Effective Date: April 23, 2026 | Version 1.0
All facial recognition and face matching in Viola runs entirely on-device. No face embeddings, no biometric templates, and no photos in plaintext are ever transmitted to Viola's servers. Photos are end-to-end encrypted before upload, and server infrastructure never holds your content in readable form. This is not a policy aspiration — it is a hard architectural constraint.
Viola App ("Viola," "we," "us," or "our") operates the Viola mobile application available on iOS and Android (the "App"). Viola is a mutual photo-sharing service that uses on-device artificial intelligence to help friends discover and share photos of each other privately and automatically.
This Privacy Policy explains what personal information we collect, how we use it, and what rights you have over it. It applies to your use of the App and any related services we provide.
For questions, contact us at [email protected].
Understanding Viola's technical design is essential to understanding this Privacy Policy. We built Viola around a privacy-by-design architecture where the most sensitive processing — face detection, recognition, and matching — never involves our servers.
Viola scans your device's photo library using on-device machine learning (Google ML Kit on Android; Apple Vision framework on iOS). The App generates 128-dimensional numerical face embedding vectors solely on your device's processor. These vectors are stored in your device's secure hardware-backed storage (iOS Keychain / Android Keystore) and are never transmitted to Viola's servers.
When a photo is approved for sharing, the App encrypts it on-device using X25519 key exchange combined with XSalsa20-Poly1305 authenticated encryption (NaCl/TweetNaCl). The ciphertext blob — which is unreadable without the recipient's private key — is uploaded to Firebase Storage. Viola's servers never receive, process, or store your photos in plaintext. The encrypted blob is automatically deleted from storage once delivery is confirmed.
| Data Element | Purpose | Where Stored |
|---|---|---|
| Email address | Account creation, authentication, password recovery, service communications | Firebase Auth (Google LLC) |
| Display name (optional) | Identify you to friends within the App | Firebase Firestore |
| Profile photo (optional) | Shown to friends for identity confirmation | Firebase Storage (encrypted at rest) |
| Firebase UID | Internal user identifier linking your account records | Firebase Auth / Firestore |
| Data Element | Purpose | Where Stored |
|---|---|---|
| Friend connections (UIDs) | Determine which users participate in mutual photo exchanges | Firebase Firestore |
| Friend request status | Manage connection requests and approvals | Firebase Firestore |
To enable cross-device face matching (so a friend's device can find photos of you on their camera roll), you may choose to share a face token with connected friends. This token is a 128-dimensional floating-point numerical vector derived from your enrollment selfie. It is not a photo and cannot be reverse-engineered to reconstruct your image.
If you enable this feature, your face token is stored in the Firestore face_tokens collection
and is readable only by users you have connected with as friends. You can revoke this at any time by
deleting your face token in the App's settings, or by deleting your account.
This feature is off by default. The face token is never shared with third parties and is never used for advertising or analytics.
| Data Element | Purpose | Where Stored |
|---|---|---|
| Transfer queue records (sender UID, recipient UID, status, timestamp) | Coordinate the mutual exchange approval flow | Firebase Firestore |
| Encrypted photo blob (ciphertext only) | Temporary relay during delivery (never plaintext) | Firebase Storage — auto-deleted post-delivery |
| Delivery confirmation flag | Trigger deletion of the encrypted blob | Firebase Firestore |
Photos are not archived on our servers. The encrypted ciphertext blob is a transient relay artefact. Once confirmed delivered, it is automatically purged via a server-side cleanup process. Viola has no mechanism to decrypt or view transferred photos.
To send you notifications about new photo approvals and friend requests, the App registers a Firebase Cloud Messaging (FCM) device token. This token is stored in Firestore and is used solely for delivering in-app notifications to your device. It is not shared with advertising networks.
We may collect limited technical information necessary to operate the service, including device operating system version, App version, and crash reports. This information does not include personally identifying information and is used only to diagnose and fix bugs. We do not use third-party analytics SDKs.
We use the data we collect for the following purposes, relying on the legal bases noted:
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Create and manage your account | Email, UID, display name | Contract performance |
| Authenticate you securely | Email, Firebase UID | Contract performance |
| Facilitate mutual photo exchanges between friends | Transfer metadata, encrypted photo blobs, friend connections | Contract performance |
| Enable cross-device face matching (optional) | Face token (with your explicit consent only) | Consent |
| Send you App notifications | FCM device token | Contract performance / Legitimate interest |
| Improve App stability and fix bugs | Crash reports, device info | Legitimate interest |
| Comply with legal obligations | Account data as required by law | Legal obligation |
| Enforce our Terms of Service | Account data, usage records | Legitimate interest |
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.
Your display name, profile photo, and friend-connection status are visible to users you connect with as friends. Your face token (if you opt in) is readable only by your connected friends' devices for the purpose of on-device photo matching. Encrypted photo ciphertext is accessible to the intended recipient only and cannot be decrypted by Viola.
| Provider | Service | Data Shared | Location |
|---|---|---|---|
| Google LLC (Firebase) | Authentication, database, storage, push messaging | Account data, transfer metadata, FCM tokens, encrypted blobs | United States (and regions per Firebase data residency) |
Firebase is bound by Google's data processing terms and applicable privacy regulations. We have executed a Data Processing Agreement with Google. Google does not receive plaintext photos or face embeddings.
We may disclose your information if required to do so by law, subpoena, or other legal process, or if we reasonably believe in good faith that disclosure is necessary to: (a) comply with applicable law; (b) protect the safety of any person; (c) prevent fraud or abuse; or (d) protect Viola's legal rights. We will notify you of such requests where legally permitted.
If Viola is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email and/or a prominent in-App notice prior to your data being transferred and becoming subject to a different privacy policy.
Viola has never sold personal data and does not intend to. We do not share your data with advertisers, data brokers, or any third party for commercial purposes beyond the service providers listed above. California residents: this constitutes notice under the CCPA that we do not sell or share personal information as defined by California Civil Code section 1798.140.
| Data Category | Retention Period |
|---|---|
| Account information (email, display name, UID) | Until account deletion, plus up to 30 days for backup purge cycles |
| Encrypted photo blobs in Firebase Storage | Automatically deleted upon confirmed delivery (typically within minutes to hours); maximum 72-hour TTL |
| Transfer queue records in Firestore | Deleted upon exchange completion or expiry of the 24-hour review window |
| Face token (if shared) | Retained until you revoke it in settings or delete your account |
| FCM push tokens | Retained while account is active; deleted on account deletion |
| Crash and diagnostic logs | Up to 90 days, then automatically purged |
Face embeddings stored in your device's Keychain or Keystore are retained locally until you remove your enrollment via the App's settings or uninstall the App. Viola does not control local device storage after uninstallation.
We take the security of your data seriously. Our technical and organisational measures include:
No system is completely secure. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities as required by applicable law.
Depending on your jurisdiction, you may have the following rights with respect to your personal data. To exercise any right, contact us at [email protected]. We will respond within 30 days (or within the timeframe required by applicable law).
We do not require you to create an account to submit a rights request, but we will need to verify your identity before fulfilling requests involving account data.
Viola is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction, which may be higher — e.g., 16 in certain EEA member states). We do not knowingly collect personal information from children below the applicable minimum age.
If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately at [email protected]. Upon verification, we will delete that information promptly.
If we become aware that we have inadvertently collected personal information from a child below the applicable minimum age, we will take immediate steps to delete that information from our systems.
Viola is operated from the United States. If you access the App from outside the United States, your personal data may be transferred to, and processed in, the United States and other countries where our service providers (principally Google/Firebase) maintain infrastructure.
For transfers of personal data from the EEA, the United Kingdom, or Switzerland to countries that have not received an adequacy decision from the European Commission, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) adopted by the European Commission. Google (Firebase) operates under the EU-U.S. Data Privacy Framework and offers SCCs for data transferred outside the EEA.
For more information about Google's data transfer mechanisms, see Google's Privacy Compliance page.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy in the App and, where required by law, by sending you an email notification to the address associated with your account. The effective date at the top of this page will be updated.
Your continued use of the App after the effective date of an updated policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you should stop using the App and may request deletion of your account.
We will retain prior versions of this Policy and make them available upon request.
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Email: [email protected]
Legal Entity: Viola App (legal entity formation in progress)
We aim to respond to all privacy inquiries within 30 days. For urgent matters related to data breaches or children's privacy, we will respond within 72 hours.
If you are located in the EEA and have a concern about our data processing that we have not adequately addressed, you have the right to contact your local data protection authority.