Privacy Policy

This Privacy Policy explains how ShareReady (“the App”) processes data. ShareReady prepares photos for sharing directly on your iPhone, and we built it so that as little data as possible ever leaves your device. This policy describes exactly what does - and what never will.

• 1. Core principle: on-device by design
• 2. Who we are
• 3. Your photos stay on your iPhone
• 4. Usage analytics (TelemetryDeck)
• 5. Purchases (Apple & RevenueCat)
• 6. iCloud sync of presets and watermarks
• 7. Feedback, ratings, and support
• 8. This website
• 9. What we do not collect
• 10. Service providers & international transfers
• 11. Data retention
• 12. Data protection (GDPR)
• 13. Your US privacy rights
• 14. Children’s privacy
• 15. Changes to this Privacy Policy
• 16. Contact

1. Core principle: on-device by design

ShareReady is built to work locally on your device:

• No user accounts
• No advertising and no advertising identifiers (the App does not request the IDFA and does not participate in Apple’s App Tracking Transparency system, because it does not track)
• No uploading of your photos, thumbnails, or photo metadata to our servers - Hawkwise Labs operates no backend servers for this App
• The only internet connections the App makes are pseudonymized usage analytics (section 4), purchase validation via Apple and RevenueCat (section 5), and synchronization of your settings through your own iCloud (section 6)

2. Who we are

The App is developed and provided by:

Hawkwise Labs OÜ
Tornimäe tn 5, 10145 Tallinn, Estonia
Email: contact@hawkwise-labs.com
Website: https://www.hawkwise-labs.com/

Hawkwise Labs OÜ is the controller within the meaning of Art. 4(7) GDPR for the processing described in this policy. Full company details are in our Imprint. Use of the App is governed by our Terms of Use.

3. Your photos stay on your iPhone

ShareReady never has blanket access to your photo library. You hand individual photos to the App through the iOS photo picker or the system share sheet - the picker runs outside the App’s process, and only the photos you actively select are handed over. The App does not request a photo-library permission and cannot browse your library on its own.

Everything that happens next happens on your device:

• Working copies. The App creates working copies inside its own local storage container. Your originals in Apple Photos remain untouched.
• Metadata removal at import. Working copies are re-encoded from pixels when they enter the App, so EXIF data, capture date, and GPS location from the original never reach an exported file.
• On-device detection. Face and license-plate detection for the Anonymize feature uses Apple’s Vision framework directly on the device. No image, thumbnail, or detection result is transmitted anywhere.
• On-device rendering. Cropping, watermarking, blurring, format conversion, and the final export are all rendered locally.
• You control the export. Finished versions leave the App only through the share destination you choose in the iOS share sheet. Exports are not automatically written back to Apple Photos.
• Automatic cleanup. Working copies are temporary by default and are cleared automatically. You can keep a set longer if you choose to.

The App’s share extension (the “ShareReady” entry in the system share sheet) stages the photos you share into the App’s local container and contains no analytics, purchase, or network components at all.

Hawkwise Labs has no remote access to your device, your photos, or your exports.

4. Usage analytics (TelemetryDeck)

To understand which features are used and to improve the App, we use the privacy-focused analytics service TelemetryDeck, provided by TelemetryDeck GmbH, Von-der-Tann-Str. 54, 86159 Augsburg, Germany. TelemetryDeck processes analytics data exclusively on servers in the European Union (Frankfurt, Falkenstein, and Nürnberg in Germany; Amsterdam in the Netherlands).

What is sent

• A hashed identifier. Before anything is sent, the device’s vendor identifier (Apple’s per-developer “identifierForVendor” - not the advertising ID) is combined with an app-specific salt and hashed with SHA-256 on your device. When the signal arrives, TelemetryDeck adds a second, server-side salt and hashes the value again. Neither we nor TelemetryDeck can reconstruct the original identifier from the stored value.
• A small number of events. A session-start signal, and events marking completion of the onboarding steps: which pain points and share destinations were selected, whether a watermark was configured and whether it is text- or image-based, and whether the share sheet was opened during the guided setup. Event payloads contain only yes/no flags, counts, and fixed keys - never free text, photo content, or the names, text, or logos of your watermarks.
• Technical metadata attached by the SDK. App version and build number, operating-system version, device model and type, platform, language, region and locale, time zone, screen properties and orientation, system display and accessibility settings (for example Reduce Motion or Bold Text), calendar buckets (weekday, hour of day), aggregate usage counters (number of sessions, distinct days used), and a timestamp rounded to the nearest hour.

What is not sent or stored

• IP addresses are never stored by TelemetryDeck - not in databases and not in log files
• No cookies and no comparable tracking technologies are used
• No advertising identifiers, no names, no email addresses, no contact data
• No photo data of any kind

TelemetryDeck describes this data as anonymized as defined by the GDPR, because the double-salted hashing rules out re-identification. Because the hashed identifier is nevertheless stable for an installation, we take the conservative view and treat these signals as at most pseudonymous data - and disclose them fully in this policy, including for the purposes of your rights in sections 12 and 13. The TelemetryDeck SDK is open source and can be audited at github.com/TelemetryDeck; TelemetryDeck’s own privacy documentation is at telemetrydeck.com/privacy.

Analytics collection is built into the App and cannot currently be switched off in the App’s settings. The legal basis for this processing is Art. 6(1)(f) GDPR - our legitimate interest in understanding, maintaining, and improving the App using data that cannot identify you.

5. Purchases and subscriptions (Apple & RevenueCat)

ShareReady is free to use; some features require the paid “ShareReady Pro” upgrade offered through Apple In-App Purchase.

Payment is handled by Apple

Payments, billing, invoicing, and refunds are processed entirely by Apple. Hawkwise Labs never receives your payment card details, billing address, or Apple ID. Apple processes this data as an independent controller under Apple’s privacy policy.

Entitlement management by RevenueCat

To validate purchases and unlock Pro features reliably across reinstalls, we use RevenueCat, provided by RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. RevenueCat acts as our processor and receives:

• A random anonymous app-user ID generated when the App first runs. It is not derived from your device, your identity, or your Apple ID, and a fresh one is generated if you delete and reinstall the App.
• The Apple receipt and the resulting purchase and transaction history for the App (products bought, subscription status, renewal and expiry dates)
• Basic technical information: device type, operating-system version, and first-seen/last-seen timestamps
• An approximate country, derived transiently from the IP address of the request; RevenueCat drops the IP address itself immediately after this lookup and does not store it

We never attach your name, email address, or any other contact information to the RevenueCat record. So that purchase events can be reflected in our usage statistics, the record is additionally labelled with the same hashed analytics identifier described in section 4; purchase events shared with our analytics remain in that pseudonymized form.

RevenueCat stores this data on Amazon Web Services infrastructure in the United States. The transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), including the UK International Data Transfer Addendum and Swiss amendments, which are incorporated in RevenueCat’s Data Processing Agreement together with its list of sub-processors. RevenueCat’s privacy policy is at revenuecat.com/privacy.

The legal basis for purchase processing is Art. 6(1)(b) GDPR (performance of the contract - providing the Pro features you purchased and restoring them when you reinstall). The legal basis for reflecting purchase events in our pseudonymized usage statistics is Art. 6(1)(f) GDPR.

6. iCloud sync of presets and watermarks

Your destination presets, watermark configurations (including a downscaled copy of a logo image you add to a watermark), and favorite groups can synchronize between your devices via Apple’s iCloud key-value storage. This data is stored in the private iCloud space of your Apple ID:

• Hawkwise Labs does not operate this storage and has no access to your private iCloud data
• Photos, working copies, and exports are never synced - they stay in the App’s local container on each device
• Synchronization follows your device’s iCloud configuration; Apple processes this data as an independent controller under Apple’s privacy terms
• If you delete the App, synced settings may remain in your iCloud until you remove them via your iCloud storage settings

The legal basis is Art. 6(1)(b) GDPR - keeping your configuration available across your devices as part of the service.

7. Feedback, ratings, and support

• Feature requests. “Request a feature” in the App opens our public feedback board at shareready.userjot.com in your browser. The App sends nothing there automatically. Anything you post on the board is processed by its operator, UserJot, under UserJot’s own privacy policy.
• Ratings. The App may occasionally show Apple’s standard in-app review prompt. Whether and when the prompt was shown is recorded only locally on your device; your rating itself is submitted to Apple, not to us.
• Email. If you contact us by email, we process your email address and the content of your message to answer your request (Art. 6(1)(b) and (f) GDPR).

8. This website

This website is a static site. It sets no cookies, runs no analytics, and embeds no third-party trackers. When you visit it, our hosting provider processes the technical data your browser transmits (IP address, requested page, user agent, timestamp) in server logs as technically required to deliver the site and defend it against abuse (Art. 6(1)(f) GDPR). Log data is not merged with any other data and is deleted on the provider’s standard schedule.

9. What we do not collect

ShareReady does not:

• create user accounts or user profiles
• track you across apps or websites, or request the advertising identifier (IDFA)
• collect your name, email address, phone number, or contacts (unless you email us yourself)
• collect precise location data - GPS data contained in photos is removed at import and never leaves the device
• send your photos, thumbnails, or photo metadata to Hawkwise Labs or third parties
• sell personal data or share it for cross-context behavioral advertising
• engage in profiling or automated decision-making with legal or similarly significant effects

10. Service providers and international transfers

We have concluded the required data-processing terms with RevenueCat (Art. 28 GDPR). TelemetryDeck’s supplemental agreement on data protection applies to its service; TelemetryDeck takes the position that it processes no personal data because the signals are anonymized before and upon arrival. Copies of or links to these agreements are available on request at contact@hawkwise-labs.com.

11. Data retention

• Photos and working copies exist only on your device. Working copies are cleared automatically after a short period unless you choose to keep a set; deleting the App removes its entire local container.
• Exports live wherever you sent them - the destinations you choose in the share sheet are outside the App’s control.
• Analytics signals are retained by TelemetryDeck in the pseudonymized form described in section 4 - actively queryable for our plan’s retention window and archived afterwards. They cannot be attributed to an identifiable person.
• Purchase records are retained by RevenueCat for as long as needed to provide and restore your purchases and to meet statutory obligations. We can have a purchase record permanently deleted on request (section 12.3).
• iCloud-synced settings remain in your iCloud according to your iCloud configuration, even if you delete the App, until you remove them.
• Email correspondence is kept as long as needed to handle your request and for a reasonable period afterwards, unless statutory retention requires longer.

12. Data protection (GDPR)

This section applies where the General Data Protection Regulation (GDPR) applies. As Hawkwise Labs OÜ is established in Estonia (EU), the GDPR governs our processing activities.

12.1 Legal bases

Photos in your library may contain sensitive content or metadata (Art. 9 GDPR). The App processes photos exclusively on your device, at your instruction, and never transmits them; the anonymization feature exists precisely to help you remove sensitive detail before sharing.

12.2 Your rights

You are not required to provide any personal data to use the App - there is no account, and no form in the App asks for personal information.

If the GDPR applies to you, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interest (Art. 21). Where processing is based on consent, you may withdraw it at any time (Art. 7(3)) without affecting prior processing.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR) - in our case the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the authority in your country of residence.

12.3 Exercising your rights - and an honest limitation

Send any request to contact@hawkwise-labs.com. We respond within 30 days; complex requests may take up to 60 additional days with notice.

Practical scope: because the App is designed not to identify you, we usually cannot link analytics or purchase data to a person (Art. 11 GDPR). Where we cannot identify you, Articles 15–20 may not technically apply - but if you provide information that lets us locate your records, we will act on it. In particular, if you send us your App Store purchase information (for example the order ID from your Apple receipt), we can locate the associated RevenueCat customer record and have it permanently deleted. Photos and edits never reach us, so there is nothing for us to delete there: removing the App removes all of its local data, and iCloud-synced settings can be removed via your iCloud storage settings.

12.4 Security

• All connections the App makes are encrypted in transit (TLS)
• Identifiers are salted and hashed on the device before transmission (section 4)
• We operate no servers of our own for the App, which removes an entire class of risk
• Our providers encrypt stored data at rest and maintain industry-standard security programs

12.5 Data breach notification

In the event of a personal-data breach affecting data held by us or our processors, we will notify the Estonian Data Protection Inspectorate within 72 hours where required by Art. 33 GDPR, and affected individuals without undue delay where required by Art. 34 GDPR. Our processors are contractually obligated to notify us promptly of breaches affecting data they process for us.

13. Your US privacy rights

This section supplements the policy for residents of the United States.

13.1 Applicable US privacy laws

Depending on your state of residence, you may have rights under the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA) and CalOPPA, the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act (OCPA), or similar laws. If your state’s law is not listed, contact us and we will address your request under applicable law.

13.2 Information we collect

In the preceding twelve (12) months, we have collected the following categories of personal information:

13.3 Sale and sharing of personal information

We do not sell personal information and have not sold it in the preceding twelve (12) months. We do not share personal information for cross-context behavioral advertising. Because we neither sell nor share personal information, no opt-out mechanism is required. TelemetryDeck and RevenueCat process data for us as service providers and are contractually restricted to that role.

13.4 Your rights

• Right to know / access the categories and specific pieces of personal information we have collected, the sources, purposes, and recipients
• Right to delete personal information we have collected, subject to legal exceptions
• Right to correct inaccurate personal information - note that analytics data is not attributed to identities, so correction may not be technically feasible; contact us and we will work with you
• Right to opt out of sale, sharing, or targeted advertising - not applicable, as we do not sell or share personal information or serve targeted advertising
• Right to limit use of sensitive personal information - not applicable, as we do not collect it
• Right to non-discrimination for exercising any of these rights

13.5 How to exercise your rights

Email contact@hawkwise-labs.com with “Privacy Request” in the subject line. We will verify your request and respond within 45 days; complex requests may take up to 45 additional days with notice. You may designate an authorized agent; we may require proof of the agent’s authorization. The practical-scope note in section 12.3 applies equally here: for data we cannot link to you, we may need additional information from you (such as your Apple order ID) to locate a record.

13.6 Do Not Track signals (CalOPPA)

Neither the App nor this website tracks users over time and across third-party websites or services, so there is no tracking for a Do Not Track signal to prevent. No third parties collect personally identifiable information about your online activities over time and across different websites through the App. We will notify you of material changes to this policy by updating the date at the top of this page (see section 15).

14. Children’s privacy

The App is not directed at children under 13 (or under 16 where a higher age of consent applies) and contains no social features, advertising, or features designed to appeal to children. We do not knowingly collect personal data from children. If we become aware that we have inadvertently received personal data from a child, we will delete it promptly.

15. Changes to this Privacy Policy

We may update this policy to reflect changes in the App, legal requirements, or platform requirements. For material changes we will update the “Last updated” date at the top of this page and, where practicable, provide notice in the App. The current version is always available at shareready.app/privacy.

16. Contact

Questions about privacy and data protection in ShareReady:

Email: contact@hawkwise-labs.com
Website: https://www.hawkwise-labs.com/

We aim to respond to all inquiries within 10 business days.