Español

Privacy Policy

Last updated: 2026-10-28

This Privacy Policy explains how PicFil processes personal data to allow users to create private groups, invite members and share photos within those groups.

1. Controller and contact

PicFil is currently published and operated by YAPIKO SOFTWARE HOUSE, S.L. (Spanish tax ID B87088746), the controller of the personal data described in this Privacy Policy.

Registered address: Calle Mónaco 33, 28232 Las Rozas, Madrid, Spain.

Privacy and support contact: info@yapiko.com.

2. Data we may process

PicFil may process the following categories of data:

• Account and authentication data: user identifier, phone number, username, profile picture and technical data required to sign in or verify the account.
• Legal acceptance data: version of the accepted Terms and Privacy Policy, acceptance date, acceptance method and acknowledged age threshold. We do not collect date of birth for this purpose.
• Group data: group name, description, dates, location or coordinates associated with the group, members, roles, invitations, group status and activity needed to administer the group.
• Photos and shared content: images uploaded by users, technical file metadata, storage references, thumbnails, data associated with the group gallery and, when the feature requires it and the user allows it, location metadata included in photos.
• Contacts: when the user grants permission, PicFil may read device contacts to help with invitations or resolve whether a contact already uses PicFil. We may temporarily store contact-derived information on the device to improve the performance of that feature.
• Notifications: push notification tokens, preferences or technical data needed to send relevant alerts.
• Technical and security data: operational logs, technical identifiers, errors, app version, device or information needed to keep the service secure and stable.
• Product analytics data, only with consent: a pseudonymous app-instance identifier, screens visited, session duration and count, country or approximate location, device model, operating system and events indicating whether actions such as onboarding, creating or joining a PicFil, invitations, photo uploads or Smart Match are completed. We do not send names, phone numbers, photos, precise coordinates, PicFil names or identifiers, or invitation codes to Analytics.
• Product feedback: answers that the user voluntarily submits through in-app surveys and limited context needed to interpret them, such as their role and ranges for the number of photos or members. These answers are stored separately from Firebase Analytics.

3. Purposes

We use this data to:

• Create and manage accounts.
• Record acceptance of the Terms and Privacy Policy and evidence the applicable version.
• Create groups, add members and manage permissions.
• Upload, display, delete and sync shared photos.
• Send invitations, reminders and notifications related to groups.
• Resolve contacts in a limited way to improve the invitation experience.
• Apply product limits, security, abuse prevention, incident review and content or account moderation when needed.
• Diagnose errors, improve performance and maintain service availability.
• Understand, only with consent, how PicFil is used, measure completion of its main flows and improve the product.
• Collect and analyze voluntary feedback to assess new features, pricing and product priorities.

4. Device permissions

PicFil may request operating system permissions for:

• Camera: taking photos for groups.
• Photos/gallery: selecting, uploading or saving photos.
• Location: setting group locations or using features related to nearby photos when available.
• Media location: reading photo location metadata when a feature requires it.
• Contacts: facilitating invitations and contact resolution.
• Notifications: sending alerts about relevant activity.

The user can manage these permissions from the device settings. Some features may not be available if a required permission is denied.

5. Legal basis

Depending on the context, processing may be based on:

• Performance of the service requested by the user.
• Consent for optional device permissions.
• The user's consent for product analytics. Refusing it does not limit PicFil features and consent can be withdrawn at any time from Settings.
• The user's voluntary action when submitting a product-feedback answer.
• Legitimate interest in maintaining security, preventing abuse and improving stability.
• Compliance with applicable legal obligations.

6. Data sharing and providers

PicFil may use technical providers to provide the service, including Firebase/Google Cloud, Expo/EAS and Apple or Google push notification services. These providers may process data as processors or technical providers required for authentication, storage, database, notifications, hosting, logs and builds. When the user consents, we use Google Firebase Analytics for product analytics. Advertising storage, use of data for advertising and advertising personalization remain denied.

We do not sell personal data.

7. Shared content, reports and moderation

Photos and other content shared by a user in a private group may be visible to other members of that group according to the permissions available in PicFil.

We may review, restrict, remove or retain information related to content, accounts or groups when necessary to investigate reports, prevent abuse, protect users, enforce our terms or comply with legal obligations.

If a user believes that a photo, group, profile or behavior infringes rights, contains personal data without authorization, is illegal or breaches our terms, they can report it to info@yapiko.com. When in-app reporting tools are available, they should preferably be used from within the app so that we can better identify the affected content.

8. Retention

We retain data for as long as necessary to provide the service, comply with legal obligations, resolve incidents or protect security. Some deletion actions may take time to be reflected due to technical processes, caches or backups.

Groups, photos and notifications may be subject to expiration or deletion rules configured in PicFil.

Analytics data is retained according to the retention period configured in GA4 and Google's applicable policies. When consent is withdrawn, PicFil stops collection and resets the local Analytics app-instance identifier; aggregate reports already produced may not make it possible to identify or later separate one person's contribution.

Product-feedback answers are retained for as long as needed to evaluate and develop the product. They may then be deleted or retained in aggregate form without being linked to an account.

The legal acceptance record is retained while the account remains active. After deletion, it may only be retained for the limited time needed to evidence compliance with legal obligations or resolve incidents.

Deleting an account from the app deletes or detaches associated information to the extent provided by the service, including profile, group memberships and photos uploaded by that account when technically applicable. Limited information may remain for the time necessary for security, legal compliance, incident resolution, abuse prevention, backups or technical logs.

9. Rights

Where allowed by applicable law, the user may request access, rectification, deletion, objection, restriction or portability of their data.

To exercise these rights, the contact indicated in this policy should be used.

The user may also request account or data deletion by writing to info@yapiko.com, especially if they cannot access the app.

10. Minors

In Spain, PicFil may be used from the age of 14. People under 14 may only use it with authorization from their parent or legal guardian. In other countries, the age or authorization required by the applicable law applies. PicFil does not request date of birth: when starting sign-in, the user confirms that they meet the applicable requirement or have that authorization. If we detect unauthorized use by minors, we may take steps to restrict or delete the account.

11. Security

We apply reasonable technical and organizational measures to protect data, including access rules, authentication, storage controls and limitation of sensitive logs.

12. Changes

We may update this policy to reflect changes in PicFil, legal requirements or service improvements. The published version will apply at each time.

13. Language

PicFil may make this policy available in several languages. For the initial launch in Spain, the Spanish version is the reference version. In case of conflict between translations, the Spanish version will prevail unless applicable law requires otherwise.