Privacy notice — firelet.media

Who is responsible

Firelet.Media, of Islamabad, Pakistan, is the controller of the personal data described here — an individual rather than a company, so the person answering a request under this notice is the same person responsible for it. Questions, and any request under this notice, go to support@firelet.media or through the support form.

Payments are a separate matter. Paddle is the merchant of record for purchases made here and is its own controller for the payment. Paddle collects and holds the card details and the billing address; we never see them, and never hold them. Paddle's privacy notice is at paddle.com/legal/privacy.

The gallery, on your own PC

Nothing from your library is uploaded. The gallery reads folders you point it at and builds an index beside itself, under your own user directory. Your photographs, the index, the thumbnails and the picture-understanding model all stay on your machine. There is no account to make, no cloud to be on, and no upload step that could be left switched on by accident. The program searches nothing on the internet.

Five things do travel, and this is all of them:

Activating and re-checking a licence. The program sends your licence key, the product family, the version it is running, an optional name you gave the machine, and a 64-character hash that identifies the machine. That hash is computed and salted on your own PC: it tells us that this is the same machine as last time and nothing else about it. The re-check happens about once a month.
Asking for the trial rules. While the gallery is on its free trial it asks firelet.media for the trial's length and the current time. Nothing about the machine or your library goes with it; like every request, it arrives from your IP address with the program's name and version, and those are recorded — see Security and fraud prevention.
Checking for a new release. The version you are running, so the server can say whether a newer one exists.
A crash report, when it crashes. The program version, the platform, the Windows version, the architecture, the kind of failure, the module it happened in, the error message and a stack trace. No file names from your library, no image data and no account details are attached.
Counters, if you switch them on. Usage counters are off unless you turn them on, and they are counts of things done rather than a record of what you did. The switch is in your account and takes effect immediately.

The gallery on your Android phone

The phone app uploads nothing of yours to us. It reads the photos and videos already on the phone, through Android's own media permission, and keeps its index, thumbnails, albums, marks and edits on the phone. It has no account, no analytics, no advertising and no crash reporting, and it talks to this site's servers only about a subscription or a licence key, as described below.

These leave the phone, and each goes straight to the service named, never to us:

Place names, if you switch them on. Off until you turn on "Look up place names" in Settings. When it is on, the coordinates stored in your photos — rounded to a coarse grid, with no image and no file name — go to BigDataCloud (api.bigdatacloud.net), which answers with a city and a country. Answers are kept on the phone so the same place is never asked twice. Turning the switch off stops it at once.
Map tiles, when you open the map. The map is drawn from OpenStreetMap's tile servers, which see the address the request comes from and which part of the map is being shown, as any map does.
The picture-understanding model, once. When the AI search is set up, the phone downloads the model's files from Hugging Face. Nothing is sent with that download beyond an ordinary request for the file.

Only these come to us, and only when you use them:

Your subscription, if you subscribe in the app. Google Play takes the payment; we never see your card. The phone then sends us the purchase token Google gave it, we check it with Google, and we answer with a licence key for your computers. We keep that token, the key, and the subscription's state as Google reports it (active, renewing, cancelled, ended), and Google tells us when that changes.
A licence key, if you type one. The phone sends the key, a random number that identifies the phone to us and nothing else, and the phone's model name, and we answer with a signed unlock. We keep those and when the phone last checked in, so that one key cannot unlock an unlimited number of phones.
Your email address, only if you ask for the key by email. We send the key to it and open an account for it, exactly as for a purchase on this site (see below).

The Wi-Fi link stays on your own network. Pairing the phone with firelet on your PC, browsing one from the other and sending files between them happen directly between the two devices over an encrypted connection — nothing goes through the internet or through us. What the phone keeps about a paired PC (its name, its key, and whether its licence or trial is current) stays on the phone and is forgotten when you remove the pairing. The camera is used only to scan the pairing code.

The app is installed and updated by Google Play, which also handles a subscription's payment, renewal and cancellation, under Google's own privacy policy.

The account on this site

Buying creates an account to hold what you bought. It stores:

Your name and email address.
Your licences and the machines each is activated on, by that salted hash.
Your orders — what was bought, when, and for how much. The receipt and the payment itself sit with Paddle.
Support tickets you open and anything you attach to them.
Sign-in records, kept so that you and we can spot access you did not make.
A consent ledger: which optional things you turned on or off, when, and from where. It exists so that a permission can be shown to have been given and withdrawn, which is the point of asking for one.
Where a purchase came from, if you told us: the tag on the link you followed (for example reddit), a code you used, and your answer to the optional "How did you hear about us?" at the checkout. These name a post or a code, never you.

The two optional email lists

The download page offers trial tips, and the Mac waitlist offers one email when the Mac version is ready. Both are optional — the download never needs an address — and both are double opt-in: we send a link to confirm before anything else, and an address nobody confirms is never mailed again. The trial list sends three tips over the first week, one reminder before the trial ends and a last note on the day; if you then buy, two short notes follow (a request for a review and your referral code). Every one has a one-click unsubscribe. We keep the address, the list, the tag on the link you arrived by, and when you confirmed or left. Legal basis: your consent, which you withdraw by unsubscribing.

The legal basis is the contract between us for everything needed to sell you a licence and let you use it; consent for anything optional; and our legitimate interest in keeping the service secure and free of fraud for the sign-in records and the security records described below.

Sync for the firelet.media player

This does not apply to the gallery. The same account can also sync the library of our separate media player between your own devices, for people who use that program. It is off until you switch it on, separately and explicitly, and switching it off is one click on the same screen. When it is on, the entries you sync and the thumbnails that go with them are stored for you; when it is off, none of it is collected at all.

Cookies

This marketing site sets no cookies and runs no analytics. The only things stored in your browser are the light-or-dark choice you made with the theme button, which never leaves it, and the site's language. The language is kept exactly like the theme — in your browser, not in a cookie, and never sent anywhere — whether you picked it from the language menu or it was set on your first visit from the language your browser asks for.

Downloading the installer adds one to a daily total for that version, and the download is also recorded with the address it came from — see Security and fraud prevention.

Links to this site can carry a tag saying which post sent you — ?ref=youtube, say. The site keeps the tag in the address as you click around, so a download or an order can be counted by the post that led to it. It is never stored in your browser, and it names the post, never you.

The account area sets one session cookie, which is what keeps you signed in. There is no advertising cookie anywhere, and nothing here is shared with an advertising network.

Security and fraud prevention

Licences are worth stealing and trials are worth faking, so a few moments are written down: downloading the installer, the gallery asking for the trial rules, opening a checkout, and signing in. Each record holds the IP address it came from, the browser's or the program's description of itself (its "user agent"), the country Cloudflare reports for the address, the time, and what it was about — which installer, or which order and the email address it was placed under.

The IP address alone is then checked with an IP-intelligence provider, which says what kind of network it belongs to: the provider and its network number, whether it is a home, mobile, business or hosting connection, its approximate location, and whether it is known as a datacenter, VPN, proxy or Tor exit or as a source of abuse. Nothing else about you is sent to it — not your name, not your email address, not what you did.

This is used only to spot fraud and abuse — a stolen card, a key passed around, a trial reset over and over — and only a person looks at it. Nothing is decided about you automatically: no download, trial, purchase or sign-in is refused because of it. The legal basis is our legitimate interest in protecting the service and its buyers from fraud. These records and what the provider said are deleted after 180 days.

Who else sees any of it

Paddle, as merchant of record, for the payment. The company that hosts the service, as the machine the data sits on. Cloudflare, which answers for the firelet.media name and carries every visit to this site, your account and the installer download through its network — like any network in the path, it sees the address a request comes from; it holds nothing else about you, and we receive nothing from it. An IP-intelligence provider, which is sent an IP address and nothing else, as described under Security and fraud prevention. On the phone, the three services named above. Nobody else: we do not sell personal data, we do not share it for advertising, and there is no third-party tracker on this site, in the program or in the phone app.

How it is kept safe

Everything between your browser and this site, and between the gallery and this site, travels over an encrypted connection. Passwords are stored hashed rather than encrypted, which is to say nobody here can read one, us included — a password you forget is reset, never recovered. The database is not reachable from the internet; the application in front of it is.

The administrative side is granted from the server console and never by signing up, every administrative action is written to an audit log, and your own sign-ins are recorded so that access you did not make is something either of us can spot. None of that is a guarantee — no honest security section claims one. If something goes wrong in a way that puts your data at risk, you will hear it from us, and so will the authority we are obliged to tell.

How long it is kept

Your account and licences are kept while the account exists — a perpetual licence is a long relationship by design, and a key you can no longer be shown is a key you have effectively lost. Orders and the records behind them are kept as long as tax and accounting law requires, which is usually several years and is not ours to shorten. Crash reports and counters are kept for a limited period and then dropped. The daily download totals say nothing about anybody, so they are simply kept; the security records — addresses, user agents and what the IP-intelligence provider said about them — are deleted after 180 days. An address on one of the email lists is kept while it is on the list; after it leaves, it is kept marked as unsubscribed, so it is never mailed again unless you ask. Delete the account and the rest goes with it.

What you can do about it

Most of it is self-serve, deliberately — a right you have to ask permission to exercise is not much of a right:

Export everything. Your account pages produce a full machine-readable copy of what is held about you, including your devices, consents, synced entries and thumbnails.
Delete the account, from the same place.
Turn the optional things on and off, individually, with withdrawal exactly as easy as granting.
Correct anything wrong from your profile, or by asking us.

You also have the right to object to or restrict some processing, and the right to complain to your data protection authority. If you would rather ask us than click, write to support@firelet.media and we will do it for you.

Where the data is

We are in Pakistan; the servers are not. The account, its licences and everything listed above sit on hosting in the United States, so your data leaves the country we are in the moment you create an account — that is worth saying plainly rather than leaving you to infer it from an address at the top of the page.

Where data reaches Paddle, Paddle moves it under its own safeguards, described in its privacy notice. Wherever it is, the same rules on this page apply to it, and the rights above are exercised the same way.

Changes

If this notice changes, the date at the top changes with it, and a change that affects what is collected is announced rather than slipped in.