X CleanX Clean — Privacy Policy
This policy explains what information X Clean (“the App”, “we”) processes, why, who it is shared with and what control you have. Read it together with our Terms of Use.
1. Who we are
Kostiantyn Chukhas, independent developer, Ukraine
E-mail: lisajsgi726@gmail.com
We are the controller of the personal data described here. We have not appointed a Data Protection Officer because we are not required to.
2. Summary
- No account is needed.
- Your photos, videos, contacts, calendar events, files and emails are analysed only on your device and are never uploaded to us.
- If you connect Gmail or iCloud Mail, your iPhone talks to Google or Apple directly; we never receive your emails or mail passwords.
- Subscriptions are paid through Apple; we never see your card details.
- With your permission (Apple’s “Allow Tracking” prompt) we use the advertising identifier to measure which ads brought you to the App. You can say no — the App works exactly the same.
- We collect pseudonymous usage statistics to improve the App. We do not sell your personal data.
3. Information we process
3.1 Photos, videos, contacts and calendars — on your device only
With your permission the App reads your photo library (to find duplicates, similar photos, screenshots and large videos and to save compressed videos), your contacts (to find duplicates and incomplete entries) and your calendars (to list and remove old events). All analysis happens on your iPhone. The content of your photos, videos, contacts and events is never uploaded to our servers or shared with third parties. Deletions and merges are performed only after you confirm them. You can change these permissions any time in iPhone Settings → Privacy & Security.
3.2 Mailbox cleanup (Gmail and iCloud Mail)
If you choose to connect a mailbox, the App connects directly from your iPhone to your email provider — Google (Gmail API or IMAP at imap.gmail.com) or Apple (IMAP at imap.mail.me.com). To group your mail and show the largest senders, the App reads only message metadata: the sender’s name and address, the subject, the date, the message size and the List-Unsubscribe header. It does not read message bodies or attachments. This data is processed in memory on your device, is not stored after you leave the screen and is never sent to our servers or to any third party. The App changes your mailbox only when you ask it to: it moves the messages you confirm to the Trash of your mailbox (they can be restored from there) and, when you tap “Unsubscribe”, it uses the sender’s unsubscribe link.
Sign-in: for Gmail you either sign in with Google (OAuth; the access token is kept in memory and the refresh token in the iOS Keychain) or enter an app password; for iCloud Mail you enter an app-specific password. Credentials are stored only in your iPhone’s Keychain and are never sent to us. You can disconnect any time in the App (mailbox menu → Sign out) and revoke access in your Google Account (Security → Third-party access / App passwords) or Apple Account (App-Specific Passwords).
Google user data — Limited Use. X Clean’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the mailbox cleanup feature visible in the App’s user interface; we do not use it for advertising, do not sell it, do not transfer it to others, and no human at X Clean can read it. We do not use Google user data to develop, improve or train generalized or non-personalized AI/ML models.
3.3 Files
The Files cleanup works only with folders you pick in the iOS Files app. The App reads file names, sizes and dates on your device to find large or long-unused files and deletes only the files you select. Nothing about your files is uploaded.
3.4 Data stored on your device
Settings, the chosen charging animation, widget preferences and cleanup statistics (for example the number of duplicates found and the space freed) are stored locally in the App and shared with its widgets on the same device.
3.5 Subscription and purchase data
X Clean Premium is an auto-renewable subscription sold through Apple In-App Purchase. We and our subscription provider (Adapty) receive transaction metadata — product, transaction identifiers, price and currency, trial or offer status, renewal and expiry dates — linked to a pseudonymous app user identifier, to unlock Premium, restore purchases and measure aggregate revenue.
3.6 Advertising attribution
We use AppsFlyer to learn which advertising campaign, if any, led to an install or subscription. AppsFlyer receives device identifiers (the identifier for vendors and, only if you allow tracking, the Apple advertising identifier IDFA), device and OS information, IP address, install and open timestamps and in-app events such as “onboarding completed” or “paywall shown”. Subscription events are sent to AppsFlyer by Adapty.
3.7 Product analytics
To improve the App we record how it is used — for example which onboarding steps are completed, which paywall was shown and why, which cleanup tools are used (with counts such as “12 photos deleted”, never the photos themselves) and technical errors. Events are linked to a random identifier created on your device (not to your name or e-mail) and include app version, iOS version, device model, language, time zone and country (derived from the network; the IP address itself is not stored). The data is stored in our database hosted by Supabase and is never sold or used for advertising.
3.8 App configuration
The App downloads a small configuration file from our website (links, feature switches). This request contains no personal data.
3.9 Support messages
If you write to us we process your e-mail address, the content of your message and the diagnostic details included (app version, iOS version, device model, subscription plan, language).
3.10 What we do not collect
We do not collect your name, precise location, the content of your photos, videos, contacts, calendars, files or emails, your mail passwords, health or financial account data. We do not create user profiles for advertising.
4. Why we use data and our legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Cleaning photos, videos, contacts, calendars | Processed on device only | Contract, 6(1)(b), with your iOS permission |
| Mailbox and files cleanup | Email metadata, file names and sizes — processed on device only | Contract, 6(1)(b), at your request |
| Selling and restoring Premium | Purchase metadata, pseudonymous ID | Contract, 6(1)(b) |
| Ad attribution with IDFA | IDFA, device data, events | Consent via Apple’s tracking prompt, 6(1)(a) |
| Attribution without IDFA, aggregate analytics, fraud prevention | IDFV, device data, events | Legitimate interests, 6(1)(f) |
| Product analytics (improving the App) | Usage events, random ID, device data | Legitimate interests, 6(1)(f) |
| Remote configuration | App version | Legitimate interests, 6(1)(f) |
| Support | Your messages | Contract / legitimate interests |
| Tax and accounting | Transaction records | Legal obligation, 6(1)(c) |
For users in Ukraine the processing also complies with the Law of Ukraine “On Personal Data Protection”.
5. Service providers
| Provider | Purpose | Data received |
|---|---|---|
| Apple Inc. | App Store distribution, payments | Handled under Apple’s privacy policy |
| Adapty Tech Inc. | Subscriptions and paywalls | Purchase metadata, pseudonymous ID, device data |
| AppsFlyer Ltd. | Advertising attribution | Device identifiers (IDFA only with consent), device data, IP, events |
| Supabase, Inc. | Database hosting for product analytics and subscription records | Usage events, random ID, device data, purchase metadata |
| Cloudflare, Inc. | Hosting this website and the analytics endpoint | Request data, IP, technical logs |
Google (Gmail) and Apple (iCloud Mail) are not our service providers for mailbox cleanup: your iPhone connects to your own account there directly, under their privacy policies, and we receive nothing from these connections.
We may also disclose data when required by law or to protect legal claims.
6. Tracking and your choice
On first launch iOS asks whether the App may track you. If you tap Ask App Not to Track, the IDFA is not available to us or AppsFlyer and ads are measured only in aggregate (for example via Apple’s SKAdNetwork). You can change the choice any time in iPhone Settings → Privacy & Security → Tracking.
7. How long we keep data
- On-device data: until you delete it or the App.
- Subscription records: for the life of the subscription and as long as required for accounting and disputes.
- Attribution data: according to AppsFlyer’s retention settings, typically up to 24 months.
- Product analytics events: up to 18 months, then deleted automatically.
- Support e-mails: up to 24 months after the request is closed.
8. International transfers
Our providers are located mainly in the United States and the EU. Transfers rely on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework where the provider is certified, plus encryption in transit.
9. Security
All network communication uses TLS. Keys for third-party services are kept on the server side, not in the App. No method of transmission is 100% secure, but we take reasonable measures to protect your data.
10. Your rights
Depending on where you live you can access, correct, delete or port your data, object to or restrict processing, and withdraw consent at any time. Write to lisajsgi726@gmail.com; we reply within 30 days. You may also complain to your data-protection authority (in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in the EU — your local supervisory authority).
11. Deleting your data
- On-device data: uninstall the App.
- Data held by us and our providers: e-mail us and we will delete the analytics linked to your device and ask Adapty and AppsFlyer to erase data linked to your identifiers.
- Deleting data does not cancel your subscription — cancel it in iPhone Settings → [your name] → Subscriptions.
12. Children
The App is not directed to children under 13 (or 16 where local law requires) and we do not knowingly collect their data. Contact us and we will delete it.
13. Notice to US residents
We do not sell personal information for money. Sharing device identifiers with AppsFlyer for ad measurement may be considered “sharing” for cross-context behavioural advertising under some US state laws; you can opt out by declining tracking in iOS (Settings → Privacy & Security → Tracking) or by writing to us.
14. Changes
We may update this policy. The “Last updated” date shows the current version; material changes will be announced in the App.
15. Contact
Kostiantyn Chukhas · lisajsgi726@gmail.com · Support page