SweeperX — Privacy Policy

Effective date: 24 August 2026 Version: 1.0 Applies to: the SweeperX iOS application (App Store ID com.syleniainc.cleanslate), the SweeperX Home Screen widgets, and the website at https://sweeperx.app.

---

In short

This summary is word-for-word identical to the privacy notice shown inside the app, under Settings → Privacy Policy. If the two ever disagree, treat it as a bug and report it to info@syleniainc.com.

What we collect Nothing. SweeperX has no account, no analytics, no advertising identifiers and no third-party SDKs. There is no server to send anything to.

Your photos, files and contacts Scanning, comparing and compressing all happen on this iPhone. Your media never leaves the device, and SweeperX never uploads, backs up or transmits it.

Your Secret Space Items you move into the vault are encrypted with a key stored in this iPhone's Keychain. The key travels only inside your own encrypted device backups, never to us and never to iCloud Keychain sync.

Your purchase The SweeperX Pro unlock is handled entirely by Apple's App Store. We never see your payment details, and we receive no personal information from the transaction.

Permissions Photos, Contacts and Face ID access are requested only for the features that need them, and can be withdrawn at any time in Settings.

Who we are SweeperX is made by Csaba Farkas, trading as Sylenia, in Salzburg, Austria. Questions: info@syleniainc.com

You can verify all of this yourself. Put your iPhone in Airplane Mode and use SweeperX normally. Every feature except the one-time purchase works, because the app never needed a connection. You can also check iOS Settings → Privacy & Security → App Privacy Report, which records every domain an app contacts. The only domain listed for SweeperX is Apple's own StoreKit host, contacted when the one-time purchase goes through; there is no other destination.

---

1. Who we are

SweeperX is made and published by:

Csaba Farkas, an individual developer, trading as Sylenia Münchner Bundesstraße 121b/Top 5, 5020 Salzburg, Austria Email: info@syleniainc.com

Sylenia is a trading name, not a company. There is no corporation, GmbH, or other legal entity behind SweeperX — it is made and published by one individual, who is personally the data controller identified here. We mention this because it is the kind of thing a privacy policy should not obscure: when you write to the address above, you are writing to a person, not a department.

Under the EU Digital Services Act, Apple verifies the identity of traders distributing apps in the EU and publishes the trader's name, address, email address and phone number on the App Store listing. The identity shown there and the identity shown here are the same person, by design.

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), Csaba Farkas is the data controller for any personal data processed in connection with SweeperX and the sweeperx.app website.

No Data Protection Officer has been appointed. Under GDPR Art. 37 one is not required, because the processing here does not consist of large-scale processing, regular and systematic monitoring of data subjects, or processing of special categories of data. Privacy enquiries reach the developer directly at the address above.

Separately from this policy, Austrian law requires a commercial website to publish an Impressum identifying its operator. Ours is at https://sweeperx.app/impressum.

Because the controller is established in Austria, the lead supervisory authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde). Contact details are in §12.

2. The short version of what this policy has to say

Most privacy policies are long because the company behind them collects a great deal and must enumerate it. This one is long for the opposite reason: explaining precisely why an app that reads your entire photo library and address book collects nothing takes more words than collecting would.

SweeperX contains no networking code of any kind. There is no HTTP client, no socket, no analytics framework, no crash reporter, no advertising SDK, and no third-party library of any description — every component it is built from is an Apple system framework shipped with iOS. There is no SweeperX server, because there is nothing for one to do.

3. Personal data we collect: none

We do not collect, receive, store, sell, share, rent, or otherwise process any personal data about you.

Specifically, and without limitation, SweeperX does not:

• create, require, or offer a user account, login, or profile;
• ask for your name, email address, phone number, date of birth, or postal address;
• collect device identifiers, including the Identifier for Advertisers (IDFA), the Identifier for Vendors (IDFV), advertising IDs, or any fingerprint derived from your hardware;
• include any analytics, telemetry, attribution, crash-reporting, A/B-testing, or session-recording software;
• display advertising of any kind, or contain any advertising network code;
• request your location, or ask iOS for permission to determine it;
• read your clipboard, calendar, reminders, health data, microphone, or camera;
• transmit your photos, videos, files, contacts, or any data derived from them to us or to anyone else.

Our App Store privacy declaration therefore reports "Data Not Collected", and the app's privacy manifests (PrivacyInfo.xcprivacy, present in both the app and the widget) declare NSPrivacyTracking = false, an empty tracking-domain list, and an empty collected-data-types list. These are not aspirational statements. They are checked by Apple against the app's actual behaviour during review, and the empty tracking-domain list in particular would fail review if any network traffic existed.

4. Tracking

SweeperX does not track you, as Apple's App Tracking Transparency framework and the App Store guidelines define tracking. We do not link any information about you or your device with data from third parties, and we do not share any information with data brokers.

Because there is nothing to ask about, SweeperX never presents the "Allow app to track your activity?" prompt.

5. What the app reads on your device, and why

SweeperX is a storage cleaner. It cannot tell you what is taking up space without looking at what is on your phone. Everything in this section happens entirely on your iPhone, in the app's own sandbox, and none of it is transmitted anywhere.

For transparency, these correspond to the following declared reasons in the app's privacy manifest: C617.1 (file timestamps, displayed to the user), E174.1 (disk space, displayed to the user), and CA92.1 / 1C8F.1 (app preferences, in the app's own domain and in its App Group respectively).

We never see any of it. These reads happen in a process running on your phone, and there is no code path by which their results could leave it.

6. Location data — the honest detail

SweeperX does not request access to your location, and no location permission prompt will ever appear. There is no NSLocationWhenInUseUsageDescription in the app.

However, one part of the app does touch location metadata that is already embedded in your own photos, and we would rather explain it than let you discover it and wonder.

When SweeperX compresses a photo or video, or converts a Live Photo to a still, it does not modify your original. It writes a new, smaller copy into your library and then — with your confirmation — removes the original. To make the copy a faithful replacement, SweeperX copies the original's creation date, favourite flag, and GPS coordinates onto the new asset. Without this, every compressed photo would fall out of the Photos app's Places map and its date ordering.

The same applies to the Secret Space: an item you move into the vault has its coordinates recorded inside the encrypted index, so that restoring it to your library returns it to the right place on your map.

In both cases the coordinates are read from your own photo, written back to your own photo or into your own encrypted vault, and never transmitted, aggregated, or seen by us.

7. Your Secret Space (the encrypted vault)

The Secret Space stores photos and videos in an encrypted container inside the app's private storage, so they no longer appear in the Photos app.

• Files are encrypted using AES-256 in GCM mode, applied in 4 MB chunks so that a large video can be encrypted without exhausting memory, and so that tampering with any part of a file is detected rather than silently decrypted into corrupted data.
• The vault's master key is a 256-bit key generated on your device by Apple's CryptoKit and stored in the iOS Keychain, under a Keychain item that does not synchronise to iCloud.
• The vault's index — the list of what is inside it, including original filenames and dates — is itself encrypted. Someone with access to the raw files sees only opaque encrypted blobs.
• Access is gated by a PIN you choose, or by Face ID / Touch ID if you enable it. Biometric matching is performed by Apple's Local Authentication framework against data held in the Secure Enclave. SweeperX never receives your biometric data — iOS only reports success or failure.
• A recovery key is generated when you set up the vault, and is shown to you once. It is stored only in a form that is itself encrypted; we do not hold a copy.

Please read this carefully: we cannot recover your vault. There is no backdoor, no master override, and no reset we can perform, because we do not have your key and have no way to obtain it. If you lose both your PIN and your recovery key, the contents of your Secret Space are permanently and irreversibly inaccessible. This is the necessary consequence of encryption that actually works.

Your vault contents are included in an encrypted iPhone backup, and the key is included in an encrypted backup made through Finder or iTunes with the "Encrypt local backup" option enabled. An unencrypted backup will not carry the key.

8. Your purchase

SweeperX offers a single optional in-app purchase: SweeperX Pro, a one-time, non-consumable unlock. There is no subscription, no recurring charge, and no expiry.

SweeperX is sold worldwide. The price is set once, in US dollars, and Apple converts it to each storefront's local currency and applies whatever sales tax or VAT that territory requires. The price shown to you in the App Store, in your own currency and inclusive of applicable tax, is the price you pay — and you pay it once.

The entire transaction is handled by Apple through the App Store, using Apple's StoreKit framework. When you buy SweeperX Pro:

• Your payment details are entered into Apple's own interface and are processed by Apple. We never see, receive, or store your card number, billing address, Apple Account email, or name.
• The app determines whether you own Pro by asking iOS locally, through StoreKit's Transaction.currentEntitlements. This check is performed on-device and works without a network connection.
• We receive no personal data from Apple in connection with your purchase. Apple provides us with aggregated, anonymised sales reporting — units sold per territory per day — from which no individual can be identified.

Apple's handling of your payment is governed by Apple's Privacy Policy, available at https://www.apple.com/legal/privacy/. For purchase problems, refunds, and receipts, Apple is the merchant of record: https://support.apple.com/billing.

Restoring a purchase on a new device likewise queries Apple, not us.

9. Data stored on your device by the app

SweeperX stores a small amount of its own state on your iPhone. This never leaves the device, is not personal data about you in any meaningful sense, and is deleted entirely when you delete the app — with one exception noted below.

The exception: iOS Keychain items can persist after an app is deleted. The vault key and the free-tier counter are stored in the Keychain. If you delete SweeperX and reinstall it, your free-tier allowance resumes where it left off rather than resetting — this is deliberate, and is how the free tier remains a genuine one-time trial rather than something that resets on reinstall. You can remove these items by erasing the device, or by contacting us for instructions.

10. Permissions, and how to withdraw them

You may grant Photos access in full or limited form. SweeperX supports limited access and will work with only the photos you select, though duplicate detection is necessarily restricted to that selection.

To withdraw any permission at any time: iOS Settings → Privacy & Security → (Photos / Contacts / Face ID) → SweeperX. Or: iOS Settings → SweeperX. Withdrawal takes effect immediately.

11. The sweeperx.app website

This section covers the website, which is technically separate from the app.

The website is a set of static pages. It does not use cookies, does not run analytics or advertising scripts, does not embed third-party trackers, social widgets, or hosted fonts, and has no login, comment system, or form that collects your details.

The website is hosted by Netlify, Inc. (United States), acting as our data processor under a data processing agreement. Netlify automatically records standard server access logs — your IP address, the page requested, the time, your browser's user-agent string, and the referring page — for the purpose of delivering the site, diagnosing faults, and protecting against abuse and denial-of-service attacks. An IP address is personal data under the GDPR. Our legal basis for this processing is legitimate interests (GDPR Art. 6(1)(f)) in operating a functioning and secure website; we consider this minimally intrusive because the logs are not used to profile visitors, are not combined with any other data, and are not used for marketing. Logs are retained for no longer than 30 days and are then deleted.

If you email us at info@syleniainc.com, we process your email address and the contents of your message in order to reply. The legal basis is legitimate interests (Art. 6(1)(f)) in responding to correspondence, or the performance of pre-contractual steps at your request (Art. 6(1)(b)) where your message concerns a purchase. Correspondence is retained for up to 24 months and then deleted.

We do not use your email address for marketing, and we do not operate a mailing list.

The website additionally publishes an Impressum at https://sweeperx.app/impressum, as required by the Austrian E-Commerce Act (ECG §5) and Mediengesetz §24. It identifies the site's operator and duplicates the contact details in §1.

12. Your rights under the GDPR

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the right to request access to your personal data, its rectification or erasure, restriction of processing, and data portability; to object to processing based on legitimate interests; and to lodge a complaint with a supervisory authority.

We want to be straightforward about what exercising these rights will produce in practice. Because the app collects nothing, there is almost certainly no personal data of yours for us to give you, correct, or delete. A subject access request will, in the ordinary case, be answered truthfully with "we hold nothing about you." The exceptions are narrow: if you have emailed us, we hold that correspondence, and our host holds server logs for up to 30 days.

To exercise any right, email info@syleniainc.com. We will respond within one month, as required by GDPR Art. 12(3). There is no charge.

If you are dissatisfied with our response, you may complain to the Austrian Data Protection Authority:

Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna, Austria Telephone: +43 1 52 152-0 Email: dsb@dsb.gv.at Web: https://www.dsb.gv.at

You may alternatively complain to the supervisory authority in your own country of residence or place of work.

13. Residents of California and other US states

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. We have never done so.

We do not collect personal information from the app, so the categories of information collected, disclosed, and sold in the preceding twelve months are, in each case, none. California residents' rights to know, delete, correct, opt out, and limit the use of sensitive personal information are available on request at info@syleniainc.com, and exercising them will not result in discriminatory treatment.

The same applies to residents of Virginia, Colorado, Connecticut, Utah, Texas, and other US states with comparable legislation.

14. Children

SweeperX is not directed at children and does not knowingly collect personal data from anyone, including children under 13 (or under 16 in EEA member states that set that threshold, Austria among them).

Because the app collects no personal data at all, it is compliant with the Children's Online Privacy Protection Act (COPPA) and the GDPR's provisions on children's data by construction rather than by policy. The app contains no advertising, no social features, no chat, no user-generated content shared with others, and no external links other than to Apple's own pages and this policy. Its App Store age rating reflects this.

15. International transfers

SweeperX is available worldwide, but its worldwide availability creates no data flows. Because no personal data is transmitted from the app anywhere, in any territory, there are no international transfers arising from its use — wherever you are, and wherever you bought it.

The website is a different matter, and we would rather state it plainly than bury it. Our host, Netlify, Inc., is established in the United States and operates a global content delivery network, so website server logs may be processed outside the European Economic Area, including in the United States. The transfer mechanism is the European Commission's Standard Contractual Clauses, incorporated into Netlify's data processing agreement, together with Netlify's certification under the EU–US Data Privacy Framework where applicable.

The data involved is limited to what §11 describes — an IP address, a requested URL, a timestamp, a user-agent string — retained for no more than 30 days and used only to serve the site and defend it from abuse. No data from the app is involved, because the app transmits none.

16. Security

The app's own security posture rests on iOS platform protections: an app sandbox that prevents other apps from reading SweeperX's storage, Data Protection file encryption tied to your device passcode, and the Keychain and Secure Enclave for key material. Vault contents receive the additional AES-256-GCM layer described in §7.

The most significant security property of SweeperX is architectural: there is no server holding your data, so there is no server that can be breached. A data breach on our side could not expose your photos, because we never had them.

The website is served over HTTPS with HSTS.

17. Changes to this policy

If we change this policy we will update the effective date at the top and publish the revised version at https://sweeperx.app/privacy. Material changes — in particular any change that would introduce data collection where there is currently none — will additionally be announced in the app's release notes and surfaced inside the app before the change takes effect.

We maintain previous versions of this policy at https://sweeperx.app/privacy/history so that you can see exactly what changed and when.

18. Contact

Questions, requests, and corrections:

Csaba Farkas (trading as Sylenia) Münchner Bundesstraße 121b/Top 5, 5020 Salzburg, Austria info@syleniainc.com

If you believe any statement in this policy is inaccurate — including the claim that the app makes no network requests — please tell us. We would rather correct it than defend it.