Privacy Policy

Effective Date: April 7, 2026

Last Updated: April 7, 2026

Sortify ("the App") is a mobile photo sorting application developed and operated by BW.Digitals e.U. Protecting your personal data is of paramount importance to us. This privacy policy informs you in accordance with Art. 13 and Art. 14 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) about what data the App processes, for what purpose, on what legal basis, and what rights you have.

1. Data Controller

The controller within the meaning of the GDPR (Art. 4(7)) is:

BW.Digitals e.U.
Owner: Bernhard Waitz
Schrekergasse 6/1/8
1160 Vienna, Austria
Email: contact@sortery.app
Commercial Register: FN 653658m, Commercial Court of Vienna

A Data Protection Officer has not been appointed pursuant to Art. 37 GDPR, as the requirements (core activities involving large-scale processing of special categories of personal data or systematic monitoring) are not met.

2. Core Principle: Your Data Stays on Your Device

Sortify was built following the principle of Privacy by Design (Art. 25 GDPR). Your photos are never uploaded to any server. All sorting decisions (keep, trash, favorite), your game progress (XP, levels, streaks, achievements, daily challenges), and your settings are stored exclusively on your device. There are no user accounts, no registration, no login, and no email collection. We do not operate any cloud sync or backup service for your data.

3. What Data Is Processed?

3.1 Data Stored Locally on Your Device

The following data is stored exclusively on your device and is never transmitted to us or any third party:

• Sorting decisions (keep, trash, favorite) — stored in a local SQLite database
• Photo metadata cache (EXIF data such as date taken, location, camera model) — used for achievements and sorting features
• Gamification data (XP, level, streaks, achievements, daily challenges)
• User preferences (theme, onboarding status, analytics settings)

Legal basis: This local processing is necessary for the performance of the contract between you and us, i.e., providing the App's core functionality (Art. 6(1)(b) GDPR). Since this data never leaves your device, it is under your sole control. You can delete all locally stored data at any time by uninstalling the App.

3.2 Anonymous Usage Analytics (Matomo)

We use a self-hosted Matomo instance for anonymous usage analytics to understand how the App is used and to improve it. Matomo is configured in cookieless mode, meaning:

• No cookies are set on your device
• No persistent visitor ID is stored — a random, non-identifiable session ID is generated for each app session
• No device fingerprinting is performed
• IP addresses are fully anonymized before any processing (on the server)
• No personal data (names, email addresses, device identifiers) is collected

The anonymous events we track include: screen views, aggregated swipe action counts, level-ups, and feature usage. This data is transmitted via encrypted HTTPS to our self-hosted Matomo instance and cannot be linked back to you as an individual.

The Matomo server is located within the European Economic Area (EEA). No international data transfer occurs for analytics data.

Legal basis: Legitimate interest in improving the App (Art. 6(1)(f) GDPR). Because Matomo operates in cookieless mode without processing any personal data, no consent is required. Access to terminal device information pursuant to § 25(2) TTDSG (Germany) or § 165(3) TKG 2021 (Austria) does not apply, as neither cookies are set nor device information is read. This assessment is consistent with the guidelines issued by the French data protection authority (CNIL) and the German Conference of Independent Data Protection Authorities (DSK) on audience measurement exemptions.

Opt-out: Even though no personal data is collected, you can disable analytics entirely in the App's Settings screen.

3.3 Advertising (Google AdMob)

The free version of Sortify displays advertisements provided by Google AdMob. When ads are enabled, Google may process certain data depending on your consent choices:

• If you consent to personalized ads: Google may collect and use your advertising ID (IDFA on iOS, GAID on Android), approximate location, and app usage data to show interest-based ads. On iOS, you will first be shown Apple's App Tracking Transparency (ATT) prompt.
• If you decline personalized ads: Google will show non-personalized (contextual) ads. Limited technical data (e.g., ad request metadata) may still be processed by Google to serve and measure ads.

Legal basis: Consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG or § 165(1) TKG 2021). Before any ad-related tracking begins, the Google User Messaging Platform (UMP) SDK will present a consent dialog compliant with the IAB Transparency and Consent Framework (TCF) v2.2. You can withdraw your consent at any time in the App's Settings screen.

Google acts as an independent controller for data it collects through AdMob. For details on Google's data practices, see Google's Privacy Policy and How Google uses information from sites or apps that use their services.

Ad-free option: You can remove all advertisements — and all ad-related data processing — permanently by purchasing the ad-free version through an in-app purchase.

3.4 In-App Purchases

In-app purchases (e.g., the ad-free version) are handled entirely by the Apple App Store or Google Play Store. All payment processing and purchase validation is performed by Apple or Google respectively. No payment information (credit card numbers, billing addresses, etc.) ever reaches Sortify's systems. Please refer to Apple's Privacy Policy or Google's Privacy Policy for details on how they handle purchase data.

3.5 Error Tracking (GlitchTip)

We use a self-hosted GlitchTip instance (an open-source error tracking platform) to detect and fix crashes and errors in the App. When the App encounters an unexpected error, the following data may be transmitted:

• Error details: error type, error message, and stack trace (code-level information about where the error occurred)
• Device metadata: operating system (e.g., iOS 18), device model (e.g., iPhone 15), and App version
• No personal data: No names, email addresses, phone numbers, photos, photo file paths, or device identifiers (IDFA/GAID) are collected

IP addresses are not stored by our GlitchTip instance. IP scrubbing is enabled at the server level, meaning IP addresses are discarded before any data is persisted.

The GlitchTip server is hosted within the European Economic Area (EEA) on infrastructure operated by BW.Digitals e.U. No international data transfer occurs for error tracking data.

Legal basis: Legitimate interest in maintaining the stability and reliability of the App (Art. 6(1)(f) GDPR). Error tracking is essential for identifying and resolving bugs that affect all users. Since no personal data is collected, the impact on your privacy is minimal.

Note: Error tracking is only active in production builds of the App and is automatically disabled during development.

4. Legal Bases Overview

5. International Data Transfers

Our Matomo and GlitchTip instances are hosted within the European Economic Area (EEA). No international data transfer occurs for analytics or error tracking data.

If you consent to personalized advertising, Google AdMob may transfer data to servers in the United States. Google relies on:

• the EU–U.S. Data Privacy Framework (adequacy decision of the European Commission pursuant to Art. 45 GDPR) and
• Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR as a supplementary safeguard

You can prevent this transfer by declining personalized ads in the consent dialog or by purchasing the ad-free version.

6. Data Retention

• Local data: Stored on your device until you uninstall the App or clear its data. We have no access to this data and cannot delete it remotely.
• Matomo analytics data: Anonymous, aggregated event data is retained on our Matomo server for up to 26 months and then automatically deleted. Since this is not personal data, it cannot be linked back to you.
• AdMob data: Retained by Google according to their own retention policies. See Google's data retention information.
• In-app purchase data: Retained by Apple or Google according to their respective privacy policies.
• GlitchTip error tracking data: Error reports are retained on our self-hosted GlitchTip server for up to 90 days and then automatically deleted. No personal data is contained in error reports.

7. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — You can request information about what personal data we process about you.
• Right to rectification (Art. 16 GDPR) — You can request correction of inaccurate personal data.
• Right to erasure (Art. 17 GDPR) — You can request deletion of your personal data ("right to be forgotten").
• Right to restriction of processing (Art. 18 GDPR) — You can request that we restrict the processing of your data.
• Right to data portability (Art. 20 GDPR) — You can request a copy of your data in a machine-readable format.
• Right to object (Art. 21 GDPR) — You can object to processing based on legitimate interest. In particular, you can object to anonymous analytics via Matomo by disabling it in the App's Settings.
• Right to withdraw consent (Art. 7(3) GDPR) — Where processing is based on consent (e.g., personalized ads), you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. You can withdraw ad consent in the App's Settings screen.

Practical note: Since Sortify stores almost all data exclusively on your device and our analytics are fully anonymized, there is very little personal data on our side. Uninstalling the App deletes all local data. If you wish to exercise any of your rights, please contact us at contact@sortery.app. We will respond within 30 days (Art. 12(3) GDPR).

8. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority for BW.Digitals e.U. is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42
1030 Vienna, Austria
Phone: +43 1 52 152-0
Website: www.dsb.gv.at
Email: dsb@dsb.gv.at

You also have the right to contact any other data protection supervisory authority within the EU/EEA, in particular the authority of your habitual residence or place of work (Art. 77(1) GDPR).

9. Children's Privacy

Sortify is not directed at children under 16 years of age. We do not knowingly collect personal data from children. Since the App does not require account creation and our analytics are fully anonymized, we have no way to identify whether a user is a minor.

In Austria, pursuant to § 4(4) DSG, the minimum age for consent regarding information society services (Art. 8 GDPR) is 14 years. Consent to personalized advertising therefore requires a minimum age of 14; otherwise, parental consent is required.

If you are a parent or guardian and believe your child has provided personal data to us, please contact us at contact@sortery.app, and we will take the necessary steps.

10. Third-Party Services Overview

11. Data Security

We implement appropriate technical and organizational measures to protect the data we process (Art. 32 GDPR). Specifically:

• All communication between the App and our servers (analytics, error tracking) occurs over encrypted HTTPS connections (TLS).
• Local data on your device is protected by your device's own security features (passcode, biometrics, device encryption).
• The SQLite database operates in WAL mode (Write-Ahead Logging) to ensure data integrity.
• Our Matomo server is protected by access restrictions and regular security updates.

Despite these measures, no electronic transmission or storage can be 100% secure. Should we become aware of a data breach, we will notify the competent supervisory authority pursuant to Art. 33 GDPR within 72 hours and inform affected individuals pursuant to Art. 34 GDPR where there is a high risk to their rights and freedoms.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The "Last Updated" date at the top of this page will be adjusted accordingly. For significant changes, we will notify you through the App. We encourage you to review this privacy policy periodically.

13. Contact Us

If you have any questions about this privacy policy or our data processing practices, please contact us:

BW.Digitals e.U.
Bernhard Waitz
Schrekergasse 6/1/8
1160 Vienna, Austria
Email: contact@sortery.app

We aim to respond to inquiries within 30 days. When exercising your data subject rights, this is mandatory pursuant to Art. 12(3) GDPR.