Privacy Policy
Effective 26 July 2026
Who we are
PrivateMark is an app for iPhone, iPad and Mac that embeds invisible, per-recipient watermarks in photos you choose to share, and reads them back if a copy leaks. It is operated by its developer, reachable at ueshiba@gmail.com ("we", "us").
What stays on your device (everything that matters)
- Your photos. Watermarks are embedded and read by a neural engine that runs entirely on your device. No photo, thumbnail, or derivative of a photo is ever uploaded to us — we have no server to upload it to.
- Your registry. The record of which copy went to which recipient is stored in a local database. Recipient names are encrypted at rest with a key held in your device's Keychain.
- Attribution results. Investigations run locally; the result of an investigation is stored only on your device.
iCloud sync (optional, yours)
If you are signed into iCloud, your registry syncs between your own devices through your private iCloud database, operated by Apple under your Apple Account. We cannot read it: it lives in your private CloudKit container, and recipient names remain encrypted with your key, which syncs only through iCloud Keychain (end-to-end encrypted by Apple). If you are not signed into iCloud, the app simply works locally.
What leaves your device
- Anonymous usage analytics (TelemetryDeck). The app sends content-free event signals — for example "a photo was protected" or "an investigation completed" — to TelemetryDeck, a privacy-focused analytics service that works without collecting personal data. These signals never include your photos, recipient names, watermark payloads, image hashes, or anything derived from your content. TelemetryDeck processes them under GDPR; identifiers are anonymized. See TelemetryDeck's privacy policy.
- Purchases (Apple & RevenueCat). Subscriptions and the lifetime unlock are processed by Apple through the App Store; we never see your payment details. To validate purchases across your devices, the app uses RevenueCat, which processes an anonymous app-generated identifier and your purchase receipt — not your name, email, or photos. See RevenueCat's privacy policy.
That is the complete list. The app contains no advertising SDKs, no social SDKs, and no trackers.
What we never collect
- Your photos or anything derived from them (hashes, fingerprints, payloads)
- Recipient names or your registry
- Your name, email address, or contacts
- Your location
- Advertising identifiers, or any data for advertising or "tracking" as defined by Apple's App Tracking Transparency — the app never asks for tracking permission because it never tracks
Data retention & deletion
Because your data lives on your devices and in your private iCloud, you are in control: deleting entries in the app, or deleting the app and its iCloud data, removes them. Anonymous analytics signals cannot be traced back to you and are retained by TelemetryDeck in aggregate form. Purchase records are retained by Apple and RevenueCat as required to keep your entitlements working and for legal compliance.
Children
PrivateMark is not directed at children under 13 (or the equivalent minimum age in your jurisdiction) and does not knowingly collect personal data from anyone — including children.
Your rights
Under the GDPR, CCPA and similar laws you have rights of access, correction, deletion and portability. Since we hold no personal data about you, most of these are satisfied by design; for anything relating to purchases or analytics, contact us and we will help you exercise your rights with the processors listed above.
Changes to this policy
If we ever change how the app handles data, we will update this page and the effective date above before the change ships. The zero-server, on-device design is the product's core promise; we do not intend to weaken it.
Contact
Questions about privacy: ueshiba@gmail.com