Privacy
Short, because there isn't much to hide.
Last updated 18 August 2026
The one-paragraph version
Downloading Cullora requires a free account, so we hold your email address (plus your name if you use Google sign-in) and nothing else about you. Our own visit statistics are cookie-free and anonymous, nothing is stored on your device and nothing can follow you across days or sites. Google Analytics runs only if you press "Accept" in the cookie banner. The app never phones home unless you opt in, and even then it only sends timings, never your photos, file names, folders, or anything that identifies you. You can withdraw any choice, or delete your account, at any time.
On this website
- Without any cookie (our own statistics): each page visit is counted with the page, referrer, UTM tags, country, and device class. To tell visits apart within a single day we compute a short-lived anonymous hash from your IP address and browser type that changes every day and is never stored alongside your IP, the IP itself is not saved. Nothing is written to or read from your device, so no consent is required, and there is nothing that could identify you or track you over time. Downloads are counted the same way.
- With your consent only:Google Analytics 4, with advertising signals disabled. It sets its own cookies, which is why we ask first. Decline and the only cookie is the one remembering your "no" (
cl_consent); declining after accepting also removes the GA cookies. - If you give us your email (news list or feedback form), it is used solely for that purpose: release announcements or replying to your report. Unsubscribe or ask for deletion anytime.
Your account (required to download)
Since 8 August 2026, downloading Cullora requires a free account. Here is exactly what that means for your data.
- What we store:your email address, and the date you signed up. With email and password, the password is stored only as a cryptographic hash by our auth provider, we never see it. With "Continue with Google", Google shares your name and email address with us, nothing else, and no access to your Google account or files. We also keep a per-account count of photos you have filed (a number, nothing about the photos).
- Why: to give you the account you asked for, so your download, your beta access and any future licence are attached to you, and so we can email you about something that affects your copy of the app, a critical fix, for example. Under the GDPR the legal basis is performance of our agreement with you (Article 6(1)(b)).
- What we do not do: we do not sell or share your email, we do not use it for advertising or profiling, and creating an account does not add you to the release-news list, that is a separate form with its own opt-in. Downloads are still counted the anonymous, cookie-free way described above; the count is not linked to your account.
- How long, and how to leave: we keep account data while the account exists. Ask at [email protected] and we will delete it. Deleting your account does not disable software already installed on your computer; Cullora keeps working offline.
- Who processes it: Supabase, our database and authentication provider (see below).
In the app
- By default: nothing, and no account. Once installed, Cullora works fully offline. It never blocks culling, rating, moving or undo on a connection or a licence check, and you can use it without ever signing in.
- If you do sign in, we count photos filed, not photos. The free tier allows more filing with an account than without one, so the app tells us a running number of photo groups you have moved, and nothing else about them: never a filename, a folder path, an image, or any EXIF. The count is a single integer per month attached to your account, it is what the monthly allowance is measured against, and it is deleted with your account. Signed out, the same count is kept only on your own machine and never sent.
- Performance telemetry is opt-in.If you agree (first-run question, changeable in Settings), the app sends operation timings and counts, e.g. "scanning 400 photos took 2.1 s", under a random install id that is not linked to your account. Never file names, folder paths, image data, EXIF or emails. Turning it off also deletes anything not yet sent.
- Anonymous activation counts, with no identifier at all. The app tells us when it is launched, when a folder is opened and when a photo is first filed, sending only the event name, the app version and the operating system family. There is no install id, no session, no account and no device identifier of any kind, and nothing is stored on or read from your computer to produce it. We add one to a daily counter and keep no record of the request, so these numbers cannot be traced to a person or a machine even by us. It exists because the opt-in telemetry above cannot tell us whether anyone opened the app at all, and that is not a good position to build a product from.
- Your download count, on your account. Downloading needs an account, so we record on your account row that you downloaded, when you first did, and how many times. It tells us how many people got the app rather than how many times a button was pressed. It is deleted with your account.
- Feedback you send includes your message, the app version and OS family (Windows/macOS), plus your email only if you typed or kept one.
- Signing in inside the app is optional and uses the same account: it stores your email and a per-account count of photos filed. Nothing about the photos themselves.
- Update checks ask our server for the latest version number; they carry no identifier and nothing is logged about you.
If you buy Cullora Pro
- We never see your card. Payments are handled by Dodo Payments, our merchant of record. The payment form is theirs, your card number is entered into their system, and it is never sent to, seen by, or stored by Cullora. They are the controller for the payment data they collect, and their privacy policy governs it.
- What Dodo needs from you: your email address, and whatever their form asks for to take the payment and charge the correct tax, typically your country and card details. Tax rules mean a billing country is not optional.
- What we keep afterwards:the email the purchase was made with, which tier and price variant it was, the licence key issued to you, Dodo’s reference for the payment, and, if you were signed in, the account it belongs to. That is what lets your licence appear in the app without you copying anything, and what lets us find your purchase when you write to us.
- Activation checks. When you activate or revalidate a licence, the app sends the key and a machine label to Dodo so the two-machine limit can be enforced. No photographs, file names or folder paths are involved, and a failed check never stops you culling.
- Founder records. If you hold a founder licence we store your founder number and which route it came from, so the promise that it is permanent can actually be kept.
- Refunds and disputes. If a payment is refunded or reversed, Dodo tells us and we mark the licence revoked. We keep the record of the purchase itself, because tax and accounting law requires it.
Who is responsible, and how to complain
The data controller for everything described here is Antonio Ivanović, Školska 2, 40324 Goričan, Croatia , reachable at [email protected]. That is a real address monitored by a person, not a ticket queue.
We are not required to appoint a Data Protection Officer: Cullora is a small operation that does no large-scale monitoring and handles no special categories of data. Questions go to the address above.
If you think we have handled your data badly, you can complain to your national data protection authority. Ours is AZOP, the Croatian Personal Data Protection Agency (azop.hr). You may also complain to the authority in the country where you live or work. We would rather you wrote to us first, but you are not obliged to.
What we collect, and on what legal basis
Under the GDPR every use of your data needs a lawful basis. Ours, in full:
| What | Why | Legal basis |
|---|---|---|
| Your email, and your name if you use Google sign-in | To give you an account, the download, and your licence | Contract (Art. 6(1)(b)) |
| Purchase and licence records: the email you paid with, the tier, the licence key, Dodo’s payment reference | To deliver and support what you bought, and to keep the accounts | Contract and legal obligation (Art. 6(1)(b), 6(1)(c)) |
| Cookie-free visit counts: page, referrer, UTM tags, country, device class | To know whether the site works, without tracking anyone | Legitimate interests (Art. 6(1)(f)): understanding our own traffic, using the least identifying method we could build |
| Google Analytics | More detailed traffic analysis | Consent (Art. 6(1)(a)), withdrawable in one click |
| App performance telemetry | To find what is slow, under a random install id | Consent (Art. 6(1)(a)), off unless you turn it on |
| Photos filed, if you are signed in | To measure the free tier’s monthly allowance, and to show you your own total | Contract (Art. 6(1)(b)): it is how the free tier you are using is metered |
| Anonymous activation counts | To know whether the app is being opened, with no identifier and no way back to a person | Not personal data: no identifier is collected, so the GDPR does not apply to it. No consent is needed under ePrivacy either, because nothing is stored on or read from your device |
| Your download count | To see how many people actually got the app | Legitimate interests (Art. 6(1)(f)): knowing whether the thing we built reaches the people who asked for it |
| Feedback you send us | To read it and reply | Legitimate interests (Art. 6(1)(f)): you wrote to us and expect an answer |
| Request rate limiting and abuse prevention | To keep the site and the download up | Legitimate interests (Art. 6(1)(f)): security |
Where the basis is consent, you can withdraw it at any time and it is exactly as easy as giving it. Withdrawing does not undo processing that already happened lawfully. Where the basis is legitimate interests, you can object, and we will stop unless we have a compelling reason not to.
There is no automated decision-making and no profiling. Nothing here produces a decision about you by machine, and we do not build a profile of you or sell anything to anyone.
How long we keep it
- Your account: until you delete it. Ask and it is gone, along with anything tied to it that we are not legally required to keep.
- Purchase, licence and accounting records: eleven years, counted from the last day of the business year the records belong to. That is not our choice: the Croatian Zakon o računovodstvu sets it, matched to the General Tax Act. This is the one category we cannot delete on request, because the law is not optional. Dodo Payments holds the invoice itself, as merchant of record.
- Cookie-free visit statistics: the daily anonymous hash expires within the day and cannot be reconstructed. What remains is aggregate counts with nobody in them.
- Google Analytics: kept by Google under their own retention settings, currently 14 months, and deleted here the moment you withdraw consent.
- App telemetry: tied to a random install id with no link to your account. Turning it off also deletes anything not yet sent.
- Feedback: kept while we act on it and for a reasonable period after, then deleted.
Who else sees it, and where it goes
We use a small number of providers, and no one else. We do not sell data, we do not share it for advertising, and there is no ad network anywhere in Cullora.
- Supabase— database and sign-in.
- Our own private server— runs the website. No third party host sees the traffic beyond our CDN.
- Dodo Payments— merchant of record, handles the payment and holds the payment data as its own controller.
- Google Analytics— only with your consent.
Some of these process data outside the European Economic Area. Where that happens it is covered by the safeguards the GDPR requires: an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses. Google is certified under the EU–US Data Privacy Framework.
Your rights, in full
All of these are free, and the answer comes from a person within one month. Email [email protected].
- Access— a copy of what we hold about you.
- Rectification— correct anything wrong.
- Erasure— delete it, except what accounting law obliges us to keep.
- Restriction— freeze processing while something is disputed.
- Objection— object to anything we do on legitimate interests.
- Portability— your data in a machine-readable file.
- Withdraw consent — analytics via , telemetry in the app’s Settings.
- Complain— to AZOP or your own authority, as above.
Providing your email is a contractual requirement for having an account and therefore for downloading the app: without it there is no account to attach a download or a licence to. It is not a statutory requirement, and nothing stops you using Cullora once it is installed.
Changes to this policy
If this policy changes in a way that matters, the date at the top changes and we say so on the site rather than quietly editing the page. Analytics consent is re-asked every six months regardless, so a decision you made once does not bind you forever.