Privacy Policy

Last updated: 29 September 2026 · Version 1.6.0

• Service: IMgest (the "App")
• Provider: LIMOD
• Contact: sukmack@gmail.com

1. Summary

IMgest safely copies photos and videos from SD cards into a library folder you choose. The guiding principle is "safety over convenience": originals are never modified or deleted (except via an explicit opt-in option).

• Your original, full-resolution photos and videos remain on your device. They are not uploaded; AI naming uses only the stripped, downsized analysis copies described below.
• Only when you use file content analysis or AI folder naming, a small number of downsized images (≤768px wide, with all metadata and GPS removed) and text metadata (date, clip count, representative filename, and per-file capture information) are sent to an AI service.
• Pseudonymous error reporting is initially enabled. Scrubbed diagnostics are sent only when an error or crash occurs, and you can turn reporting off anytime in Settings.
• Direct-distribution builds automatically send first launch, first run per version, and verified update-completion events after a successful start. No file, media, account, or hardware information is included.
• Payments are handled by Paddle; the App never sees your card details.

2. What we process

2.1 Information processed on your device

Information separately sent when AI features are used is described in section 2.2.

• Photo/video files and their contents
• File paths, sizes, hashes (for integrity verification), capture times
• App settings stored locally on your computer
• Import job reports written inside your own library folder

2.2 Sent only when file content analysis or AI folder naming is used

• Downsized images: a representative frame/photo re-encoded to a JPEG ≤768px wide with embedded metadata such as EXIF/GPS stripped. Original media files and GPS coordinates are not sent.
• Capture information for per-file analysis: the capture time and its basis when available, video duration, original pixel width and height, and sampled-frame timestamps. These fields are sent separately as text after embedded image metadata is stripped. GPS, device serial numbers, owner names, and full file paths are not included.
• Text metadata: date, clip count, time of day, device type, representative filename, media type, and the existing folder name when one is reused (which may be a name you chose yourself). Representative filenames and existing folder names may contain personal information such as user-chosen names or places. Full file paths are not included.
• A random pseudonymous installation identifier (install_id, a random UUID — not tied to hardware or account). It is sent to the LIMOD hosted service (api.actioncam.dev) with file-analysis or naming requests for quota accounting, and is not forwarded to AI model providers.
• Detailed AI-usage metering records: install_id, request_id, usage month and job/date bucket, app/model/prompt/pricing versions, quota source, status and error code, frame count and dimensions, token and cost data, whether quota was charged, latency, and record time. These records are kept in Cloudflare D1 for cost, quality, and error analysis for up to 90 days, then deleted. They do not store images or full file paths.
• AI-request deduplication records: to prevent duplicate charges or model calls and replay a result after response loss, Cloudflare D1 stores the pseudonymous IDs, request-payload SHA-256, status, internal charge token, and a sanitized result. The sanitized result is deleted after up to 90 days. A minimal tombstone is retained as needed to prevent duplicate calls, charges, or refunds. Prompts, images, and full file paths are not stored in this record.
• Current quota balances and charge, refund, and duplicate-processing markers are separate from detailed metering records. They are retained only for as long as necessary to provide entitlements and prevent duplicate charges or refunds.

2.3 Pseudonymous error reporting (initially enabled, can be turned off anytime)

• Reporting is enabled on first run. While enabled, anonymized diagnostics (error kind, anonymized stack trace, app version, OS version, random install_id) are sent only when an error or crash occurs.
• On receipt, the server derives an approximate country from the request IP and stores it; the IP address itself is not stored.
• Your username, file paths, API keys, and email are scrubbed before sending.
• You can turn it off anytime in Settings › Diagnostics.

2.4 Payments & licensing

• Payments are processed by Paddle as Merchant of Record. The App does not store or read card data.
• When restoring on a new device, the email address you enter is sent to verify your license.
• LIMOD keeps a minimal pseudonymous Paddle transaction index (paddle_transactions) in Cloudflare D1: Paddle transaction and subscription IDs, the random install_id, product ID, quantity, entitlement kind and lot reference, event time, and record time. It is used to grant and restore entitlements and reconcile refunds or chargebacks. Each transaction-index row is deleted 5 years after it is recorded.
• Approved Paddle refund and chargeback incidents are kept in a separate pseudonymous incident ledger with the Paddle event and transaction IDs, action, full or partial type, event time, and record time. No amount is stored, and rows are retained only as needed for reconciliation and legal or dispute-resolution needs.
• Separate current entitlement state and markers for refunds or chargebacks, entitlement transfers, and duplicate-grant prevention are also kept in D1. They are retained only for as long as necessary to provide active entitlements, prevent re-grants, and meet legal or dispute-resolution needs.
• If a Paddle webhook cannot be matched to an installation, a recovery record may temporarily contain the Paddle event and transaction IDs, product and entitlement kind, purchaser email when supplied by Paddle, the original webhook payload, failure reason, timestamps, and any resolution installation ID. This is used only to recover or reconcile the purchase and is deleted after 90 days whether resolved or unresolved.

2.5 Optional diagnostic sharing (per-case opt-in, nothing sent by default)

• When the AI names a folder oddly, you can send that single case, with your explicit consent, to the developer to help improve naming quality. There is no bulk logging and no automatic sending. You must tap [Send] on screen for each folder; if you cancel, nothing is transmitted.
• What is sent is the same shape used for AI naming: up to 3 downsized JPEGs (≤768px wide, with EXIF/GPS and all metadata stripped) plus naming metadata (the AI's candidate name, your corrected name, confidence, model and provider, reason and cues, and optionally the classification prompt) and a free-text note you write. Original photos, full resolution, file paths, and volume names are never sent.
• It includes the same random pseudonymous install_id used for metering. This feature is separate from AI usage metering and does not consume any quota (no charge).
• The destination is developer-controlled Cloudflare (R2/D1, api.actioncam.dev), and cases are retained for up to 30 days, then automatically deleted. You may request deletion anytime at sukmack@gmail.com.

2.6 Direct-distribution lifecycle operations metrics (automatic)

• Direct-distribution macOS/Windows builds, excluding Microsoft Store, send first_launch and version_seen after a successful start. update_completed is sent only when the next successful start verifies a marker written by Sparkle/WinSparkle immediately before installation. An update check or download alone is not counted.
• Fields are a random event UUID, random pseudonymous install_id, event type, current and previous app versions, operating-system and direct distribution labels, and observation/receipt times. File paths, filenames, media content, accounts, emails, and hardware identifiers are excluded; IP addresses are not stored in D1.
• Failures never block the App. Transient failures remain in a local queue until ACK and are retried on a later launch; non-retryable 4xx responses are retained locally as rejected and stop automatic transmission. Server app_events rows are retained in Cloudflare D1 for up to 90 days, then deleted. Microsoft Store packages do not use this custom lifecycle channel.

3. Everywhere your data may go (sub-processors)

The Windows Microsoft Store package does not contact updates.actioncam.dev. Microsoft Store manages installation and updates for that package.

Google's official Gemini API abuse-monitoring policy states that Google may retain prompts, contextual information (which can include the stripped, downsized analysis images supplied as context), and model output for up to 55 days to detect and prevent prohibited-use violations, maintain service safety and security, and make required legal or regulatory disclosures. This is provider-side retention: LIMOD's hosted service handles automatic naming images in memory and does not persist them.

Each sub-processor has its own privacy policy (Cloudflare, Anthropic, Google, OpenAI, Paddle).

3.1 Cross-border transfer of personal data

When you use file content analysis or AI folder naming, or a direct-distribution build sends a lifecycle event, some data is transferred outside Korea to recipients located in the United States. Under Korea's PIPA (Art. 28-8) we disclose the following:

• Items transferred: metadata-stripped downsized images (thumbnails, ≤768px wide), text metadata (including capture date, a representative filename, and a reused existing folder name), a random pseudonymous install_id, the detailed AI-usage metering fields described above, and the lifecycle fields in §2.6. Representative filenames and existing folder names can be user-chosen strings and may contain personal information such as names or places. Original photos, full-resolution files, full file paths, and GPS location are not transferred.
• Destination country: United States. (When: while file analysis or AI naming is in use or just after a successful direct-build start · How: via HTTPS API calls.)
• Recipients: Cloudflare, Inc. (infrastructure for the LIMOD hosted service), Google LLC (Gemini model), and Anthropic, PBC where applicable.
• Purpose and retention/use period: for file content analysis, folder-name classification, and direct-distribution operations metrics. The LIMOD hosted service does not persist images from automatic naming requests; detailed AI-usage metering records and lifecycle events are kept in Cloudflare D1 for up to 90 days. AI providers process request data under their respective API data policies. Google's Gemini API abuse-monitoring policy allows the provider-side retention described above for up to 55 days.
• How to refuse and the effect: turning off both file content analysis and AI folder naming stops the AI naming transfer described above, and the app keeps working normally using date-based folders. Other service traffic may still occur when you make or restore a purchase, an error or crash occurs while error reporting is enabled, you opt in to a per-case naming report, or a direct-distribution build sends lifecycle metrics or checks for updates.

For users in the EU/EEA, the terms and transfer safeguards relevant to transfers to the United States depend on the service provider and service used. Where applicable, a provider's terms may include standard contractual clauses or data processing terms. Contact sukmack@gmail.com for current information about the providers and terms used for IMgest.

4. Retention & deletion

• On-device data is deleted when you remove the app, its settings, and job reports.
• Downsized images sent for AI naming pass through the LIMOD hosted service, are handled in memory only for the naming request, and are not persistently stored there.
• LIMOD does not store images from the automatic import and AI-naming pipeline. This does not override Google Gemini's provider-side abuse-monitoring retention of prompts, context, and output for up to 55 days. Only individual cases you deliberately share with LIMOD via the optional diagnostic sharing in §2.5 are retained for up to 30 days, then automatically deleted (metadata-stripped downsized images ≤3 plus naming metadata). Deletion requests: sukmack@gmail.com.
• Pseudonymous error reports are retained for up to 90 days, then deleted.
• Direct-distribution lifecycle events (app_events) are retained for up to 90 days, then deleted.
• Detailed AI-usage metering records (ai_usage_events) are retained for up to 90 days, then deleted.
• Sanitized results in AI-request deduplication records (ai_folder_requests) are deleted after up to 90 days. Minimal tombstones used to prevent duplicate calls, charges, or refunds remain in those records for as long as needed.
• Current quota balances and charge, refund, and duplicate-processing markers are retained separately for only as long as necessary to provide entitlements and prevent duplicate charges or refunds.
• Paddle webhook recovery records, including the original payload and purchaser email when present, are deleted after 90 days whether resolved or unresolved.
• Each Paddle transaction-index (paddle_transactions) row described in §2.4 is deleted 5 years after it is recorded.
• Separate current entitlement state and markers for refunds or chargebacks, entitlement transfers, and duplicate-grant prevention are retained only for as long as necessary to provide active entitlements, prevent re-grants, and meet legal or dispute-resolution needs.

5. Your rights

Depending on where you live (e.g. EU GDPR, Korea PIPA, California CCPA) you may request access, correction, deletion, or to object to processing. Contact sukmack@gmail.com. Most data lives on your device, so you can manage and delete it directly.

6. Children

The App is not directed to children under 14 (or your local minimum age).

7. Changes

This policy may change; we will notify you of material changes in the app or on the website.

8. Contact

LIMOD — sukmack@gmail.com