Privacy policy

Last updated: 21 September 2026 · document v1.5 · app version 1.0.0 · Borrito for Mac 1.0.6

Applicable to the mobile application Borrito — Photo Cleaner for iOS and Android, and to Borrito for Mac (section 17).

Borrito helps you free up space: it finds duplicate and look-alike photos, large videos, WhatsApp files and old screenshots; it shows you what slows your phone down and which screenshots leave private data in view. All of that analysis happens inside your phone. Superbites Studios S.A.S. does not operate servers that receive your photos, your videos or information about your library, and cannot see them. This document explains plainly what data the app processes, why, with whom it is shared when that happens, how long it is kept, and what rights you have.

The essentials, in five lines

Your photos, your videos and the text in your screenshots never leave your phone. There are no accounts, no ads, no advertising identifiers and no cross-app tracking. Borrito never deletes anything on its own: it asks you first, and then the operating system asks you to confirm. The only things that leave the device are the purchase information the store needs to charge for Borrito Pro and, on Android only, technical metrics from the Google tool that reads the text in screenshots (never the images or the text; see section 6). You can erase everything the app keeps, immediately, from inside the app.

1. Data controller

The controller of the personal data described in this document is:

Company

Superbites Studios S.A.S.

Tax ID (NIT)

901.861.933-9

Address

Carrera 2 # 3-4, Armenia, Quindío, Colombia

Country

Republic of Colombia

Contact email

apps@superbitesstudios.com

Responsible area

Personal data requests — Borrito

Every request, question or complaint about personal data should be sent to that address. It is the official channel for these matters.

2. Scope and acceptance

This policy applies to the Borrito mobile app distributed through Apple's App Store and Google Play, and to Borrito for Mac, in every version and every country where they are available. It does not apply to operating systems, app stores or third-party services, which operate under their own policies; section 6 lists which ones are involved and what they process.

By downloading, installing or using Borrito you confirm that you have read this policy. The permissions the law or the operating system require —photo access and notifications— are requested separately, through the system's own dialogs, before they are used.

3. How Borrito works

Borrito is a local app. To find what takes up space, it reads your library with the operating system's tools (PhotoKit on iOS and MediaStore on Android) and compares photos with each other on the device. No image, video, thumbnail or library data is sent to Superbites Studios S.A.S. or to third parties.

When you decide to free up space, Borrito asks the operating system to delete the files you selected, and the system shows its own confirmation:

• On iPhone, deleted items go to the "Recently Deleted" album for 30 days.
• On Android 11 or later, they go to the system trash for 30 days.
• On Android 10 or earlier, the system has no trash and deletion is permanent; the app warns you before continuing.

Before that step, Borrito shows its own question with what is about to be deleted; if you cancel, nothing is deleted.

If you use iCloud Photos, what you delete is also deleted on your other devices signed in to the same iCloud account, because that is how Apple's sync works. The app says so on the bin screen.

When you ask for it, Borrito can also:

• Compress videos and turn Live Photos into still photos (the latter on iPhone only). The new copy is saved in your library next to the original, with the same date. The original is not deleted unless you choose to and confirm it; you can also keep both. On iPhone with iOS 26 or later, if you leave the app while it compresses, the system may let the work continue and show you its progress; iOS handles that and nothing leaves the phone.
• Check your phone's speed: it reads what the system itself reports —temperature, memory in use, battery level and health, days since the last restart and free space— to tell you what slows it down. It is shown while the screen is open and is not stored.
• Check your phone's security: it asks the system whether a screen lock is set, whether Face ID or Touch ID is set up (on iPhone), the system version and, on Android, the security-patch date, whether USB debugging is on and whether there are signs the system was modified (root or jailbreak). It changes no setting and does not store the answers.
• Find screenshots with private data: on the phone and without an internet connection, it reads the text in your most recent screenshots (up to 400) to point out the ones that seem to contain card numbers, passwords, verification codes, bank accounts or ID numbers. On iPhone this is Apple's text recognition (Vision); on Android, Google's ML Kit library, both on the device. The text read is neither stored nor sent: only which screenshots look sensitive, and of what kind, is kept in the app's memory until you close it. The screenshots found are shown blurred until you choose to see them, and you can move them to the safety bin.
• Count photos with a location (iPhone only): it checks how many of your photos have the place they were taken saved in them, to remind you to remove it when sharing. They are only counted; Borrito does not show, store or send those places.

4. Data processed

Everything below is stored only in the app's private storage on your device:

• Your photos and videos. Read for analysis, with your permission. They are not copied off the phone.
• A fingerprint of each photo. A 64-bit number computed from a thumbnail, together with the file's library identifier, modification date and size. It makes the next scan faster. The image cannot be rebuilt from it.
• The last scan's results. Groups of duplicates and look-alikes, and the lists of large videos, WhatsApp files and screenshots, with their sizes and dates.
• The safety bin. The list of files you marked to free up, with their size and capture date. While a file is on that list it stays untouched in your library.
• Your swipe-mode progress. Which photos you already chose to keep, so they are not shown again.
• Stats. How much space you have freed and when.
• Preferences. Your name if you type it (only to greet you), language, light or dark theme, what you said fills your phone, and whether the reminder is on.
• Borrito Pro status. Whether Pro is active and how much of today's free allowance you have used.
• Videos and Live Photos already converted. The identifiers of originals that already have their copy, so they are not offered again if you keep both.

The Speed and Security readings, the result of the screenshot check and the count of photos with a location are not stored on the phone: they are computed when you open those screens and are gone, at the latest, when you close the app. The text in screenshots is never kept at any point.

Borrito does not request or process your contacts, your current location, the microphone, the camera, biometric data or health data. It does not recognise faces or classify the content of your photos. The only content it reads is the text in your screenshots, when you ask for that check: it may find in them data you captured yourself —for example, a card number or an ID document—, which is sensitive data. That is why the analysis happens only on your phone, is not stored, is sent to no one and only serves to show it to you.

4.1 Legal basis

Processing is based on your consent, given when you grant the operating system's permissions, and on providing the service you ask for (finding and freeing space and, if you buy it, Borrito Pro). For Colombia, processing is carried out with the prior, express and informed authorisation of the data subject under Law 1581 of 2012 and Decree 1074 of 2015.

5. Device permissions

5.1 Photos and videos

The only essential permission: without it Borrito cannot find anything. You can grant full or limited access; with limited access Borrito only sees the photos you select. You can change or revoke it at any time in your phone's settings.

If your photos are stored in iCloud Photos, iOS may download a photo's thumbnail from iCloud so Borrito can analyse it or show it to you. Apple's system makes that connection with your account; Borrito receives nothing from it.

Borrito also uses this permission to save to your library the copies it creates when compressing videos or converting Live Photos, and to read the text in your screenshots when you ask for the private-data check.

5.2 Notifications

Optional, and only requested if you turn on the weekly reminder or start a free trial (to remind you the day before it ends). They are local notifications: your own phone schedules them and they go through no server. You can turn them off in the app or in your phone's settings.

5.3 Face ID and Touch ID

Borrito does not use Face ID or Touch ID and accesses no biometric data. In the Security check it only asks the system whether they are set up, which iOS answers without showing any prompt.

5.4 Screen kept on

While compressing videos or converting Live Photos, Borrito keeps the screen on so the phone does not lock and stop the work. When it finishes or you cancel, the phone goes back to normal.

6. Third parties involved

Only these parties may process data related to your use of Borrito, and none of them receives your photos, your videos or the text in your screenshots.

Apple Inc. — App Store and payments on iOS; iCloud Photos if you use it. Receives the purchase transaction. Policy: apple.com/legal/privacy

Google LLC — Google Play and payments on Android. Receives the purchase transaction. Policy: policies.google.com/privacy

RevenueCat, Inc. — Server-side subscription validation, as a data processor. Receives an anonymous per-install identifier, the product purchased, purchase and renewal dates, store country, device model, OS version and the request's IP address. It does not receive your photos, your name or your email. Policy: revenuecat.com/privacy

Google LLC — ML Kit (Android only) — Google's library that reads the text in your screenshots when you ask for the private-data check. Reading happens on the phone, and Google states that ML Kit does not send the images or the resulting text to its servers. The library does send Google technical usage and diagnostic metrics: the phone's manufacturer, model and OS version, the app's name and version, a per-installation identifier that Google says is not intended to identify you, response times, format and size of the processed images, feature version, events (initialisation, detection, releasing resources) and error codes. Google uses this data to measure, maintain and improve ML Kit and to detect abuse, sends it encrypted and states that it does not transfer it to third parties. On iPhone, Apple's system does the reading and nothing is sent. Details: developers.google.com/ml-kit/android-data-disclosure · Policy: policies.google.com/privacy

Apart from the above, there is no other provider, ad network, analytics tool, crash-reporting service or attribution service in the app. Fonts ship inside the app, so your IP address does not reach a font server either.

7. Backups

On Android, Borrito excludes its data from cloud backups and device-to-device transfers. This is deliberate: its lists use identifiers that only make sense on the phone that created them, and restoring them on another phone could point at different photos. On iPhone, the data follows the system's backup rules.

8. Subscriptions and payments

Borrito offers Borrito Pro as a weekly or yearly subscription, or as a one-time purchase. Purchases are processed exclusively through the App Store or Google Play. Superbites Studios S.A.S. never sees, receives or stores your card or payment details.

The app keeps on your phone whether Pro is active, so it works offline, and RevenueCat confirms it with the store. Payment, renewal and cancellation terms are in the Terms of use.

9. What Borrito does not do

• It does not upload your photos or videos to any server.
• It does not store or send the text in your screenshots.
• It does not delete anything without your confirmation and the operating system's, including the originals of the videos it compresses.
• It does not change any of your phone's security settings.
• It does not promise to "speed up" your phone: it shows you what slows it down and how to fix it.
• It does not suggest your favourite photos.
• It does not show ads, and it does not sell or rent data.
• It does not use advertising identifiers or track you across other apps or websites.
• It does not claim to recover photos that are no longer in the system trash.

10. Children

Borrito is not directed at children under 13 and does not knowingly collect personal data from anyone. Because the data lives on the device, uninstalling the app or using the erase option in section 11 is enough.

11. Retention and deletion

11.1 Data on your device

It is kept while the app is installed. You can delete it at any time:

• In the app: Settings → Erase Borrito data deletes your name, preferences, stats, the last scan, the photo fingerprints, the safety-bin list and the list of videos and Live Photos already converted. Your photos are not touched: those in the safety bin stay in your library, and so do the copies created by compressing or converting.
• By uninstalling the app, which removes everything Borrito stored.

11.2 Subscription data

Apple, Google and RevenueCat keep purchase history according to their own legal and accounting obligations. If you want RevenueCat to delete the record linked to your Borrito install, write to us and we will request it.

12. Security

• Data is stored in the app's private container, protected by app sandboxing and by the operating system's encryption, active when the phone has a passcode or biometrics.
• With no servers of our own there is no central database to leak.
• All communication with RevenueCat is encrypted with TLS, and purchases are verified server-side.
• Before freeing space, the app checks each file again: if it no longer exists, changed or is now a favourite, it is taken off the list without being deleted.

If you find a vulnerability, report it to apps@superbitesstudios.com. If an incident affects personal data under our responsibility, we will notify the people affected and the competent authorities within the legal deadlines.

13. International transfers

The data described in section 6 —purchase information and, on Android, ML Kit's technical metrics— is processed by providers outside Colombia, mainly in the United States, based on your authorisation and on each provider's terms, which include equivalent safeguards. Data that lives on your device is not transferred.

14. Your rights

14.1 Colombia — Law 1581 of 2012 (Habeas Data)

You have the right to know, update and correct your data; to request proof of the authorisation you gave; to be told how your data has been used; to file complaints with the Superintendence of Industry and Commerce; to revoke your authorisation and request deletion when no legal or contractual duty prevents it; and to access your data free of charge.

Procedure. Send your request to apps@superbitesstudios.com with your name, a way to contact you and what you are asking for. Queries are answered within ten (10) business days, extendable by five (5). Complaints are answered within fifteen (15) business days, extendable by eight (8).

The supervisory authority is the Superintendencia de Industria y Comercio (sic.gov.co).

14.2 European Economic Area, Switzerland and United Kingdom — GDPR

You have the rights of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time. You can exercise them by writing to the contact address and complain to your local supervisory authority. Because we do not keep your photos or library data, we cannot locate or hand them over: they live only on your phone.

14.3 California and other US states

We do not sell or share personal information within the meaning of the California Consumer Privacy Act (CCPA/CPRA). You can exercise the rights to know, delete, correct and non-discrimination by writing to the contact address.

15. Changes to this policy

We may update this document to reflect changes in the app or the law. The current version will always be published at this address, with its update date. If a change is substantial —in particular, if it adds a new data recipient— we will announce it inside the app before it takes effect.

16. Contact

Superbites Studios S.A.S. Email: apps@superbitesstudios.com Suggested subject: "Personal data — Borrito" Armenia, Quindío, Colombia

17. Borrito for Mac

Borrito for Mac is a desktop app for macOS that helps you free up disk space. All the analysis happens on your Mac: it has no accounts, advertising or analytics, and your files never leave the computer. It only goes online to look for updates (section 17.7) and, if you have a subscription, to renew your licence (section 17.6). Only if you buy Borrito Pro for Mac is purchase data involved, as explained in section 17.6.

17.1 What it looks at

• Caches, logs and developer and video-app leftovers, from a curated list of system places, each with its own explanation.
• Your Downloads, Desktop, Documents, Movies, Music and Pictures folders, to find duplicate files, very large files and downloads you haven't opened in months. To confirm two files are exact copies it computes a fingerprint (SHA-256) of their content on your Mac; the fingerprint never leaves the computer.
• In those same folders, the photos and videos kept as files ("Photos"), to find look-alike photos, heavy videos and screenshots. To compare look-alike photos it reads the date each photo was taken and computes, on your Mac, a visual fingerprint of a thumbnail; neither the fingerprint nor the photo leaves the computer. It does not look at the Photos app library or at programming or app project folders.
• Your installed apps, their size and the last-used date macOS keeps.
• Xcode simulators (their name, version and last-used date) and, in your folders, programming projects: it only looks at their files' dates to know whether they've gone untouched for more than 3 months. It does not read your code.
• The folder where Telegram keeps what it downloaded, to show you how much space it takes.
• The iCloud Drive files that are downloaded on the Mac.
• If you ask, the size of the folders in your home folder or in a folder you choose ("Lens").
• In the menu bar, disk space, memory, processor and battery, read from the system itself.

17.2 macOS permissions

macOS may ask you to allow Borrito to read your Desktop, Documents or Downloads folders. Full Disk Access is optional: it only lets Borrito see places the system protects, such as iPhone backups or Mail attachments. You can grant or remove it in System Settings → Privacy & Security. "Open at login" uses the standard macOS mechanism and can be turned off in the app or in System Settings → General → Login Items.

17.3 What it does with your files

• Cleanup, My clutter and Photos: what you choose is moved to Borrito's quarantine, a folder on your own Mac (~/Library/Application Support/Borrito/Cuarentena), together with a list of where each item was. For the period you choose —3, 7, 14 or 30 days; 7 by default— you can put it back exactly where it was with one click. When the period ends, or if you choose "Free it now", it is deleted for good.
• Apps: when you uninstall an app, the app and its leftovers go to the macOS Trash; you can take them out of there until you empty it.
• Cloud: removing the download of an iCloud Drive file does not delete it: it stays in iCloud and on your other devices, and downloads again when you open it.
• Compressing a video: it creates a new HEVC copy on your Mac, next to the original. Only if it plays, lasts as long and takes at least 20 % less space does the original go to quarantine; otherwise the copy is discarded. Nothing is sent to any server.
• Moving to a disk: it copies the files you choose to the folder you pick on another disk, checks that each copy is identical, and only then does the original go to quarantine.
• Borrito does not change the content of any file and moves nothing you haven't chosen.

17.4 Data it keeps

Only on your Mac, in the app's preferences: your name and avatar colour if you choose them (only to greet you), the theme, the language, the animation, quarantine, menu bar and login settings, the date you started using Borrito, whether you've seen the welcome, and how much space you freed each day. The quarantine list is stored next to the quarantined files. If you turn on notices, also the date of the last notice and of the last scan.

Notices: "Disk almost full" and "Weekly reminder" are optional and off by default; when you turn them on, macOS asks for your permission. They are local notifications: your own Mac schedules them from the free space it measures, and they go through no server. Turn them off in Settings → Notices.

17.5 How to erase everything

• Settings → Erase my Borrito data erases your profile, preferences and activity. It does not touch the quarantine or your files.
• To empty the quarantine: Quarantine → Free it all now.
• If you uninstall Borrito, empty the quarantine first or delete the ~/Library/Application Support/Borrito folder; otherwise what was in quarantine will keep taking up space on your disk.

17.6 Buying Borrito Pro for Mac

This only applies if you buy Borrito Pro for Mac on our website.

• Paddle.com Market Ltd. processes the purchase as Merchant of Record: it receives your name, email, country, billing address where the law requires it, and payment details, which never reach Superbites Studios S.A.S. Policy: paddle.com/legal/privacy
• What we receive from Paddle: your email and the order details —product, dates, transaction and subscription identifiers, and their status. We use them only to issue your licence, email it to you, renew it while you pay, and handle refunds or support. They are kept in our database (Supabase, access restricted to the server) while the licence is valid and afterwards for as long as accounting and tax rules require.
• Licence renewal: only if you have a subscription, the app connects to apps.superbitesstudios.com (hosted on Vercel) a few days before your licence ends. It sends only the licence text —its identifier, plan and dates—; as with any connection, the server sees the request's IP address. Nothing about your files or your Mac is sent. Lifetime licences never connect.
• Borrito for Mac still includes no analytics, crash-reporting or advertising.

17.7 Updates

Borrito for Mac uses Sparkle, an open-source program, to look for new versions. While it is on —you can turn it off in Settings → About—, once a day it checks apps.superbitesstudios.com/borrito/appcast.xml, which points to our storage on Supabase. The request only includes the app's name and version; as with any connection, the server sees the IP address. It sends nothing about your files and no profile of your Mac. It asks you before installing, and only installs versions signed by Superbites Studios S.A.S.

18. Annex — Store privacy labels

For Apple and Google, data is "collected" only when it leaves the device. What is processed on the phone and never transmitted is not declared.

• Purchase history — RevenueCat, Apple, Google — Declared. Purpose: app functionality. Not used for tracking.
• Identifiers (anonymous install identifier) — RevenueCat — Declared. Purpose: app functionality. Not linked to your identity.
• App diagnostics and performance; per-installation identifier — Google ML Kit, Android only — Declared on Google Play. Purpose: analytics and diagnostics of the library. Not linked to your identity; not used for advertising. Not applicable on iPhone.
• Photos, videos and screenshot text — On the device only — Not declared. Never transmitted.
• Phone status (temperature, memory, battery, security) — On the device only — Not declared. Neither stored nor transmitted.
• Name — On the device only — Not declared. Optional; never transmitted.
• Location and contacts — Not processed (photos with a location are only counted on the device) — Not declared.