Privacy Policy
Last updated: 11 August 2026
Kitate is a photo organiser that groups your pictures by the people who appear in them. This policy explains what the app does with your data.
The short version: Kitate runs entirely on your device. We have no servers, no user accounts, and we never receive your photos or your facial data. We cannot see them, even if we wanted to.
Who is responsible
Kitate is developed by TheBigShot.
For any privacy enquiry: thebigshot.labs@gmail.com
What data the app handles
Everything described below is stored only in your device's private storage, in the area reserved for the app, which no other app can access.
Photos you choose
When you create an album or add a reference photo to a profile, you pick the specific images through the Android system photo picker. Kitate has no permission to access your gallery: it only receives the photos you explicitly select, one by one.
For each selected photo, the app stores a copy in its private storage. Your original photos are never modified, moved or deleted.
Facial data
To group photos by person, Kitate detects the faces that appear in the images and generates, from each one, a numerical representation that allows them to be compared with each other. This representation is biometric data.
About this processing:
- It happens entirely on your device. The detection and recognition models are bundled inside the app; nothing is downloaded and no external service is contacted.
- It is never sent anywhere. The app has no internet access (see below).
- It is stored encrypted. Both the facial representations and the profiles' reference photos are stored encrypted with AES-256, using a key generated on your own device and held in the Android keystore, hardware-backed where the device supports it. That key never leaves the device and we do not know it.
- The legal basis for this processing is your consent, which you give by selecting photos and creating profiles, and which you can withdraw at any time by deleting the profiles or uninstalling the app.
App preferences
Kitate stores settings unrelated to your identity, such as the light or dark theme. They contain no personal data.
What the app does NOT do
- It does not access the internet. The app declares no network permission. You can check this yourself: in the Android settings, under the app's information, you will see that Kitate requests no permissions at all.
- It has no user accounts and requires no sign-up.
- It collects no usage statistics, no analytics and no crash reports.
- It shows no advertising.
- It shares no data with third parties. There is nobody to share it with: the data never leaves your device.
- It does not include your data in backups. Android's automatic backups and device-to-device transfer are disabled for this app, so your photos and your facial data are neither uploaded to the cloud nor copied to a new phone.
When data leaves the device
In one case only, and always because you ask for it: when you use the share feature. When you share photos, Android shows its own menu and the images are sent to the app you choose (messaging, email, etc.). From that moment on, those photos are governed by the privacy policy of the destination app.
Profile reference photos and facial data are never shared this way.
How long data is kept and how it is deleted
Data is kept for as long as you keep it in the app.
- Deleting a profile removes its reference photos, its facial data and its matches from the device.
- Deleting an album removes the copies of its photos from the device.
- Uninstalling the app removes all of the above, including the encryption key.
In all three cases, your original gallery photos remain untouched.
Your rights
Data protection law grants you the rights of access, rectification, erasure, restriction, objection and portability.
In Kitate's case, these rights are exercised directly from the app, because you are the one holding the data: you can view it, change it and delete it at any time without intermediaries. We cannot access it, hand it over to you or delete it on your behalf, because it is not in our possession.
If you have questions about this processing, write to us at the address above. You may also lodge a complaint with your local data protection authority; the developer is based in Spain, where the competent authority is the Agencia Española de Protección de Datos (www.aepd.es).
Children
Kitate is not directed at children under 13 and does not knowingly collect their data.
Changes to this policy
If the app changes in a way that affects this policy, we will publish the updated version here with a new date. Significant changes will also be communicated inside the app itself.