Privacy Policy

Effective date: October 23, 2026

01Who we are

Poof! (“the App”) is provided by ZR ECO d.o.o., a company registered in Croatia (“we”, “us”). We are the controller of the limited personal data described in this policy. You can reach us at [email protected].

02Data that stays on your iPhone

Poof’s features work on your device, using Apple frameworks such as Photos, Vision, Contacts and EventKit. None of the following is sent to us or to anyone else.

• Photos and videos. With your permission, Poof reads your library to find duplicates, similar, blurry and accidental shots, screenshots, documents, large and RAW photos, Live Photos and videos. The results of this analysis (such as image fingerprints, quality scores and sizes) are stored on your device to make later scans faster. When you compress a video, optimize a photo or convert a Live Photo, the new copy is created on your device and saved to your library.
• Location in your photos. Many photos contain the place where they were taken. Poof reads this metadata to show your photos on a map, to estimate places such as home, and to let you remove location data or make copies without metadata. These estimates are calculated on your device. Poof does not ask for or use your iPhone’s current location.
• Contacts. If you open the contacts cleaner, Poof reads your contacts to find duplicate, similar and incomplete cards. Before every merge or deletion, the affected cards are saved as a vCard backup on your device so you can restore them. Changes happen in your device’s Contacts, only after you confirm.
• Calendars and reminders. If you open the calendar or reminders cleaner, Poof reads your events and reminders so you can remove old, duplicate and spam events, and completed or long-overdue reminders. Nothing is deleted until you confirm.
• Vault. Photos, videos, notes and files you move to the Vault are encrypted with AES-GCM using a 256-bit key stored in your device’s Keychain, available only on this device. Vault items are excluded from backups and can be opened only with Face ID, Touch ID or your passcode. Face ID and Touch ID data are handled by iOS and are never available to the App. If you take photos or videos straight into the Vault, the camera and microphone are used only while you capture.
• Passwords. Passwords you check are analyzed on your device (see section 03 for the leak check). Passwords you generate, and their history, are stored only on your device.
• Settings and activity. Your preferences, cleanup history, goals and streaks, privacy checklist and the email addresses you monitor are stored on your device. Widgets, Control Center controls and Siri shortcuts read a summary that also stays on your device.

If your library uses iCloud Photos, iOS may download originals from Apple’s servers when Poof displays or analyzes them. That transfer is handled by Apple under Apple’s privacy policy.

03Data that leaves your iPhone

Leak checks you start

• Email breaches (where available). When you add an email address to check, that address is sent over an encrypted connection to an external breach-checking service, which returns the known breaches it appears in. Addresses you keep in the list are checked again when you open Protect, at most once a day. The address is not sent to us. That service’s privacy policy applies to the request.
• Password check. Your password is hashed on your device, and only the first 5 characters of that hash are sent to an external database of leaked passwords. The service returns a list of possible matches, and the comparison happens on your iPhone (a technique called k-anonymity). Your password and its full hash never leave your device.
• Latest breaches. Poof downloads a public list of known breaches. No personal data is sent.

Place names and maps

When Poof shows the name of the place where a photo was taken, or a map of your photos, the photo’s coordinates are sent to Apple’s location services to look up the place name and load the map. This is handled by Apple under Apple’s privacy policy. We do not receive it.

Service providers

We do not request access to the advertising identifier (IDFA), and Poof does not show the App Tracking Transparency prompt. Adapty processes data on our behalf as a processor and under its own privacy policy.

04What we don’t do

• We don’t sell or rent personal data.
• We don’t show ads or build advertising profiles.
• We don’t collect your name, email or phone number, and there is no account to create.
• We don’t access the content of your photos, videos, contacts, calendars, reminders, passwords or Vault.

05Why we process data

Under the EU General Data Protection Regulation (GDPR) and similar laws, we rely on these legal bases:

• Performance of a contract: providing the App and Poof! Pro.
• Legitimate interests: understanding which plans people choose, preventing fraud and keeping the App reliable.
• Your request: leak checks and place-name lookups happen only for features you use.
• Legal obligations: keeping purchase records where tax and accounting law require it.

06Permissions

Poof asks for access to Photos, and when you use the related features, to Contacts, Calendars, Reminders, Camera, Microphone, Face ID and notifications. Each permission is used only for the feature that needs it. Notifications, such as a weekly cleanup reminder or a low-storage alert, are created on your device; we don’t send push notifications. You can change or revoke access at any time in iOS Settings → Apps → Poof!.

07How long data is kept

Data stored on your device stays there until you delete it in the App or delete the App. Deleting the App permanently deletes the contents of the Vault and Poof’s contact backups. Data held by our service providers is kept only as long as needed for the purposes above and is then deleted or anonymized, except where purchase records must be kept longer for tax and accounting reasons.

08International transfers

Our service providers may process data outside the European Economic Area, including in the United States. Where required, these transfers are protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

09Your rights

You have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time. You also have the right to lodge a complaint with a data protection authority: in Croatia, the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, azop.hr), or the authority in the country where you live or work. California residents: we do not sell personal information or share it for cross-context behavioral advertising.

To make a request, email [email protected]. Because Poof has no accounts, we may ask for information from your device, such as a purchase receipt, to locate your data, and we will tell you exactly what we need. We reply within one month.

10Security

Every network request the App makes is encrypted in transit, Vault content is encrypted at rest, and we limit the data we work with to what is described here. No method of transmission or storage is completely secure, but we work to protect your information.

11Children

Poof is not directed to children under 13, and we do not knowingly collect personal data from them. Where the law of your country sets a higher age for consent to data processing (in Croatia, 16), the same applies up to that age. If you believe a child has provided us personal data, contact us and we will delete it.

12Changes to this policy

We may update this policy as the App changes. The current version is always available at this address, and the effective date above shows when it was last changed.

13Contact

ZR ECO d.o.o., Croatia
Email: [email protected]