
• Correct anything wrong from your profile, or by asking us.

You also have the right to object to or restrict some processing, and the right to complain to your data protection authority. If you would rather ask us than click, write to support@firelet.media and we will do it for you.

Where the data is

We are in Pakistan; the servers are not. The account, its licences and everything listed above sit on hosting in the United States, so your data leaves the country we are in the moment you create an account — that is worth saying plainly rather than leaving you to infer it from an address at the top of the page.

Where data reaches Paddle, Paddle moves it under its own safeguards, described in its privacy notice. Wherever it is, the same rules on this page apply to it, and the rights above are exercised the same way.

Changes

If this notice changes, the date at the top changes with it, and a change that affects what is collected is announced rather than slipped in.