Privacy Policy — Cleo

Last updated: 20 October 2026

Cleo ("the app", "we", "us") is developed by RA2 Lab ("ra2lab"). This policy explains what the app does with your data — and, more importantly, what it does not do.

1. The short version

• Your photos and videos never leave your device. All scanning, comparison, blur detection, face grouping and search happen locally on your iPhone or iPad. We do not upload, copy, or store your media on any server. We cannot see your photos.
• You do not need an account. There is no sign-up, no email, no password.
• We do not sell your data, and we do not share it with advertisers. The app contains no advertising SDK and does not use the Advertising Identifier (IDFA). You will never see an App Tracking Transparency prompt, because we do not track you across other apps or websites.
• Deleting is always your decision. The app pre-selects candidates, but nothing is removed until you confirm — and deletion runs through iOS's own system dialog, into your "Recently Deleted" album.
• The only things that leave your device are: anonymous usage statistics, crash diagnostics, subscription status, and — if you use it — the text you type to the in-app assistant, and — only if you connect a Google account to the Email Cleaner — the requests your device makes to Gmail on your behalf. Each is described below.

2. Photos and videos

When you grant photo library access, the app reads your library through Apple's PhotoKit framework in order to:

• find exact duplicates and visually similar photos,
• detect blurred, screenshot, and chat/downloaded images,
• list large videos and compress them, or convert Live Photos to stills,
• compute an on-device search index so you can find photos by description ("cat", "ID card") and group photos by face.

All of this runs on your device. The image analysis models (image-understanding and face-grouping) are bundled with the app and run locally; no image, thumbnail, filename, or asset identifier is ever transmitted to us or to any third party.

The derived index (small numeric fingerprints of your photos) is stored only in the app's private storage on your device. Uninstalling the app deletes it.

Deletion. The app never deletes anything silently. Every removal — from the review screens, from Smart Cleaning, or from a Cleo result card — requires your confirmation, and iOS then shows its own system confirmation. Deleted items go to the Photos app's "Recently Deleted" album, where you can restore them for 30 days.

Secret Library. If you use the Secret Library, the media you import is copied into the app's private container on your device, protected by iOS file encryption and excluded from iCloud backup. Your PIN is stored only as a salted hash on the device. We never receive your PIN or the contents of the vault, and we cannot recover them if you forget the PIN.

3. Contacts

If you use the Contacts tools and grant permission, the app reads your contacts through Apple's Contacts framework to find duplicates and incomplete entries, and to merge or delete them at your request. Contact data is processed entirely on your device and is never uploaded. We receive only the anonymous count of how many contacts were merged or deleted (see §5).

4. Cleo (the in-app assistant)

Cleo answers questions about your library and suggests what to clean. When you send a message, the following is transmitted over an encrypted connection to our backend (api.ra2lab.io), which forwards it to our AI model provider to generate a reply:

• the text of your message and the recent messages in that conversation,
• aggregate facts about your library — counts, total sizes in bytes, and date ranges (for example: "1,240 duplicates, 3.1 GB").

The following is never sent: your photos or thumbnails, filenames, photo identifiers, location data, text recognized inside your photos, or anything derived from faces. Photo search and face grouping are performed locally on your device; only the words you type travel to the network.

Conversations are stored on your device so you can revisit them, and are deleted when you delete a conversation or uninstall the app. On our side, messages are processed only to produce the reply: we do not build a profile from them, we do not sell them, and we do not use them to train AI models. The AI provider that generates the reply processes the text on our behalf as a service provider and is not permitted to use it to train its own models.

If you use voice input, your speech is converted to text by Apple's speech recognition, which — depending on your device and settings — may process audio on Apple's servers under Apple's privacy policy. We do not store your audio.

Cleo can never delete anything by itself; it can only open a review screen where you decide.

5. Analytics and crash reports

To understand whether the app works and where people get stuck, we use two Google Firebase services:

Firebase Analytics — anonymous, aggregated usage events, for example: which onboarding page you reached, that a paywall was shown, that a scan finished (number of files, megabytes, duration), that a cleanup completed (number of photos, megabytes), that an assistant query ran (query type and number of results), and whether a tool such as video compression, contact merging, or email cleanup succeeded or failed. Events include a device-generated identifier (Apple's Vendor Identifier, IDFV) and general device/locale information, plus whether the account is on a paid plan.

Firebase Crashlytics — crash and error diagnostics: stack traces, device model, OS version, and a few technical values that tell us the scale of the work being done when a crash happened (approximate number of assets in the library, which scan stage was running, batch size of a deletion).

We deliberately do not send: filenames, photo or video identifiers, contact names, email addresses, email subjects or bodies, the questions you ask Cleo, or any content of your photos. Analytics carries counts and category-level labels only.

The app does not link this data to your identity, does not use it to track you across other apps or websites, and contains no advertising or attribution SDK.

6. Email Cleaner (Google account data)

The Email Cleaner is optional, and it is being rolled out — it may not be available in your version of the app yet. This section applies only if you use it and choose to connect a Google account. If you never connect one, the app has no access to your email at all.

What we request. With your consent, we request the Gmail scope https://www.googleapis.com/auth/gmail.modify, plus your basic profile (email address) so the app can show which account is connected.

What we do with it. The app calls the Gmail API directly from your device to:

• count and list messages in categories such as Promotions, Social, and Updates, and read the message you open in order to display it,
• move messages you have selected to the Gmail Trash (recoverable in Gmail for 30 days) — the app never deletes mail permanently,
• read List-Unsubscribe headers and, at your request, send an unsubscribe request from your account.

Where it goes. Your email data is fetched to your device and shown to you. We do not copy your messages to our servers, we do not store their content, and we do not use them for any purpose other than performing the action you asked for in the moment you asked for it. Your Google access token is stored on your device only. What we keep is the anonymous counter described in §5 — for example "emails trashed: 128" — with no addresses or subjects.

Google Limited Use. Cleo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties, do not use it for advertising, and do not use it to train AI or machine-learning models — including generalized models. Human access is not permitted except with your explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized.

Revoking access. You can disconnect at any time from Settings inside the app, or from your Google Account at myaccount.google.com/permissions. Revoking immediately ends the app's ability to read anything from your mailbox.

7. Purchases and subscriptions

Subscriptions are sold through Apple's In-App Purchase. Apple processes your payment — we never see your card details, billing address, or Apple ID.

We use RevenueCat to check whether your subscription is active. RevenueCat receives an anonymous identifier it generates, your purchase receipt from Apple, and device/platform information. We use it only to unlock paid features and to know that a purchase, restore, refund, or expiration happened.

To talk to our backend, the app also creates an anonymous Firebase account — an identifier with no name, email, or password attached. It exists solely so requests to api.ra2lab.io can be authenticated.

8. What we never collect

• Your photos, videos, or any copy, thumbnail, or crop of them.
• Filenames, photo identifiers, or photo location (EXIF/GPS) data.
• Faces, face templates, or any biometric identifier leaving the device.
• Text recognized inside your photos (for example, ID card numbers).
• Contact names, phone numbers, or email addresses from your address book.
• Email content, subjects, or sender addresses.
• Your Secret Library PIN or its contents.
• Your precise location.
• The Advertising Identifier (IDFA), or any cross-app tracking data.

9. Third-party services

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

10. Retention and how to delete your data

• On-device data (photo index, conversations, Secret Library, settings, keep-lists): deleted when you delete the app, or from within the app where offered.
• Analytics and crash data: retained by Google Firebase for a limited period under its standard retention settings (a matter of months), then deleted automatically.
• Assistant messages: sent to generate the reply. We do not keep a conversation history on our servers — the copy you can read back lives on your device. Routine server logs may contain request data for a short period for security and reliability purposes.
• Google account data: not retained by us at all; revoke access as described in §6 to cut it off immediately.

To request deletion of anything associated with your device, email admin@ra2lab.io from the device's context (tell us the approximate date and country of use — we have no name or email to look you up by, so this is the only handle we can work with). We will respond within 30 days.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to lodge a complaint with your local data protection authority.

If you are in the EEA/UK: we process anonymous usage and crash data on the basis of our legitimate interest in keeping the app stable and usable; assistant messages and Gmail access on the basis of performing the service you requested (contract) and your consent to the relevant permission; purchase data on the basis of contract. You can withdraw a permission at any time in iOS Settings, and revoke Google access as described in §6.

If you are in California: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising.

Data may be processed on servers located in the United States and other countries by the providers listed in §9, under their respective safeguards for international transfers.

12. Children

Cleo is not directed to children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us with data, contact us and we will delete it.

13. Security

Network traffic uses TLS. The Secret Library and on-device index are kept in the app's private container with iOS file protection enabled, and the Secret Library is excluded from iCloud backups. No system is perfectly secure, but because your photos and contacts never reach our servers, there is no copy of them for us to lose. The same holds for email content: it never reaches our servers.

14. Changes to this policy

If we change what data the app collects, we will update this page and the "Last updated" date above, and — for material changes — surface a notice in the app.

15. Contact

Questions, requests, or complaints: admin@ra2lab.io (RA2 Lab).

Terms of Use. This page covers privacy only. Your use of Cleo is governed by Apple's standard Licensed Application End User License Agreement.