Naru Privacy Policy
Naru is a photo-culling app for Android. It helps you step through the photos already on your phone and decide which ones to keep.
The short version
Your photos never leave your device.
Naru does not upload, copy, back up or transmit your images. It does not send their filenames, their album or folder names, their EXIF data, their capture dates, or their MediaStore identifiers. Nothing about the content of your photo library is transmitted anywhere, whatever settings you choose.
Naru has no account system, no login, and no server of its own. It shows no advertising
and does not collect an advertising identifier — the AD_ID,
ACCESS_ADSERVICES_AD_ID and ACCESS_ADSERVICES_ATTRIBUTION
permissions are all explicitly removed from the app.
Two kinds of data can leave your device, both described in detail below:
- Usage statistics, which are anonymous and sent only if you turn them on. They are off until you accept the prompt, and you can switch them off again at any time.
- Crash reports, sent when the app crashes, so that the crash can be fixed.
Neither contains anything about your photos.
1Data stored on your device
The following is kept on your phone in app-private storage and is never transmitted:
- Which photos you have marked as seen.
- Which photos you have marked to move to trash.
- Your settings: grouping option, items per group, reminder and startup preferences.
- The last album you had open, if "continue where you left off" is enabled.
- Your answer to the usage-statistics prompt.
- Small flags recording which one-time tips you have already been shown, and whether you have opened the sorter before.
The seen and marked lists are stored as MediaStore identifiers — numbers issued by Android that are only meaningful on the phone that issued them. This data is excluded from Android cloud backup and from device-to-device transfer, so it stays on the device that created it. Uninstalling Naru deletes all of it.
2How Naru reads your photos
Naru asks Android's MediaStore for a list of the images on your device. It reads four fields per image: the MediaStore id, the folder path, the date the image was added, and the orientation flag needed to display it the right way up. It does not read EXIF metadata, and it does not open image files for any purpose other than showing them to you.
Thumbnails and fullscreen previews are decoded inside the app's own process, directly from
the content:// address Android provides. No copy of a photo is made and nothing
is sent anywhere.
When you confirm a deletion, Naru hands the selected items to Android's own trash mechanism. Android — not Naru — shows the confirmation dialog, and the photos are moved to the system trash, where they stay recoverable for as long as your device's gallery keeps them. Naru never permanently erases a photo itself.
3Usage statistics (optional, off by default)
Naru can send anonymous usage statistics through Google Firebase Analytics.
This is off by default. Analytics collection is disabled in the app manifest and is only switched on after you accept the prompt, which appears on first launch once your photos have finished loading. Nothing is sent before you answer. Declining is a genuine choice: everything in the app works identically either way. You can change your mind at any time in Settings → Privacy → Share usage statistics, and turning it off stops collection immediately.
What is collected when you opt in
Every event Naru is able to send is listed here, with the exact information attached to it.
Counts marked (range) are reduced to a coarse bucket before sending — one of
0, 1-10, 11-100, 101-500,
501-1k, 1k-5k or 5k+ — so the real size of your photo
library is never transmitted.
| Event | What is attached |
|---|---|
screen_view | Which screen was opened: splash, albums, album content, sorter or settings |
album_opened | Number of groups (range) and number of images (range) in the album — never its name |
permissions_granted, permissions_denied,
permissions_rationale_shown | Nothing beyond the event itself |
trash_requested | How many photos were sent to the delete confirmation (range) |
trash_result | Whether the deletion succeeded |
restore_selections_prompted | How many previous selections were found (range) |
restore_selections | Whether you chose to restore them, and how many (range) |
media_load_finished | Number of albums (range), number of images (range), and how long the scan took, in seconds |
selections_session_started | Whether multi-select began from an image or from a group header |
mark_seen, mark_unseen, mark_trash,
unmark_trash | How many photos were marked (range) |
sorting_session_started | How many photos the session covers (range) |
image_trash_toggled | Whether a photo was marked or unmarked |
sorting_session_finished | Photos seen (range), photos marked (range), and time spent, in seconds |
group_by_setting_changed | The new value: day, month or number of items |
items_per_bucket_setting_changed | The new number of items per group |
notifications_enabled_setting_changed | Whether reminders were turned on or off |
resume_album_setting_changed | Whether "continue where you left off" was turned on or off |
No event contains any information about an individual photo — no id, no filename, no album name, no date, no location.
Collected automatically by the Firebase SDK:
- A randomly generated app instance identifier, reset if you reinstall or clear app data.
- Your approximate location (country and region), derived from your IP address. Firebase does not store the IP address itself in Analytics.
- Device model, operating system version, app version, device language.
Naru does not enable Google Signals, ads personalisation or cross-device tracking. Ad storage, ad user data and ad personalisation consent are all set to denied unconditionally in code, regardless of your analytics choice.
4Crash reporting
Naru includes Firebase Crashlytics. When the app crashes, a report is sent so the fault can be diagnosed and fixed. A crash report contains:
- The stack trace of the crash — the sequence of code that was running.
- Device state at the time: device model, operating system version, app version, and memory and storage conditions.
- A Crashlytics installation identifier, reset if you reinstall or clear app data.
A crash report never contains a photo, a thumbnail, a filename, an album name, or any MediaStore identifier.
5Legal basis and your rights
Where the UK GDPR or EU GDPR applies, the legal basis for processing usage statistics is your consent (Article 6(1)(a)), obtained through the in-app prompt before any collection begins. You may withdraw consent at any time in Settings, with no effect on the app's functionality and no effect on the lawfulness of processing carried out before withdrawal.
The legal basis for crash reporting is our legitimate interest (Article 6(1)(f)) in keeping the app working correctly, weighed against the fact that a crash report carries nothing about you or your photos.
You have the right to access, correct, erase, restrict and object to the processing of your personal data, and to lodge a complaint with your data protection authority (in the UK, the Information Commissioner's Office at ico.org.uk).
To erase the data associated with your installation, turn off "Share usage statistics" and uninstall the app, or contact us at naruappsupport@gmail.com.
6Recipients, transfers and retention
Analytics and crash data are processed by Google LLC / Google Ireland Limited acting as our data processor, under Google's Data Processing Terms. Data may be processed on servers in the United States; Google relies on the EU-US and UK-US Data Privacy Framework and Standard Contractual Clauses for these transfers.
Analytics data is retained for the shortest period Firebase offers and then deleted automatically. Crash reports are retained for 90 days.
We do not sell your data and do not share it with any party other than Google in the processor role described above.
7Children
Naru is not directed at children under 13 and we do not knowingly collect data from them.
8Permissions Naru requests
Which media permission Naru asks for depends on your Android version:
| Android version | Permission | What it is for |
|---|---|---|
| Android 11–12L | READ_EXTERNAL_STORAGE | To list and show your photos. |
| Android 13 | READ_MEDIA_IMAGES and READ_MEDIA_VIDEO | To list and show your photos. |
| Android 14 and later | READ_MEDIA_VISUAL_USER_SELECTED | Lets you grant access to only some of your photos rather than all of them. Naru works with a partial selection. |
Naru reads images only. The video permission is requested because Android 13 groups images and video into the same permission prompt; Naru never queries, displays or touches video files. All media access is used entirely on device.
Naru also requests notifications (POST_NOTIFICATIONS) —
optional, and only for the daily sorting reminder at 19:00 local time, which you can turn off
in Settings. The check for whether anything is left to sort runs entirely on your device, and
the reminder sends nothing anywhere.
9Opening this policy
Tapping the privacy policy link in the app opens https://naruapp.co/privacy/ in
an in-app browser tab. Naru attaches no information about you or your photos to that request.
As with visiting any website, the site's host sees the ordinary request details, including
your IP address.
10Changes
If this policy changes materially, the updated version will be published here and, where the change concerns what we collect, you will be asked for consent again.
11Contact
Questions about this policy or your data: