Img2Wallet Privacy Policy

Img2Wallet is operated by Polyphasic Developers Ltd ("we," "us," or "our"), a company registered in the United Kingdom. This Privacy Policy explains how Img2Wallet handles information when you use the Img2Wallet app for iPhone and Apple Watch.

For the product overview and supported image types, visit the Img2Wallet landing page.

Summary

• When you tap Add to Wallet, the image you selected is sent to a server we operate at id.waruj1m.uk, which builds and cryptographically signs the Apple Wallet pass. The image is deleted once signing completes and is not retained.
• We do not require an account, and we do not use your images or pass contents for advertising, profiling, or any purpose other than creating the pass you asked for.
• Img2Wallet is free and supported by advertising. Ads are served by Google AdMob, a third-party service that collects device and advertising data.
• The app does not present Apple's App Tracking Transparency prompt and does not ask permission to track you. Because iOS releases the advertising identifier (IDFA) only after that permission is granted, the IDFA is not available to the ads SDK.
• If you are in the UK, EEA, or Switzerland, Img2Wallet asks for your advertising consent through a Google-provided form when you first open the app. No ad is requested until you have answered, and you can change your answer at any time.

Information We Collect

Images, Barcodes, and Pass Content

To create a pass, Img2Wallet needs the image you choose through Apple's standard photo picker.

Apple Wallet will only accept a pass that carries a valid cryptographic signature, and signing requires a private certificate that cannot safely be stored inside the app. For that reason, when you tap Add to Wallet the image you selected is transmitted over an encrypted connection to a server we operate at id.waruj1m.uk. That server generates the pass, signs it, returns it to your device, and deletes the image once signing completes.

This means your image, and whatever is visible in it, does leave your device at the moment you create a pass. Depending on what you convert, that may include loyalty card numbers, ticket barcodes, membership details, or any other content captured in the image, so please consider what is in frame before converting it.

We do not retain the image after the pass is signed. We do not use it to build a profile of you, we do not share it with advertisers or any other third party, and it plays no part in the advertising described below. Once returned, the pass is handed to Apple Wallet (PassKit) on your device, and any pass data stored on your device or synced through your Apple account is handled under Apple's own terms and policies.

App Data Stored On Your Device

Img2Wallet may store items such as your app preferences, your advertising consent choice, and records of the passes you have created locally on your device. This data stays on the device unless you back it up yourself through Apple's backup systems.

Advertising and Device Data Collected by Google AdMob

Img2Wallet displays advertising supplied by Google AdMob, a service provided by Google LLC and, for users in the UK, EEA, and Switzerland, Google Ireland Limited. To select, deliver, measure, and report on ads, the Google Mobile Ads SDK and Google's advertising partners may collect and process information from your device, including:

• Advertising and device identifiers made available to the SDK. Apple's Identifier for Advertisers (IDFA) is not among them, because the app does not request tracking permission, as explained below
• Device information such as device model, operating system version, language, and country or coarse location derived from your IP address
• IP address and network information
• Ad interaction data such as ad impressions, clicks, and view time
• App information such as the app identifier and app version
• Diagnostic and performance data relating to ad delivery, including crash and error data generated by the ads SDK

This information is collected by Google directly through its SDK. We do not receive the underlying identifiers or profiles. We receive only aggregated, non-identifying reporting from Google, such as total impressions, revenue, and country-level breakdowns.

Advertising, Consent, and Tracking Permission

Img2Wallet is free to use and is funded by advertising. There is no paid ad-free version at this time.

Tracking Permission

Img2Wallet does not present Apple's App Tracking Transparency (ATT) prompt and does not ask for permission to track you across apps and websites. On current versions of iOS, the advertising identifier (IDFA) is released to an app only once that permission has been granted, so the IDFA is not available to the Google Mobile Ads SDK in Img2Wallet.

You can review and restrict app tracking generally at any time in Settings › Privacy & Security › Tracking.

Advertising Consent

If you are in the UK, EEA, or Switzerland, the app presents a consent form supplied by Google's User Messaging Platform when you first open it. You can consent, manage individual purposes, or decline. The Google Mobile Ads SDK is not started and no ad is requested until that choice has been made, so no advertising data is collected from your device beforehand.

You can revisit or change your choice at any time: open Img2Wallet, tap the ⓘ button in the top bar, and choose Privacy settings. That option appears whenever Google indicates a consent choice applies to you.

If you decline, or restrict individual purposes, Google limits its processing accordingly and any ads you see are non-personalised.

Outside the UK, EEA, and Switzerland no consent form is shown.

What This Means For The Ads You See

Because the app never requests tracking permission, the IDFA is not available, so Google cannot link your ad activity in Img2Wallet to a cross-app advertising profile built from that identifier. Subject to the consent choice you make, Google does still process other data described above, including your IP address and device and ad interaction information, for ad delivery, frequency capping, aggregated reporting, and fraud and abuse prevention, and may use that data in accordance with its own policies.

Google's Own Policies

Google's handling of the data it collects is governed by its own terms. For details, see:

• Google Privacy Policy
• How Google uses information from sites or apps that use its services
• About AdMob and user data
• Google Ads Settings, where you can manage ad personalisation on your Google account

Photo Library

Img2Wallet uses Apple's standard photo picker to let you choose the image you want to convert. The picker runs outside the app, and Img2Wallet receives only the single image you select — the app is not granted access to your photo library and cannot browse or read any other photo.

The image you choose is sent to our pass-signing server as described above. It is never shared with advertising partners or used for any advertising purpose.

How We Use Information

We use information to:

• Convert the image you select into a signed Apple Wallet pass and return it to your device
• Save your app preferences, consent status, and locally stored pass records
• Display advertising that funds the free app, in line with the permissions and consent you provide
• Understand aggregate ad performance and revenue
• Diagnose app errors, prevent abuse and invalid ad activity, and improve reliability

How Data Is Shared

We do not sell your personal information, and we do not share your images or pass content with advertisers, data brokers, or any other third party.

Your image is sent to our own pass-signing server as described above. Beyond that, data is handled by others only where necessary to operate the app and its advertising:

• Google AdMob, and Google's advertising partners, to select, deliver, measure, and report on ads
• Apple, through PassKit, the App Store, and standard distribution and crash reporting features you may have enabled on your device
• Our hosting and infrastructure providers, to the extent needed to run the pass-signing server

Legal Bases for Processing (UK and EU users)

Where UK GDPR or EU GDPR applies, we rely on the following legal bases:

• Performance of a contract, for transmitting and signing the image you submit so that we can deliver the pass you asked for.
• Legitimate interests, for measuring aggregate ad performance, preventing fraud and abuse, and keeping the app secure and reliable.
• Consent, for the collection of advertising data from users in the UK, EEA, and Switzerland. Consent is gathered in the app through Google's User Messaging Platform before any ad is requested, and can be changed or withdrawn at any time as described above.

Data Retention

Images sent to our pass-signing server are deleted once the pass has been signed and are not kept afterwards. Our server may generate ordinary operational logs, such as IP address and timestamp, which are kept only as long as needed to run and secure the service.

Data stored by Img2Wallet on your device is retained until you delete it, delete the app, or overwrite it through normal use.

Advertising data collected by Google is retained according to Google's own retention schedules, described in the Google Privacy Policy linked above. We do not hold copies of that data.

Your Rights and Choices

You can:

• Restrict app tracking in Settings › Privacy & Security › Tracking
• Limit ad personalisation on your Google account through Google Ads Settings
• Choose not to convert an image whose contents you would rather not transmit for signing
• Change your advertising consent choice at any time from the ⓘ screen, under Privacy (UK, EEA, and Switzerland)
• Delete the app, which removes the app data stored on your device

Depending on where you live, you may also have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to lodge a complaint with a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). Because we do not hold identifiers that let us link data to you, requests about advertising data are usually best directed to Google; contact us and we will help where we can.

If you are a California resident, we do not sell or share your personal information as those terms are defined under the CCPA/CPRA. Requests relating to data collected by Google's advertising services should be directed to Google.

Children

Img2Wallet is not directed to children under 13, and we do not knowingly collect personal information from children. The app is not designated as a child-directed app for advertising purposes. If you believe a child has provided personal information through the app, contact us and we will review the request.

Security

Images are transmitted to our pass-signing server over an encrypted connection and are deleted once the pass is signed. We use reasonable measures appropriate to the app's design to protect the information Img2Wallet handles. No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

International Transfers

Google and Apple operate globally and may process data outside your home country, including in the United States. Where personal data is transferred out of the UK or EEA by those providers, they are responsible for using an approved transfer mechanism such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses. Details are set out in their respective privacy policies.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, provide additional notice in the app or on this page.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact [email protected].

Polyphasic Developers Ltd, Lincoln, United Kingdom.