Privacy policy

1Who we are

Fix & Restore Old Photos (Android package io.testiq.oldphotos) is made by TESTIQ LLC, 1500 N Grant St Ste N, Denver, CO 80203, United States. We decide how the data described here is used, which makes us its controller under the EU and UK General Data Protection Regulation (GDPR). You can reach us at support@testiq.io.

This policy covers the app and this website, oldphotos.testiq.io. The app is for adults aged 18 and over.

2What stays on your phone

You pick photos with Android's own photo picker, or scan a print with the camera, so the app sees only the photos you choose and never asks for access to your whole gallery.

• Your History, with each original, its results and the choices you made, lives in the app's private storage on your phone. It is not backed up to the cloud.
• Saved restorations go to your phone's gallery, where they are yours.
• Before a photo is uploaded, the app removes hidden data such as its location.

You can delete one restoration or clear all of History in the app at any time.

3What happens when you restore a photo

1. The app asks for your consent before your first upload and tells you, in plain words, that an AI restores the photo and that faces are processed only to restore them.
2. Our server checks the photo for nude or sexual content before any AI sees it (see Google Cloud Vision below). Such a photo is not restored.
3. The photo is uploaded over an encrypted connection to our server, which runs on Google Firebase, and is passed to an AI provider (next section).
4. The restored photo is sent back to your phone. The upload is deleted as soon as processing ends. The restored copy stays on our server only until your phone has downloaded it into the app, and for about 7 days at most. A scheduled cleanup, and a storage rule as a second safeguard, delete anything that is left.
5. When you save or share a photo, or export it at a larger size, the app asks our server to make the signed file (see "When you save or share" below).

4When you save or share

Our server makes the file you save, share or export at a larger size, because it adds the AI marking (a signed note in the file that says an AI modified it), and only the server may sign it: the signing key never leaves our server and is never on your phone. For each file the app sends: the restored photo (the result the server gave you); your original, only when the file needs it, which is when you blend the faces back toward the original or share a before and after image; the Faithful ↔ Enhanced level you chose; how the original lines up with the result; and where the faces are on the photo, as positions only. No other face data is sent, and the server does not store the positions or look at the faces to learn who anyone is.

The two photos are deleted as soon as the file has been made or the request has failed. If a request is interrupted, anything it left is deleted within a day at most. The finished file is deleted when your phone confirms it has it, and in any case within 1 day. If the server still holds your restored result, the app does not send it again. Nothing is kept for the file, and the photos stay on our server (Google Firebase): they are not passed to the AI provider.

5The AI provider

The restoring is done in two steps. First Google repairs the photo, using its Gemini image models on Google Cloud's Vertex AI, set up for zero data retention: the photo is sent inline with the request, and our server sends nothing unless it has checked that caching is turned off for our project. Under that setup Google does not use your photos to train its models and does not keep them. Google states that it may log a request that its abuse classifiers flag, for up to 90 days, and that its authorized staff may look at such a flagged request. Google says it marks every picture its image models make with SynthID, an invisible watermark that says it was made with AI.

For full quality, Replicate (Replicate, Inc., in the United States) then enlarges the repaired photo with the Real-ESRGAN model, on our behalf. Replicate receives only the photo Google repaired, never your original. We delete the copy we send it when the restoration ends, and Replicate removes anything that is left within a day at most. A restoration you get by watching an ad is repaired by Google alone: it is not enlarged and nothing is sent to Replicate.

If we ever change a provider, we will name the new provider here and say how long it keeps data before any photo is sent to it.

6Faces and biometric data

A restoration works on faces as part of the picture. We process them only to restore the photo. We never create face fingerprints, face templates or faceprints, we never compare a face with another to identify anyone, and we never use faces to recognize who is in a photo. Where the app finds faces on your phone to show you the face strip, it does so on the phone and keeps nothing. We keep no face data. When you save or share, the app sends where the faces are on the photo (positions only) so the server can make the file; the server does not store them, and the upload is deleted as soon as processing ends. The face finder is Google's ML Kit, built into the app. No photo and no face data is sent to Google, but ML Kit, like other Google SDKs, may send Google technical diagnostics: the app's name and version, your device model and Android version, a random installation ID and how long a step took.

7Services the app uses, and what each receives

Firebase: our server, credits and security

• Cloud Functions and Cloud Storage run the restoration. They receive your photo while it is processed, as described above.
• Firestore holds your credit balance and a record of credit changes, kept by the server. It also holds a record for each restoration (the kind, the quality, the status and how it was paid for, never the photo) and, for each rewarded ad, a one-time code and its reward. All of it is linked to a random ID for your installation or, if you sign in, to your Google account ID. It holds no photos.
• App Check, with Google Play Integrity, checks that requests come from the genuine app on a genuine device. Play Integrity also keeps up to three marks for your device on Google's side, which survive a reinstall, so the free restorations cannot be repeated by reinstalling. Our server reads these marks and sets them after each free restoration. They count the free restorations used on the device and are used by no other app of ours. If we have flagged an account for fraud (see “Fraud flag” below), all three marks are set, so that a new account on that phone gets no free restorations. Google keeps the marks for up to three years.
• Fraud flag: if repeated refunds of credits you have already spent, or a refund that Google reports as fraud, suggest misuse, our server marks the account with a flag, the date and the reason. This is an automated decision. A flagged account gets no free restorations and no ad restorations, and all three device marks are set, so a new account on the same phone gets no free restorations either. Credits you bought and the plan keep working. If you think it is wrong, write to support@testiq.io, and a person will review it. The flag is deleted with the account; the device marks stay up to three years.
• Remote Config downloads settings such as how many ad restorations a day are allowed, whether restorations are paused, and which of two versions of the first screens you see.
• Server logs and sign-in records: Google Cloud's request logs for our server normally hold the caller's IP address and user agent for 30 days. Firebase Authentication keeps when an account was made and last used, and how it signed in, and keeps the IP addresses of sign-ins for a few weeks.

Google Analytics for Firebase and Crashlytics

Events about how the app is used: finishing a step of the first screens, photos added, scans, restorations started, finished, refused or failed, using the sliders and the face strip, saves, exports, shares, reports, seeing the credits page, purchases, plan starts and cancellations, ad offers and rewards, and signing in. Events never contain a photo or anything you type. With them go a random ID for the installation, your device model, Android version, app version and language, your approximate location (country and region, worked out from your IP address, which Analytics does not store) and, where Android and your choices allow it, your advertising ID. When the app crashes, Crashlytics sends a report: the technical trace, the device model, Android and app versions, free memory and storage, and the installation ID, but never a photo.

Every crash report also carries the name of the screen that was open. If you agreed to analytics, it also carries the names of the last few things you did in the app (for example “restoration started”). These are fixed words from a list in the app, never a photo, a file name or anything you typed. Without that consent, only the screen name is added.

Each time the app starts, analytics stays off until Google's consent check has answered, and, where a choice is needed (the EEA, the UK and Switzerland), until you answer. If you agree, the events above are sent with the identifiers listed. If you decline, analytics may still send cookieless pings: the same events without any identifier or advertising ID, with nothing stored on your phone, which Google uses only to estimate overall usage (Google's “consent mode”). Crash reports are sent whatever you answer (see Legal bases).

If you redeem the pre-registration reward, the app sets one analytics property, “prereg”, on your installation. We use it only to compare how long that group keeps using the app. Like the other analytics data, it is kept on the phone and sent only once Google's consent check and, where a choice is needed, your choice allow analytics.

Google Play Billing: credits and the plan

Credit packs and the plan are bought through Google Play. Google handles the payment, and we never see your card details. Our server checks each purchase with Google before it adds credits, and Google shares order details with us, such as the order number, date, country and price. If a purchase is refunded or voided, its credits are taken back. For a plan, our server also keeps the purchase token it needs to check the plan with Google; the token is removed when you delete your account.

Google AdMob: ads you choose to watch

The app shows only optional rewarded video ads, after your free restorations, in return for one restoration at standard quality. There are no banners or pop-up ads, and never an ad during a restoration. AdMob receives your advertising ID, your IP address and information about your device and how you interact with the ad, and uses them to show and measure ads, for analytics and to prevent ad fraud. With each rewarded ad the app sends AdMob your account's random ID, and a signed message from Google confirms that you finished the ad, so that the reward is always delivered to the right account. In the EEA, the UK and Switzerland, Google's consent form asks for your choice, the app requests no ads until your choice allows them, and everything else still works if you decline. You can reopen the form in Settings. Learn how Google uses information from apps that use its services.

Sign in with Google (optional)

After your first purchase the app offers to sign you in with Google, so that your credits survive a reinstall or a new phone. In our own records we store only your Google account ID, never your photos. Firebase Authentication, the sign-in service of our server, also holds the email address, name and picture of your Google account on our behalf, until you delete the account. You can delete the account in the app or on this website.

Google's consent form

Each time the app starts, it asks Google's consent service whether a choice is needed where you are. This sends Google your IP address and basic information about your device and the app.

Google Cloud Vision: the safety check

Before a photo is restored, our server sends it to Google Cloud Vision (SafeSearch), which checks it for nude or sexual content. This runs in our own Google Cloud project, under the same Google Cloud terms and data processing agreement as the rest of our server. Vision answers only with likelihood scores. Google states that it processes the image in memory and does not store it, does not use it to train or improve its services, and keeps only temporary technical details about the request (its Cloud Vision data-usage page). A photo that is blocked is deleted without being restored, and your credit is returned.

8Reports and email

If you report a result from the result screen, we receive the report and the restored image you reported, so that we can review it. This is the one case where we keep an image: it is seen only by us, kept only for the review, and deleted when the report is settled and in any case within 90 days. If an image appears to show the sexual abuse of a child, US law requires us to report it to the National Center for Missing & Exploited Children and to keep it, securely and seen by nobody else, for at least a year after the report. We do this when we see such an image; we do not scan photos for it. If you choose “A child may be in danger or harmed” as the reason, we keep the report from the start, with the record of the restoration it names, so that we can pass it on to the authorities, even if you later delete your account.

If you write to us, we receive your email address and message. Choosing “Suggest a better translation” in Settings opens an email with the screen and language filled in, which you can read and change before you send it. We use emails only to answer you and improve the app.

9Legal bases

Where the GDPR applies, we rely on:

• your consent (Art. 6(1)(a)) for analytics with identifiers and for ads. You can withdraw it at any time in Settings (the consent form);
• performing our contract with you (Art. 6(1)(b)) for restoring your photos, which includes sending each photo to the AI provider named above, for the safety check, for credits and purchases, and for answering your emails. The app explains this before your first upload and asks you to agree before it sends anything;
• our legitimate interest (Art. 6(1)(f)) in keeping the app safe, preventing misuse and repeat free restorations, fixing crashes (crash reports are sent whatever you answer in the consent form) and measuring overall use without identifying anyone (the cookieless pings sent after you decline);
• our legitimate interest (Art. 6(1)(f)) in restoring the photo you chose, for the people in it who are not you and who cannot be asked, such as relatives, strangers and children: we process their image only to restore it, never to identify them, and delete the upload as soon as it is done. The photo comes to us from the person who uploads it;
• protecting children (Art. 6(1)(d) and (f)): where a report says a child may be in danger or an image appears to show the sexual abuse of a child, we keep the report and the record of the restoration and pass them to the authorities, as described under “Reports and email”.

10Who receives data, and transfers abroad

Data goes only to these recipients:

• Google, for Firebase, Google Play, AdMob, the optional sign-in and the AI provider. For Firebase and Google Cloud, Google processes data on our behalf under its data processing terms. For AdMob and Google Play, Google is also responsible for data under Google's own privacy policy.
• Replicate (Replicate, Inc., United States), which enlarges the repaired photo for full quality (see the provider paragraph above). It receives only that photo and enlarges it on our behalf. We do not yet have a separate data processing agreement or EU standard contractual clauses with Replicate. We are moving this step to our own servers in Google Cloud and will update this policy once that is done.
• Our email providers, which forward and store the mail you send us, and our website host (Namecheap, Inc., United States). Pages reach you through Cloudflare, Inc. (United States), which sits in front of our host to deliver and protect this website, so it also receives your IP address.

Google may process data in the United States. Google is certified under the EU–US Data Privacy Framework, and the UK and Swiss equivalents apply; standard contractual clauses back this up. Namecheap, Inc. is in the United States and is not covered by Google's certification; it handles the technical data of a visit to our website, such as your IP address, under its own terms. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework and its UK and Swiss extensions. We give data to no one other than the recipients listed here, except to the authorities where the law requires it (see “Reports and email”).

11How long data is kept

• Uploaded photos: deleted as soon as processing ends. A photo that is uploaded but never processed is deleted after about 1 day. A scheduled cleanup removes anything left from a job that got stuck.
• Restored results: kept on our server only until your phone has downloaded the result into the app, and for about 7 days at most. Then they are deleted automatically.
• Files made for saving, sharing and large exports: the two photos the app sends are deleted as soon as the file has been made or the request has failed, and anything an interrupted request leaves is deleted within a day at most. The finished file is deleted when your phone confirms it has it, and in any case within 1 day.
• Large-export records: a short note that a result's large export was paid for (the result's internal ID and the credit it used, never a photo). It is kept while your account exists and deleted with it.
• At the AI provider: as described in the provider paragraph above.
• On your phone: until you delete it in the app or uninstall the app.
• Credit and restoration records: the credit balance and its changes, a record of each restoration (the kind, the quality, the status and how it was paid for, never the photo), the notes of what a restoration cost us in AI, and the records of rewarded ads, which carry your account's random ID: kept while your account exists and deleted with it.
• Purchase and plan records: when you delete your account they stay, without the purchase token: product, order number, date and state, and your account's random ID (no name, email or card). They are deleted 7 years after the end of the year of their last change, as tax and accounting law requires.
• Fraud flag: kept with the account and deleted with it. The three device marks set for a flagged account stay at Google for up to three years.
• Pending device mark: the Play Integrity token that lets our server write your device mark after a free restoration is kept until the mark is written, and for 14 days at most.
• Account merges: when you sign in on a new phone and two accounts are combined, the note of the merge is kept while the account exists. The ticket that lets the app finish a merge is deleted 90 days after its last use.
• Server logs: 30 days, Google's default for Cloud Logging. Firebase Authentication also keeps the IP addresses of sign-ins for a few weeks.
• Accounts you stop using: an account that nobody has opened for 12 months, and that has no purchase and no Google sign-in, is deleted automatically with its data.
• Plan notices nobody claimed: when Google tells our server about a plan before the app has sent it, the note keeps the purchase token. If no account claims it within 30 days, it is deleted (for a refunded plan, only the token is removed).
• Review access codes: the record of a code that Google Play's reviewers used is kept until we revoke or delete it; it carries no name. When you delete your account, its ID is removed from it. Wrong codes that are typed are counted for 1 hour.
• Reported images: kept only to review your report, seen only by us, and deleted when the report is settled and in any case within 90 days. An image that appears to show child sexual abuse is kept for at least a year after our report, as the law requires, and reported to the authorities. A report that a child may be in danger or harmed is kept from the start, and even if you delete your account we keep with it, until the matter is closed, the record of the restoration it names with its credit entries, how the account signed in (for example with Google), the dates it was made and last used, and the photo of that restoration if it is still on our server. A report carries your account's random ID.
• Analytics: at most 14 months, then deleted automatically.
• Crash reports: 90 days.
• Emails: until your request is settled, and at most two years after our last exchange.

12Your choices and rights

• Privacy choices. In the EEA, the UK and Switzerland you can reopen the consent form in Settings and change your choice at any time.
• Delete your photos. Delete a restoration or clear History in the app. Nothing is kept on our side, except an image you reported (see how long data is kept).
• Delete your account. In the app or on the account deletion page. To delete only part of your data and keep your account, see delete some of your data.
• Advertising ID. Reset or delete it in your phone's settings.
• See, correct, delete, limit, object, take your data. Under the GDPR, the UK GDPR and similar laws you can ask what we hold about you, ask us to correct or delete it, ask us to limit how we use it, object to our use of it where we rely on a legitimate interest (including the fraud flag), and receive the data you gave us in a common format. Write to support@testiq.io. We answer within one month.
• Complain. You can complain to the data protection authority where you live or work. In the EU the authorities are listed at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en; in the UK it is the Information Commissioner's Office, https://ico.org.uk/make-a-complaint/.
• No sale of data. We do not sell your personal information. Google may use the advertising ID for personalized ads where you allow it; you can turn that off in your phone's settings and, in the EEA, the UK and Switzerland, in the consent form.

13Children

The app is for adults aged 18 and over and is not directed at children. Photos that show children are restored like any other photo, but we do not knowingly collect data from anyone under 18. If you believe a child has used the app, write to us and we will help.

14Where we are, and how to reach us from the EU and the UK

TESTIQ LLC, 1500 N Grant St Ste N, Denver, CO 80203, United States is based in the United States and has no establishment in the European Union or the United Kingdom. We have not appointed a representative in the EU or the UK under Article 27 of the GDPR and the UK GDPR. You can contact us directly about your data at any time at support@testiq.io; we answer in English, German, French, Spanish, Italian and Dutch. You also have the right to complain to the data protection authority of the EU country where you live or work (the list is at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en), or in the UK to the Information Commissioner's Office (https://ico.org.uk/make-a-complaint/).

15Washington residents

Washington's My Health My Data Act counts images of a face as “consumer health data”. The only such data we handle is the photo you choose to restore, which we process because you asked us to restore it, as described in this policy, and delete when processing ends. We do not sell it, we do not use it to identify anyone, and we share it only with the service providers named above. You can exercise the rights in “Your choices and rights” by writing to support@testiq.io; if we decline a request you may appeal by replying to our answer, and if the appeal fails you may contact the Washington Attorney General.

16Security and this website

Everything the app sends goes encrypted in transit (HTTPS) to our server, Google and Replicate. oldphotos.testiq.io uses no cookies, no analytics and no trackers, and loads nothing from other sites. Our host and Cloudflare, Inc. process your IP address and the pages you request to deliver the site and keeps these logs only briefly.

17Changes and contact

We update this page whenever the app or the services it uses change, and change the date at the top.

TESTIQ LLC, 1500 N Grant St Ste N, Denver, CO 80203, United States
support@testiq.io