Language:한국어English日本語简体中文繁體中文 Español Français

Privacy Policy

Effective date: November 7, 2026 (previous version: November 5, 2026) — usage statistics (Google Analytics) added

This is the English version of the Fotune privacy policy. If it differs from the Korean original, the Korean original prevails.

Fotune ("the App") respects your privacy and complies with applicable laws. This policy explains what information the App handles and how.

Fotune is an iOS and Android app that helps you find albums in your Photos app (iOS) or device gallery (Android) by place, date and the people you were with. Your photos and photo information are processed on your device. When you use features that need an account, such as album sharing, you sign in with Apple or Google (on Android, Sign in with Apple opens a web sign-in window). Only when you start album sharing yourself and agree, that album's photos and videos and album information are sent to the delivery server the developer uses (Cloudflare) and to Google Firebase. Your other photos and their locations never leave your device.

1. Information we handle

Item	Details	Where it is stored	Purpose
Photos library information	Album list (on Android, the photo and video folders on your device), names and covers; each photo's capture time, location (GPS) and favorite status	Your device (on-device index)	Search albums by place and date
Information you enter	Names of people and people groups you add to albums, places you type or pick on the map (name and coordinates), hidden automatic places, tags, favorite and hidden album flags, photo flags (good · okay · not great, with the photo's identifier — the iCloud identifier on iOS, the folder path on Android)	Your device + (iOS) your own iCloud private database / (Android) the Android Auto Backup of your Google account, if you turned it on	Search by people and place; keep your data when you change devices
Place name lookup	A city's public center coordinates (GeoNames) and your device language — not your photos' coordinates	(iOS) Apple geocoding / (Android) the device's geocoding service (Android Geocoder; the provider depends on the device)	Show city names in languages not included on the device
Map search text	Text you type into the place search field, the map area on screen, and the ID of the place you pick	Google (Maps · Places)	Show place search results
Advertising identifier and device information	Advertising identifier (IDFA on iOS, advertising ID on Android), approximate location, usage data	Google (AdMob)	Serve and measure ads
Usage statistics	Screen and feature usage events (sign-up, sign-in, album creation, sharing, invitations and similar — counts recorded as ranges), Firebase app instance ID, device model, OS and app version, and approximate region estimated from IP address (both iOS and Android). Advertising identifiers (IDFA / advertising ID) are not used, and the data is not linked to your account (UID or email). Crash reports (Crashlytics) are not collected	Google (Firebase · Google Analytics)	Understand how the service is used and improve the App
Account information	A user ID (UID) created by signing in with Apple or Google, and the sign-in email. Firebase Auth keeps the email as sign-in information; the App writes only a SHA-256 hash of the normalized email to Firestore, for finding users. The name and profile photo of your sign-in account are not received	Google (Firebase Auth · Firestore, Seoul region)	Sign-in, finding people to share with
Account name	One name you choose yourself — it is shown to other people in album sharing	Google (Firestore)	The name shown to the people you share with
Shared albums	Original photos and videos (1080p) of albums you send with Share Invite, the album name, people, places and tags, the name shown to recipients, and invitation and receipt status	Files: Cloudflare (R2 delivery server); album information and invitations: Google (Firestore)	Deliver the album to the people you choose
Push notification token · reports · blocks	Push notification registration token (FCM; on Android with an app install ID), report records (reporter, reported account id, album id, reason, time — photos are not included), and your block list	Google (Firebase FCM · Firestore), (iOS) Apple (push delivery)	Sharing notifications, safety (reports · blocks)

Except when you agree to and start album sharing, the App never copies or sends your original photos or their locations off your device on its own. It reads information from Photos and builds a search index on your device.
Photos and videos you share stay on the delivery server only until all recipients have received them, and are deleted right after they have all been received. They are deleted after 7 days at the latest (it can take one more day because of the storage's automatic deletion rule). They are also deleted when you stop sharing.
Photos you receive are saved to the recipient's Photos app (on Android, the device gallery under Pictures/album name), and the sender cannot delete them.
A person who comes in through a link receives the album only after the album owner approves. Upload and download addresses issued by the delivery server are valid for 24 hours only, and invitations and bundles of photos to receive end 7 days after the server creates them.
If you install the Android app from an invitation link, the app reads the Google Play install referrer once at first launch to pick up the invitation code. Links clicked more than 30 days ago are ignored, and people are never guessed from IP address or device fingerprint.
When 3 different people report an account, that account's sharing is suspended and the photos it uploaded are deleted right away. On Invitations, Albums Shared with Me and Waiting for Approval screens you can use "Report" and "Block This Person".
City, region and country names are resolved with data stored on the device (GeoNames). Only when a name in your device language is missing does the App send that city's public center coordinates and your device language to Apple's geocoding service. Your photos' coordinates, capture times, photo identifiers and album names are never sent.
When you ask (add to an album, create an album, rename an album, edit or delete photos), the change is applied to your Photos library or device gallery right away. On Android, a system confirmation window appears, and because an album is a folder, adding a photo to an album moves it out of its original folder.
When you share photos yourself with the share sheet, they are delivered in their original form (including location) to the app you choose. This is a transfer you choose; the developer does not receive it.
Hidden albums are locked with Face ID (iOS) or biometrics and the device lock (Android). The operating system handles authentication; the App never receives face or fingerprint data.
Android permissions: reading photos and videos (for the search index), reading photo location data (ACCESS_MEDIA_LOCATION), notifications (sharing alerts) and internet. The App does not request your current location. Uploading and downloading shared albums and saving videos run as foreground services with a visible notification so they can finish when the App is in the background.
If you choose selected-photos access in Android's system settings, the App can read only those photos; searching all albums requires full access.
Usage statistics never include search terms, album names, people's names, place names, photo identifiers, email addresses or account names. Counts such as numbers of photos or results are recorded only as ranges, not exact values. Statistics are not used for advertising (ad personalization signals are off) and are deleted when the Google Analytics retention period ends.

2. Advertising and tracking consent

The App shows Google AdMob ads so it can be free. Google may use the advertising identifier and similar data for personalized ads.

App Tracking Transparency (ATT, iOS): The App asks for permission to track. If you do not allow it, only non-personalized ads are shown. Android has no ATT; only the Google UMP consent flow applies.
Users in Europe (GDPR): Users in the European Economic Area, the UK and Switzerland are shown a consent form through Google's User Messaging Platform (UMP).
You can change your choice at any time in iOS Settings › Privacy & Security › Tracking, or on Android in device Settings › Google › Ads (delete advertising ID, opt out of personalization). In the EEA, the UK and Switzerland you can also change it in the App under Settings › Privacy & Ad Settings.

3. Third-party services

The App uses the following services; each provider's privacy policy applies.

Google AdMob and User Messaging Platform (ads · consent) — https://policies.google.com/privacy
Google Firebase · Google Analytics (sign-in (Auth) · album information (Firestore) · push (FCM) · usage statistics) — https://firebase.google.com/support/privacy
Google (Sign in with Google, Credential Manager on Android · Maps · Places · Google Play install referrer) — https://policies.google.com/privacy
Cloudflare, Inc. (R2 · Workers: delivering album files, auto-deleted after 8 days by a lifecycle rule) — https://www.cloudflare.com/privacypolicy/
Apple (iCloud sync, geocoding, map search, Sign in with Apple, push notifications (APNs)) — https://www.apple.com/legal/privacy/

4. Retention and deletion

The on-device index and the information you entered are removed when you delete the App.
Information synced to iCloud (the information you enter, above) can be deleted in iOS Settings › Apple Account › iCloud; Android backups can be deleted in the device's Google backup settings.
If you delete your account, your account data on the servers is deleted, including your account information, the shared album documents you created and your block list (Settings › Account › Delete Account — see Delete Account for what is deleted and what remains). For Sign in with Apple, the connection (token) is also revoked. Shared albums you own are stopped and their photos are deleted from the delivery server; shared albums you joined are left. Photos on the delivery server are deleted according to the retention rules above.
Data processed by third parties (Google, Apple, Cloudflare) is retained under their policies.

5. Your rights

You can edit or delete the people and places you added to albums at any time in the App.
You can change your account name and delete your account in the App. You can stop sharing, and report and block people.
You can change or revoke Photos access at any time in iOS or Android Settings.
You can withdraw consent to ad personalization in device Settings or in the App's consent screen.
If you can no longer open the App, you can request account deletion by email (see Delete Account).

6. Children

The App is not directed at children and does not knowingly collect personal information from children.

7. International transfers

Third-party services such as Google, Apple and Cloudflare may process data on global infrastructure; in that case, each provider's safeguards apply. Firebase data is kept in the Seoul region (asia-northeast3), but Google and Cloudflare may process it on global infrastructure. Usage statistics (Google Analytics) are processed on Google's global infrastructure, including in the United States.

8. Changes to this policy

This policy may be updated when laws or the service change. We will announce important changes in the App or on this page.

9. Contact

Privacy inquiries: noggong@gmail.com