Privacy Policy

1. Who we are

Maple Album is operated by Liana App Studio, a sole proprietorship registered in Ontario, Canada, owned by Ali Sina Bahadori Kavijani ("we", "us", "our"). Maple Album is the "data controller" responsible for the personal information described in this policy. You can reach us at [email protected].

2. Information we collect

We collect only what we need to operate Maple Album. We do not use third-party advertising, analytics, crash-reporting, or tracking SDKs, and we do not sell your personal information.

a. Account information

You sign in with Sign in with Apple or Google Sign-In. We receive and store your email address, an optional display name, and a stable identifier from the sign-in provider. We do not use passwords, phone numbers, or SMS. This information is readable by us.

b. Content you share

Photos and videos you post to an Album (including their thumbnails), and the avatars you set for members of an Album, are end-to-end encrypted on your device before upload. We store only the encrypted data and cannot decrypt or view it. The following related content is not end-to-end encrypted and is readable by us so the app can function: an Album's cover or header image (shown to people you invite before they join), your account profile picture, captions, photo tags, comments, and likes.

c. Information about the people in your Albums

To organize an Album you can add details about the people, children, and pets in it, such as a name and, optionally, a date of birth and gender. Because these details help operate the app (for example, tagging and organizing), they are stored in a form readable by us. Only you and the members of your Album can see them in the app. Please only add information about children if you are their parent or legal guardian, or otherwise have the right to do so. See "Children's privacy" below.

d. Device and technical information

To deliver encrypted content and notifications we store: your devices' public encryption keys and key fingerprints (private keys never leave your device), Apple Push Notification service tokens and related device metadata (such as environment, locale, and time zone), and basic operational logs. Encryption keys for your Album content are stored only in a form wrapped to your devices' public keys, which means we hold them but cannot unwrap or use them.

e. Reports you submit

If you report content or a member, we collect the report category and any description you provide. Because your posted media is end-to-end encrypted, reporting a specific photo or video also shares with us the decryption key for that single item so we can review it. We use that key only to review the report and permanently discard it once the review is complete. Reporting one item does not give us access to any of your other content.

3. How we use information

We use the information above to:

• Create and secure your account and sign you in.
• Operate Albums: store and deliver your encrypted content, manage members, invites, and access.
• Send push notifications and transactional emails (for example, invites, account deletion, and data export confirmations).
• Keep the service safe: review reports, enforce our Terms, and prevent abuse.
• Comply with legal obligations and respond to lawful requests.

Our legal bases (where the GDPR or similar laws apply) are performing our contract with you, our legitimate interest in operating and securing the service, your consent (for example, device permissions), and compliance with legal obligations.

4. End-to-end encryption: what we can and cannot see

The photos and videos you post to an Album are encrypted on your device using keys that only your devices and the devices of your Album members hold. We cannot read, decrypt, or hand over the contents of those photos and videos. The only exception is content you choose to report: to let us review a report, your app shares the decryption key for just the reported item, which we use solely for that review and then discard (see Section 2e). We can see the other information described in Section 2, including your account email, the names and details you add for people in your Albums, Album cover images, captions, comments, and technical metadata. We are transparent about this so you are not misled: Maple Album is not a fully zero-knowledge service — encryption protects your posted photos and videos specifically.

5. Children's privacy

Maple Album is designed primarily for adults, such as parents and relatives, to share family moments. It is not intended for children under 13, who may not create accounts. However, the app is used to share photos and information about children.

When you add a child's photo, name, or date of birth to an Album, you confirm that you are the child's parent or legal guardian, or that you have the consent of a parent or legal guardian. A child's posted photos and videos are end-to-end encrypted and visible only to members of the private Album you choose; a child's name and date of birth are stored in readable form solely to operate the album and are never used for advertising, profiling, or shared with third parties for their own purposes. If you are a parent or guardian and want us to review or delete information about your child, contact [email protected]. We handle children's information consistent with applicable laws, including COPPA and similar regulations.

6. How we share information

We do not sell your personal information and we do not share it for advertising. We share information only with service providers who process it on our behalf, under contracts requiring them to protect it and use it only for the services they provide to us:

• A cloud storage provider — stores your encrypted media, which it cannot decrypt.
• Apple Push Notification service — delivers notifications to your device.
• Apple and Google — verify your identity when you sign in.
• Our email delivery provider — sends transactional emails such as invites and account confirmations.

We may also disclose information if required by law, to respond to valid legal process, or to protect the rights, safety, and security of our users and the service. Remember that we cannot disclose the contents of your end-to-end encrypted photos and videos because we cannot decrypt them.

7. Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the service. You can delete your account at any time from within the app (Settings). Account deletion is scheduled with a short grace period during which you can cancel; after that, your account and associated data are permanently removed, except for limited records we must keep to meet legal, security, or accounting obligations. You can also request a copy of your data ("download my data") from within the app. Backups and logs are purged on a rolling basis.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. These rights apply, for example, under Canada's PIPEDA, the EU/UK GDPR, and the California Consumer Privacy Act (CCPA). You can exercise many of these directly in the app (account deletion and data export), or by contacting us at [email protected]. We will not discriminate against you for exercising your rights. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

9. Sharing within Albums and revoked access

Content you post is visible to the members of the Album you post it in. If you remove a member or they leave, they lose access to content shared afterward. However, we cannot retrieve content a member has already viewed, saved, screenshotted, or cached on their device before losing access. Only invite people you trust, and share accordingly.

10. Security

We protect your information with end-to-end encryption for posted media, encryption in transit, hardware-backed keys on your devices, access controls, and other safeguards. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and regulators of incidents where required by law.

11. International transfers

We are based in Canada and use service providers that may process data in Canada, the United States, and other countries. Where required, we rely on appropriate safeguards for cross-border transfers of personal information.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, notify you in the app or by email. Your continued use of Maple Album after an update means you accept the revised policy.

13. Contact us

Questions about this policy or your personal information? Email us at [email protected] or reach our support team at [email protected]. Postal address available on request.