Privacy policy

Information we process

Account information includes your name, email address, verified-email status and account settings. Server passwords are hashed. Installed applications store session credentials in protected device storage; choosing Remember me also saves your login details there for autofill.

Your private catalog may contain titles, descriptions, tags, collections, notes, custom fields, links, file names, paths, hashes, storage-device details and scan or operation history. You choose what to record, synchronize, import, export or share. File names and paths can themselves reveal personal information.

Original media files stay on your devices by default. Optional previews, thumbnails and portable catalog archives can contain content you choose to upload. Native scanning and file operations use explicit operating-system access grants; deleting an account does not delete original files on your devices.

We process device/session names, app versions, network addresses, timestamps, request identifiers, security events, support messages and abuse reports where needed to operate and protect the service. We do not currently include advertising SDKs or use your catalog for cross-app advertising tracking.

Why we use information

We use information to authenticate accounts, provide catalog search and synchronization, manage device inventory and user-requested sharing, deliver account emails, process imports/exports and backups, prevent abuse and respond to support or privacy requests. Optional app-update checks contact the update service with information needed to find a compatible update.

Sharing and visibility

Catalogs are private by default. Only fields you explicitly publish are made available to selected recipients, confirmed friends or anyone with a public link, according to your selection. Recipients may retain exported copies; revoking access cannot recall copies they already saved. Do not share content or personal information you lack permission to disclose.

Service providers

We use hosting/storage infrastructure, Brevo for account email, and Expo/EAS for application builds and optional updates. Providers receive information needed for those functions and their own security operations. We do not sell your personal information. External websites linked from catalog records have their own privacy practices.

Processing locations

The operator is based in Sri Lanka. Hosting, email and app-distribution providers may process information in other countries. Contact us with questions about the providers and safeguards applicable to your account.

Retention and deletion

Account information is retained while your account is active. After you confirm a deletion email, the selected account or catalog data becomes inaccessible immediately and enters a seven-day recovery period. It is permanently removed from active service storage after that period. Contact support before the deadline to request restoration. Restricted backups follow operational retention settings; restoration procedures reapply confirmed erasures. Limited security, abuse-handling and erasure records may be retained to protect the service, honor deletion requests and meet applicable obligations.

Security and device storage

Production API connections use HTTPS. Access controls scope private records to their owners and explicit recipients. Installed apps use operating-system protected credential storage. Turning Remember me off removes saved login-form details after your next successful sign-in. Account/session logout and token revocation are separate controls. Keep your device and sign-in details secure.

Website storage

The website uses essential authentication cookies and browser storage for preferences such as language and appearance. Its offline cache stores public assets rather than authenticated account pages or API responses. Browser app sessions do not persist account tokens in localStorage.

Your choices and requests

You can review and edit your account and catalog, export supported catalog data, change sharing, block other users, report content, revoke sessions, and request account or catalog deletion. We may ask you to verify your identity before acting on a privacy request. Account deletion is available in the app profile and through the web account page.

Children

MediaLibrary is a general-purpose productivity service and is not designed or marketed specifically to children. If you believe a child has provided information inappropriately, contact us so we can investigate and take appropriate action.

Changes and contact

We update this policy when the service or our practices change and identify the effective date here. Privacy, access, correction, deletion and support requests can be sent to the contact below.