← Limetag

Privacy Policy

Effective date: November 2, 2026

This policy explains what the Limetag Android app (“the app”), its server and this website collect, why, and how long we keep it. Limetag is made by Kineto Soft (Ugur Akcelik, Turin, Italy, VAT IT12938420010; “we”, “us”). We are responsible for your data (the “controller” under EU and UK data protection law). Questions? Email info@kineto-soft.com.

1. What we collect

• Account ID. When you first open the app, our server creates an account for you with a random ID (shown as “Your ID” in the app). The app gets a secret sign-in key and keeps it in secure storage on your phone. Our server stores only a one-way code (hash) of that key and when it was created and last used. We do not use your phone’s device ID, Android ID or advertising ID. Your account ID is not linked to your name or email unless you choose to save your account with Google.
• Google account (optional). Only if you tap “Save with Google” in the app. Google confirms your sign-in, and we keep your Google account ID and email address with your account (not your name). We use them only to keep your account, plan and credits after a reinstall or on a new phone.
• Photos you shoot. Only the photos you take in the app’s camera for a set (for example the front, back and main shot of an item). Before upload, the app makes a smaller JPEG copy. The app has no access to your location or to the other photos on your phone.
• Cut-out masks, checks and results. For each photo: the outline of the item (the cut-out mask), a preview, and the check results (sharp, light, glare, framing). For each set: the finished images and, if you order them, AI scenes.
• Sets. The name you give a set, the look you choose (white or studio), and technical details (time, status, AI model used, processing time and AI cost).
• Your consent. The time you confirmed that you are 18 or older, that you have the rights to your photos, and that your photos are sent to Google Gemini.
• Plan and credits. Whether you have Limetag Pro, until when, how many plan sets you used, your credit balance and a history of credit and set changes (used, given back, bought, refunded).
• Purchase records. From Google Play and RevenueCat: the product you bought, the Google Play order ID, whether it was a test purchase, and the time. We check each credit pack with Google Play and store only a one-way code (hash) of its purchase token, so the same purchase is never credited twice. Google Play also tells us when a purchase was refunded.
• Reports. If you report an image or mark a cut-out as wrong: your account ID, the image, the reason and the time.
• App usage events. The app sends a few usage events to our own server: first app open, camera started, photo retaken, set started and done, paywall viewed, purchase, AI scene retried or accepted, export and report. Each event is stored with your account ID, the time and a few details (for example the product you bought, or where the paywall opened). We do not use Google Analytics or any other analytics, advertising or crash reporting service.
• Technical data. Our server receives your IP address and basic details of each request (time, address requested and app information sent by your phone). Our server logs keep these, plus technical details such as your account ID and errors, for up to 30 days to fix problems and keep the service secure.
• Sign-up checks. When the app creates your account, Google Play Integrity checks that the request comes from the real Limetag app on a genuine Android device. We use the result only to allow or refuse the sign-up, and we do not store it. To stop mass sign-ups, we also store a one-way code (hash) of your IP address for 1 day.

We do not collect: your name, or your email address (unless you choose Google sign-in), phone number, contacts, device ID, advertising ID, location, microphone, or any photos other than the ones you shoot in the app.

2. How we use it

• To check your photos, cut out the item and make your sets, and the AI scenes you order.
• To run Limetag Pro and credits: count your plan sets, keep your credit balance, and handle purchases and refunds. If a set fails, you get the set back.
• If you choose Google sign-in: to keep your account after a reinstall or on a new phone. We never email you.
• To prevent abuse and fraud and keep the service secure (Play Integrity, a sign-up limit per IP address, upload limits and a daily cap on AI spending).
• To review reports of harmful or wrong images, as Google Play’s rules for AI-generated content require.
• To understand how the app is used and to improve it, using the usage events above.
• To meet legal, tax and accounting duties.

We do not look at your photos or results, except to check an image you reported or when you ask us for help with a specific set. We do not use your photos to identify people or to create face templates.

Legal bases (EEA and UK): providing the service you ask for, including plans, credits, purchases and optional Google sign-in (contract); sending your photos to Google Gemini (your consent, see section 4, and the contract); security, abuse prevention, handling reports, usage events and improving the app (our legitimate interests; you can object); and keeping tax and accounting records (legal obligation).

3. AI processing by Google

• Every photo you shoot is sent from our server to Google’s Gemini API, which finds the item and returns its outline. We use that outline to check the photo and to cut out the item.
• The white and studio images in your set are made on our own server from your photo’s own pixels. Gemini only tells us where the item is; it does not paint the item.
• AI scenes (when the app offers them) are made by Gemini from your photos, and Gemini also checks each scene against your item. AI scenes are AI-made images. They are marked “AI scene” in the app.
• Google acts as our service provider. We turn off the Gemini API’s option to store requests. We use the paid Gemini API: under Google’s terms for paid services, Google does not use your photos or the results to improve its products. Google logs requests and responses for a limited time, only to detect and prevent misuse of its service and for legal reasons. Google’s terms do not give a fixed number of days, and our 7-day deletion does not cover that log.
• Google’s AI may refuse some photos, for example photos it sees as sensitive. Then the app asks you for another photo.

4. Your photos and your consent

Before your first photo, the app asks you to confirm that you are 18 or older, that you own your photos or have the right to use them, and that your photos are sent to Google Gemini to cut out the item (and to make AI scenes). We save the time you confirmed. You can withdraw your consent at any time by deleting your account (section 8).

Shoot only the item. Keep people, faces, papers with personal details and other private things out of the photo.

5. Who we share data with

We run the app’s server ourselves. These companies process data on our behalf:

• Hetzner Online GmbH: rents us the server in Germany (EU) that stores our database, your photos and results. They provide the machine and network only and do not use your data for their own purposes.
• Google Gemini API (paid tier): finds and cuts out the item, checks photos and makes AI scenes (see section 3).
• Google Play: handles payments (Google Play Billing) and checks that new accounts come from the real app (Play Integrity).
• Google Sign-In (optional): confirms your Google account when you choose to save your account with Google.
• RevenueCat, Inc. (USA): manages purchases and subscriptions for us. It gets your random account ID (not your name or email) and your purchase details from Google Play. Its software in the app also sends basic technical details, such as the app version, the Android version and the store country. We use it to know whether you have Limetag Pro and which credit packs you bought.

Payments are made in Google Play under Google’s own privacy policy. We never see your card or bank details. We only receive the purchase details listed in section 1.

We may also share data if the law requires it, to protect our users or the service, or with a buyer if the app is sold (who must then follow this policy).

No ads, no selling. The app shows no ads. We do not sell your personal information, and we do not share it for targeted or cross-context advertising.

Learn more in Google’s Privacy Policy, how Google uses data from apps that use its services and RevenueCat’s Privacy Policy.

6. Where your data is stored

Our database, photos and results are stored on our own server, rented from Hetzner Online GmbH in Germany. Your photos are sent to Google’s Gemini API, which may process them in other countries where Google has facilities, including the United States. Google Play Billing, Play Integrity and Google Sign-In are also run by Google. RevenueCat is based in the United States. If you live in the EEA, the UK or Switzerland, these transfers are protected by the companies’ data processing terms, which include the EU Standard Contractual Clauses, and for Google also by its certification under the EU-U.S. Data Privacy Framework.

7. How long we keep data

• Photos, cut-out masks, previews, finished images and set records: deleted automatically after 7 days. Cleanup runs once a day, so items are gone within a day after the 7 days have passed.
• Copies on your phone: the app keeps temporary copies in its cache, which are removed when you uninstall. Images you save to your gallery or share stay where you put them; we cannot delete those.
• Account data (account ID, sign-in key hashes, consent time, plan status, credit balance and the history of credits and sets, Google account details if you saved them): kept until you delete your account.
• App usage events: deleted automatically after 60 days.
• IP address hash for the sign-up limit: deleted automatically after 1 day.
• Reports: kept until you delete your account.
• Purchase records: as long as needed for accounting, tax, refunds and other legal duties.
• Server logs: up to 30 days.
• Backups: our database (not photos or results) is backed up every day, and each backup is kept for up to 14 days. Data you delete can stay in these backups until they are removed.
• Google’s abuse log: as described in section 3.

8. How to delete your data

• In the app (fastest): open Account, tap Delete my account and data at the bottom and confirm. This deletes right away your photos, sets, results, credit balance, credit history, reports, usage events and your account, including your sign-in keys and the link to your Google account if you made one. Unused credits and plan sets cannot be restored. Purchase records are kept for accounting, no longer linked to your account.
• Subscriptions: deleting your account does not cancel a Limetag Pro subscription. Cancel it first in Google Play (Profile → Payments & subscriptions → Subscriptions).
• Photos and sets: you do not need to do anything. They are deleted automatically after 7 days.
• Without the app: email info@kineto-soft.com with the subject “Delete my data”. We do not store your name, and unless you saved your account with Google we do not know your email, so please include something that lets us find your data: your account ID (shown as “Your ID” in the app), the email of your Google account if you saved your account with Google, or the Google Play order ID of a purchase (in your Google Play receipt email). We delete your data within 30 days, and we also ask RevenueCat to delete its record for your account ID.
• Deleted data is also gone from our database backups within 14 days.
• Uninstalling the app stops all data collection. Your sign-in key is kept only on your phone, so after uninstalling you may not get back to your old account, unless you saved it with Google first. Data already on our server is deleted as described above.

9. Your rights

Under the GDPR (EEA), the UK GDPR and similar laws, you have the right to:

• access the data we hold about you and get a copy of it;
• correct it;
• delete it;
• object to or restrict how we use it (for example, usage events);
• receive it in a portable format;
• withdraw your consent at any time (this does not affect what we did before);
• not be treated differently for using these rights.

You can delete your account and data yourself in the app (see How to delete your data). To use any of these rights, email us at info@kineto-soft.com. Include your account ID or a Google Play order ID, so we can find your data. We reply within 30 days. You can also complain to your local data protection authority, or in Italy to the Garante per la protezione dei dati personali.

California residents: in the terms of the CCPA, we collect identifiers (account ID, IP address, and with optional Google sign-in your email address and Google account ID), commercial information (plans and purchases), app activity (usage events and set records) and the photos you shoot, for the purposes in section 2. We do not sell or share personal information.

10. Adults only

Limetag is for adults (18 and over). It is not directed to anyone under 18, and we do not knowingly collect data from them. If you believe a minor has used the app, email us and we will delete the data.

11. Security

• All connections use HTTPS, so data is encrypted on the way.
• Your photos, sets and credits can only be reached with your account’s sign-in key, and we store only a hash of each key. Links to your photos and results are signed and stop working within 7 hours. Only our server can change credits or write results.
• The database cannot be reached from the internet; only our server software uses it.
• The AI key, the RevenueCat key and our Google service keys are kept on our server, never in the app.
• Google Play Integrity blocks sign-ups that do not come from the real app.

No system is perfectly secure, but we work hard to protect your data.

12. This website

This website sets no cookies and has no analytics. It loads its fonts from Google Fonts, so your browser sends your IP address to Google when you open a page. Our server logs keep the request details for up to 30 days, like the app’s.

13. Changes to this policy

We may update this policy. We will post the new version on this page and change the effective date at the top. If a change is important, we will also mention it in the app’s release notes on Google Play.

14. Contact

Kineto Soft (Ugur Akcelik), Turin, Italy
Email: info@kineto-soft.com