Privacy Policy

Last updated: 6 July 2026. This privacy policy explains what personal data Lynz collects, where it is stored, why it is used, and which choices and rights you have.

1. Controller and Privacy Contact

The controller for the processing described in this policy is Lynz.

Privacy requests can be sent to info@lynz-app.com.

2. What This Policy Covers

This policy covers the Lynz website, the Lynz mobile app, Lynz backend services, app provisioning, photo transfer, relay and chat features, backup features, telemetry, diagnostics, surveys, newsletter signup, support messages, credits, entitlements, and paid checkout when available.

Lynz is designed as a photo sharing and backup app. Some data stays only on your device. Some data is sent to Lynz backend systems when needed to provide account access, syncing, relay, backup, diagnostics, telemetry, or support.

3. Website Data

When you visit the Lynz website, technical data may be processed, including IP address, date and time of access, requested page, browser user agent, referrer if provided by your browser, response status, and security log data. This is stored in website hosting, server, security, and application logs.

This data is used to deliver the website, keep it secure, investigate errors, and prevent misuse. The legal basis is Art. 6(1)(f) GDPR.

4. Contact, Newsletter, and Private Website Areas

If you contact Lynz through the website, Lynz processes the name, email address, message, IP address, user agent, and submission time you provide or that is technically generated by the request. This information is stored in the website database and may be processed by the configured email system so Lynz can reply.

If you subscribe to Lynz updates, Lynz processes your email address, confirmation status, confirmation and unsubscribe tokens, and related timestamps. This is stored in the website database and used to send updates and manage unsubscribe requests.

If you use a private or protected website area, Lynz may process login identifiers, password hashes, session tokens, expiry times, and access logs. These are stored in the website database and in a technically necessary browser session cookie.

The legal basis is Art. 6(1)(b) GDPR where processing is needed to answer a request or provide access, Art. 6(1)(a) GDPR for newsletter consent, and Art. 6(1)(f) GDPR for website security and abuse prevention.

5. App Access and Account Data

To activate the app, provide invite links, deliver app access, manage entitlements, and support users, Lynz may process your email address, user token, plan or tier, build type, app version, provisioning token, download token, token expiry, token usage count, first-use IP address, first-use user agent, entitlement data, account status, and related timestamps.

This data is stored in Lynz backend databases. On your device, access tokens and entitlement tokens are stored in secure device storage where available. Non-secret app state and preferences are stored in app-local storage.

The legal basis is Art. 6(1)(b) GDPR because this processing is needed to provide app access and related services. Lynz also relies on Art. 6(1)(f) GDPR for security, abuse prevention, and troubleshooting.

6. Data Stored Locally on Your Device

The app stores data locally so it can work reliably and, for some features, offline. Local data may include installation ID, device ID, user token, entitlement token, paired devices, blocked or muted peers, received photo records, synced photo records, transfer state, backup settings, marketplace unlocks, cached feature data, telemetry consent, diagnostics logs, app preferences, and notification preferences.

Local data is stored in app-local storage, application support files, secure device storage where available, and user-visible device folders where diagnostics or exported files are saved. Local data usually stays on your device unless you choose a feature that sends or uploads it.

7. Photo Transfer, Relay, Chat, and Pairing

When you use photo transfer, relay, pairing, or chat features, Lynz may process operational data such as user tokens, sender and receiver device IDs, public keys, pairing tokens, circle or contact identifiers, message IDs, transfer IDs, object IDs, encrypted blob references, encrypted content, wrapped encryption keys, delivery status, acknowledgement status, error codes, byte size, expiry time, and timestamps.

This data is stored locally on your device and, when needed for relay, sync, delivery, or recovery, in Lynz backend databases and object storage. Where a feature uses client-side encryption, Lynz stores encrypted payloads and delivery metadata, not plain photo or message content.

The legal basis is Art. 6(1)(b) GDPR because this processing is needed to deliver the requested sharing, relay, sync, and chat features. Lynz also relies on Art. 6(1)(f) GDPR for reliability, security, and abuse prevention.

8. Backup Features

If you enable local backup, Lynz may process backup pairing data, backup device identifiers, backup device display name, platform, output path label, enabled or revoked status, public keys, pairing timestamps, and last-seen timestamps. This is stored locally and in Lynz backend databases when needed to maintain the pairing.

If you enable managed cloud backup, Lynz may process backup target data and encrypted backup object metadata, including source device ID, source asset ID, content hash, encrypted content hash, encrypted size, MIME type, original filename if available, storage key, upload status, error codes, upload timestamps, and deletion timestamps. Encrypted backup files are stored in Lynz-managed storage. Backup metadata is stored in Lynz backend databases.

The legal basis is Art. 6(1)(b) GDPR for providing backup features and Art. 6(1)(f) GDPR for reliability, security, and troubleshooting.

9. Telemetry, Surveys, and Diagnostics

In release builds, telemetry is controlled by consent. If enabled, Lynz may process installation ID, event name, event timestamp, platform, app version, build number, timezone, session duration, feature events, transfer success or failure, and user token when the app is linked to an account. Telemetry is first stored locally in the app and then sent in batches to Lynz backend systems.

If you submit a survey, Lynz processes your ratings, optional free-text answers, installation ID, technical app context, timestamp, and reward request ID if credits are granted. Survey data is stored in Lynz backend databases.

If you create or send diagnostics, Lynz may process diagnostic entries, timestamps, error codes, sanitized error messages, stack traces where present, runtime information, platform, app version, and redacted or hashed identifiers. Diagnostics are stored locally first and, if sent, in Lynz backend systems for issue investigation.

The legal basis is Art. 6(1)(a) GDPR where you consent to telemetry, surveys, or optional diagnostics. Lynz may also rely on Art. 6(1)(f) GDPR for security and fault investigation.

10. Credits, Entitlements, and Feature Unlocks

Lynz may process in-app utility credit and entitlement data, including credit balances, photo-share balances, ledger entries, feature unlocks, marketplace feature IDs, request IDs, receipt IDs, sender and receiver identifiers, media hashes, byte sizes, transfer allowances, offline receipts, entitlement tokens, and timestamps.

This data is stored locally for offline use and in Lynz backend databases for authoritative balances, entitlement state, fraud prevention, reconciliation, support, and audit. LY is an in-app utility credit for Lynz features only. It is not cash, legal tender, crypto, or a redeemable financial instrument.

The legal basis is Art. 6(1)(b) GDPR for providing the feature and Art. 6(1)(f) GDPR for fraud prevention, reconciliation, and service integrity.

11. Payment and Billing Data

Lynz does not collect or store full payment card numbers, bank account details, card security codes, or full payment credentials in the Lynz app or Lynz backend.

When paid checkout is available, payment and billing data is collected, processed, and stored by the Merchant of Record shown at checkout. This may include buyer name, billing email, billing address, tax location, payment method details, invoices, receipts, subscription status, refund status, fraud-prevention signals, and transaction history.

Lynz may receive limited purchase confirmation data from the Merchant of Record, such as customer email, product or plan, transaction ID, subscription ID, payment status, refund or cancellation status, timestamp, and the minimum information needed to activate or support the purchased Lynz feature. That limited data is stored in Lynz backend systems.

The Merchant of Record handles checkout, payment processing, tax, invoicing, refunds, chargebacks, and payment compliance. Depending on the exact processing activity, the Merchant of Record may act as an independent controller for its own legal, tax, anti-fraud, and payment obligations.

12. Recipients and Processors

Lynz may share personal data with service providers only where needed for hosting, databases, object storage, email delivery, bot and abuse protection, payment confirmation, analytics, diagnostics, customer support, security, professional advice, or legal compliance. These providers process data under contractual obligations where required.

Lynz may also disclose data if required by law, regulation, court order, or to establish, exercise, or defend legal claims.

13. International Transfers

Lynz and its service providers may process data in countries outside your country of residence. Where GDPR transfer rules apply, Lynz relies on adequacy decisions, Standard Contractual Clauses, or another lawful transfer mechanism.

14. Retention

Lynz keeps personal data only for as long as needed for the purposes described in this policy, unless a longer period is required for legal obligations, accounting, payment disputes, fraud prevention, security, backup integrity, or legal claims.

Local app data remains on your device until you delete it, clear app storage, uninstall the app, or use available in-app deletion features. Relay objects, backup data, diagnostics, telemetry, support messages, account data, entitlement records, and payment confirmation records are retained according to their operational need and applicable legal requirements, then deleted or anonymized where appropriate.

15. Security

Lynz uses technical and organizational measures appropriate to the risk, including encrypted transport, access controls, authentication tokens, secure device storage where available, encryption for supported payloads, rate limiting, diagnostics redaction, and operational monitoring. No system can be guaranteed completely secure, but Lynz limits collection and access to what is needed for the service.

16. Your GDPR Rights

Subject to legal requirements and limitations, you may have the right to request access to your personal data, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent with future effect.

You may also have the right to lodge a complaint with a competent data protection supervisory authority. To exercise rights, contact info@lynz-app.com. Lynz may need to verify your identity or your account/device relationship before acting on a request.

17. Children

Lynz is not intended for children below the age at which they can lawfully consent to digital services in their country. If you believe a child has provided personal data to Lynz without appropriate consent, contact Lynz.

18. Changes

Lynz may update this policy when the product, legal requirements, providers, or data practices change. The date above shows when this policy was last updated.