1. Who is responsible and how to contact me
STRABUN is developed and provided by Constantin Georgiu, an individual software rightsholder using the ConGeoTech brand. I am the controller of personal information processed for operating STRABUN accounts, service security, purchases, support and this website.
Contact: [email protected]. The legal operator address is provided in section 1 of the Terms and Conditions. “I” and “me” mean the operator identified above; “you” means the person using STRABUN or its website.
This notice covers the application and its pages at congeotech.com/strabun. Features vary by platform, build and availability. The Terms and Conditions explain the software licence and consumer rights. Reading this notice or accepting the terms does not give blanket consent to new processing purposes.
2. Your archive and local processing
Your archive can contain photographs, scans, thumbnails, restored or generated versions, people and relationships, dates, locations, descriptions, testimony and other context you enter. STRABUN processes these files and records on your device and, if you choose, synchronizes them to storage you authorize. The operational STRABUN backend is not a repository for your family photographs, stories or timelines.
Restore, optional colorization, Reimagine and Live Photo / Alive run locally on supported devices with downloaded model packages. STRABUN does not send your photographs or descriptions to a cloud AI service. There is no Help organize cloud-AI feature. Local processing creates derivatives and temporary files; you decide what to retain or export. Generated images or movement can be inaccurate and are not evidence of historical events.
Model downloads contact the relevant package/download hosts, which receive normal network request information such as your IP address and requested file. They do not receive your archive as part of a model download. Hardware capability and job statistics, such as GPU/VRAM usage, are used on your device to select compatible processing and show progress; they are not an advertising profile or remote analytics feed.
Personal information about relatives may come from you rather than those relatives. Include and share only information you are entitled to use. Family photographs and stories can reveal sensitive information. A photo containing a face is not automatically biometric identification data; STRABUN’s local face alignment does not identify people against an identity database. If you use the archive outside purely personal or household activities, you may have your own data-protection responsibilities.
3. Accounts, devices and operational records
Where a feature requires a STRABUN account, authentication uses Google/Firebase services. Account records include your account identifier and authentication information, such as email and verification status. Account sign-in and storage-provider authorization have separate purposes.
The service may process device identifiers, platform, app/protocol version, optional device labels and registration/activity timestamps to manage account devices and compatible archive writers. Archive-control records can include archive identifiers, storage-root or viewing-projection identifiers, writer enrollment and leases; they coordinate authorized access rather than hold the family archive itself.
Where purchases are offered, records may include product and purchase identifiers, payment-provider references, purchase/entitlement status, relevant timestamps and receipt-verification information. The seller/payment provider handles the payment details described at checkout. STRABUN does not require you to send full payment-card details to the support mailbox.
Service requests and security operations can create limited logs, including timestamps, request/status information and technical errors. Do not include private archive material in support messages unless it is necessary and you choose to provide it. If you contact me, I receive your email address, message and any attachments you send.
4. Storage you choose and permissions
You can keep material locally or use a supported storage provider you authorize. Providers operate under their own terms and privacy notices. Synchronization sends selected archive files and records to that provider; this is storage, not cloud AI inference.
For Google Drive, the private application-data archive uses the drive.appdata permission. An optional visible viewing/export projection uses drive.file, limited to files the application creates or you authorize for it. These permissions do not provide unrestricted access to all Drive files. Account sign-in may also request basic identity information to show and authenticate the connected account. For supported OneDrive storage, the application uses the authorized application folder and relevant identity/access permissions.
You can revoke authorization through the provider’s account controls. Revocation stops authorized future access but does not erase files or copies already created. A read-only viewing copy, linked viewing device or exported package has separate access and deletion controls. Only share a projection or export with people you intend to allow access.
STRABUN’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google API user data is not sold, used for advertising or used to train my own AI models. Access, use and transfer are limited to the user-facing features and permitted operational/security purposes under that policy.
5. Purposes and lawful bases
I process necessary account, service and purchase information to perform the agreement with you or take steps you request before a contract. Your chosen storage connection and synchronization carry out the features you request; the provider’s authorization is also required.
I rely on legitimate interests for proportionate service security, fraud/abuse prevention, troubleshooting and responding to support or legal requests, after considering the effect on individuals. You can object where that basis applies. Records required by applicable tax, accounting or other law are processed to meet legal obligations.
Where consent is required for an additional optional purpose, it must be requested separately and can be withdrawn without affecting earlier lawful processing. No optional advertising or analytics consent is bundled into the terms. A contract with an uploader does not by itself establish a lawful basis for every use of another person’s sensitive information.
6. Recipients and international processing
Information is disclosed as needed to services providing the features you choose: Google/Firebase for authentication and account infrastructure; Google Drive or Microsoft OneDrive for authorized storage; package/download hosts such as Hugging Face and the model publisher for downloads; the actual seller/payment provider for a purchase; and Gmail for correspondence. Website hosting uses Cloudflare Pages. Service providers and authorities may receive information where necessary to provide the service, protect rights or meet a legal duty. Your exports and sharing choices can disclose archive material to their recipients.
I do not sell personal information or use family archives to train my own AI models. I do not provide your family content to advertising networks. External services may independently process information for their own account, security and legal purposes.
Providers may process information in the EEA, United States or other countries. Their applicable service terms and transfer provisions determine how they protect international processing, including standard contractual clauses or other mechanisms where applicable. These vary by provider and product. Contact me for information about the safeguards applicable to information I control. Relevant notices include Google privacy, Firebase privacy and security, Microsoft privacy, and Cloudflare privacy.
7. Website, cookies and analytics
The STRABUN pages on congeotech.com are static pages. Cloudflare Pages processes normal request information, including IP address and browser/request details, to deliver and secure them. The website loads fonts from Google Fonts, which receives network requests and associated technical information. Contact by email is handled through Gmail.
These pages do not include advertising, audience analytics or tracking-cookie integrations. External links, authentication and provider checkout pages have their own data/cookie practices. The application does not include an advertising or audience-analytics service. A future optional integration requiring consent will be disclosed before it is enabled.
8. Retention, security and deletion
Local archive files remain under your device/file controls, and provider files remain under the provider’s storage controls until removed. Old revisions, backups, caches, exported packages and viewing projections are separate copies. Deleting an item, signing out, revoking authorization or uninstalling does not necessarily delete all of them.
I retain account and operational records while needed to provide the account, coordinate authorized devices and handle security. Purchase and legally required records are retained for applicable accounting/legal periods and justified disputes. Support correspondence is retained while resolving the request and necessary follow-up or claims. Logs are retained only as needed for operation, security and investigation, subject to the relevant service’s retention settings. Retention depends on the record’s purpose and applicable obligations; account closure does not justify indefinite retention of unrelated information.
You can request account closure or erasure by email. I will identify what can be deleted, any information retained for a lawful reason, and the steps needed for your local/provider copies. This is a contact-based request; the app does not promise an instant, automated deletion of every copy. Keep a backup or export of material you want before deleting it.
I use reasonable measures appropriate to the information and service, including authenticated service access and platform credential controls. Your device security, authorized provider account and sharing choices also matter. No absolute security or universal end-to-end encryption guarantee is made. Revoking access can prevent future access but cannot recall a copy someone has already downloaded.
9. Your rights and complaints
Subject to applicable law, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it. You can ask about the source and recipients of your information, including where you are a relative whose information appears in an archive rather than an account holder.
Send requests to [email protected] and describe the information or account concerned. I may need proportionate identity verification to avoid disclosing information to the wrong person. I normally respond to GDPR requests within one month; if a lawful extension of up to two further months is necessary, I explain it within the first month. Rights have legal exceptions and must also respect other people’s rights.
You may complain to Romania’s ANSPDCP or your competent data-protection authority. People outside the EEA may also have rights under their applicable privacy laws; contact me to exercise them. STRABUN does not make solely automated decisions about eligibility, employment, credit or similar matters with legal or comparably significant effects.
10. Children and changes
STRABUN accounts are intended for adults aged 18 or older. An archive may include children as subjects, so exercise particular care with their photographs, stories and sharing. This does not authorize unrestricted use of children’s information or override protections that apply by law.
Changes to this notice carry a new version/effective date. Material changes are brought to your attention as appropriate before new processing starts, and separate consent is requested where required. Contact me by email above with any privacy question.