Privacy Policy

1. The short version

Art Frame TV runs on your television and shows pictures. To do that it does not need to know who you are, so it does not ask and does not find out.

• No account. There is no sign-up, no profile and no user database.
• No analytics, advertising or tracking. The app contains no analytics SDK, no advertising SDK and no crash-reporting service. No advertising identifier is read. No usage data is sent anywhere.
• Your photos stay on your TV. Pictures you pick are downloaded to the device and shown from local storage. They are never uploaded to us, because we operate no service that could receive them.
• Your settings stay on your TV. Frame, mat, brightness and interval choices are stored locally and are not synced.
• Nothing is sold or shared. We do not sell, rent or share personal data with anyone, for any purpose.
• Purchases go through Google, not us. Studio Unlock is billed by Google Play. We never see your payment details — only whether this device is entitled.

2. Who is responsible

Art Frame TV is published by Digital Space Agency UG (haftungsbeschränkt), the data controller for the limited processing described here.

• Email: info@dsa.team
• Postal address: [registered address — to be completed before publication]

Because the app collects no personal data on any scale, we have not appointed a Data Protection Officer; info@dsa.team is the contact point for every question and request covered by this policy.

3. What we do not collect

To be unambiguous, the app does not collect, transmit or store any of the following on any server we control:

• Your name, email address, or any account identifier
• Your photos, or any copy, thumbnail or derivative of them
• Device identifiers, advertising IDs, or an IP-based profile
• Analytics, telemetry, diagnostics, crash reports or usage statistics
• Location data
• Contacts, calendar, microphone or camera data

The app requests no runtime permissions beyond network access. It declares allowBackup="false" and a data extraction rule set, so its stored data is excluded from Android cloud backup, adb backup and device-to-device transfer.

4. Data stored on your TV

Everything in this table lives in the app's private storage on the television. It is readable by the app and not by other apps, it is excluded from backup, and it is deleted when you uninstall.

5. Google Photos

Connecting Google Photos is entirely optional — the app ships with its own gallery and works without ever being signed in.

If you do connect it, the app uses Google's official Photos Picker API. Since March 2025 this is the only route Google permits, and it is deliberately narrow: you choose items in Google's own picker on your phone, and the app is handed those items only. It cannot list, search or browse the rest of your library, and it never receives your albums, faces, places or any other Google Photos metadata beyond what is needed to display the pictures you chose.

The single scope requested is https://www.googleapis.com/auth/photospicker.mediaitems.readonly, which is read-only. Art Frame TV cannot modify or delete anything in your Google Photos library.

You can withdraw this access at any time, without uninstalling the app, from your Google Account's third-party access page. Doing so immediately stops the app fetching anything new. Photos already downloaded to the TV remain on the TV until you clear the app's data or uninstall it.

6. Phone sign-in (the relay)

A television is a poor place to type a password, and Google's device-code flow for limited-input devices does not permit the Photos scope. So the app can hand sign-in over to your phone through a small relay we host at connect.dsa.team, backed by Google Cloud Firestore.

How it works:

1. The TV generates a random 128-bit session identifier and creates a Firestore document under that identifier. The identifier travels only inside the QR code on your screen.
2. You scan the code and sign in with Google in your phone's browser. The page writes the resulting access token into that document.
3. The TV reads the token, opens a Photos picker session, and writes the picker link back for your phone to follow.
4. The TV deletes the document when the hand-off is finished.

What is in that document: a short-lived Google access token and a picker URL. No name, no email address, no photo, and no identifier that we could tie to you.

How long it exists: seconds to minutes in normal use. Security rules cap every hand-off at 15 minutes regardless, make the creation timestamp immutable, forbid listing the collection, and constrain the shape of every write. A document can only be reached by guessing its 128-bit identifier.

The relay page itself sets noindex, sends no referrer, loads no analytics and sets no cookies of its own; Google's sign-in script sets what it needs to sign you in, governed by Google's privacy policy. Firestore and Firebase Hosting, as our processors, write operational logs that include IP addresses — see Firebase's privacy documentation. We do not read those logs to identify anyone.

Once Art Frame TV is published and its Android OAuth client is verified by Google, this relay becomes unnecessary and sign-in will happen on the television itself. This policy will be updated when that happens.

7. Shared album links

As an alternative to signing in, you can paste a Google Photos shared album link (photos.app.goo.gl or photos.google.com). The TV then reads that album's public share page directly from Google and displays the images on it.

Nothing in this route passes through us. Note that a shared album link is a capability link: anyone holding it can see that album, so treat it as you would any other share link. The app accepts only HTTPS Google Photos hostnames, so a link cannot redirect your television at an arbitrary server — including one on your own home network.

8. Pairing over your Wi-Fi

To let you send a link from your phone's browser without typing it on the remote, the app can run a small web server on your local network while the pairing screen is open.

It is deliberately constrained. It:

• requires a six-digit code shown only on the TV screen, rotated every time it starts, and compared in constant time;
• serves only peers with private-range addresses, so it is not reachable from the internet;
• caps request line, header and body sizes, times out sockets, and limits concurrent connections;
• HTML-escapes everything it renders.

It stores nothing and sends nothing to us. A debug-only broadcast hook for setting the photo URL exists for development and is not registered in release builds.

9. Network connections the app makes

Any request your TV makes reveals its IP address to the host it contacts — that is how the internet works, not something specific to this app. For completeness, here is every host Art Frame TV talks to and why. All traffic is HTTPS; cleartext is forbidden by the app's network security configuration.

Wikimedia and Unsplash are not our processors; they are image hosts the TV fetches from, each under its own privacy policy. If you only ever use your own photos, the app will still fetch bundled artwork when that source is selected.

9a. Purchases

Art Frame TV offers one optional in-app purchase, Studio Unlock — a single payment, not a subscription — which enables Google Photos as a source, the full mat and moulding palettes, and the fine-tuning controls.

The transaction is handled entirely by Google Play Billing. Your card details, billing address and Google account never reach us: Play processes the payment and returns only a purchase token confirming that the entitlement exists. The app stores that entitlement locally and checks it with Play, exactly as it checks nothing else about you. Google's handling of the payment is covered by Google's privacy policy.

There is no account, so the purchase is tied to the Google account that made it through Play, not to any profile we hold. Restoring it on another device is Play re-reporting the entitlement, not us looking you up. Refunds are handled by Google Play support under their refund policy.

10. Legal bases for processing

Where the GDPR applies, our legal bases are as follows. The scope is narrow because the processing is narrow.

• Consent (Art. 6(1)(a)). Connecting Google Photos, and the sign-in hand-off that makes it possible. You give this by choosing to sign in and may withdraw it at any time (§5).
• Performance of a contract (Art. 6(1)(b)). Storing your settings and your selected photos on your own device so the app can do what you installed it to do, and honouring a Studio Unlock purchase.
• Legitimate interests (Art. 6(1)(f)). The minimal, short-lived operational logging our hosting provider performs, for the security and availability of the relay.

The relay runs on Google Cloud infrastructure, which may process data outside the EEA under Google's Standard Contractual Clauses. Everything else stays on your television.

11. Your rights

If you are in the EEA or the UK you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time.

In practice these are unusually simple to exercise here, because we hold almost nothing: there is no account to look up and no profile to export. Data on your TV is already in your sole possession, and the §6 hand-off has deleted itself long before any request could reach us. We will still respond to any request sent to info@dsa.team within 30 days, and will tell you plainly if the answer is that we hold nothing about you.

You may also lodge a complaint with your local supervisory authority. If you are in California, note that we do not sell or share personal information as the CCPA/CPRA define those terms, and we do not process it for cross-context behavioural advertising.

12. Deleting your data

• Remove everything from the TV: uninstall the app, or go to Settings → Apps → Art Frame TV → Clear data. This deletes the downloaded photos, the stored token and your settings.
• Revoke Google Photos access: remove Art Frame TV at myaccount.google.com/permissions.
• Ask us: email info@dsa.team. There is no server-side record to delete, and we will confirm that in writing.

13. Security

• HTTPS is enforced for all outbound traffic; cleartext is blocked at the platform level.
• Photo links are accepted only from an allowlist of Google Photos hostnames, so a malicious link cannot redirect the TV at another host.
• Stored data is excluded from cloud backup, adb backup and device transfer.
• The local pairing server is authenticated, rate-constrained and limited to private-range peers (§8).
• Relay documents expire in 15 minutes, cannot be listed, and are addressed by a 128-bit random identifier.
• Release builds ship with debug-only entry points removed.

No system is perfect. If you believe you have found a vulnerability, please write to info@dsa.team and give us a reasonable chance to fix it before disclosing it publicly.

14. Children

Art Frame TV is rated for everyone and is not directed at children specifically. It collects no personal data from anyone, children included, so it does not knowingly collect data from a child under 13 (or under 16 where that is the local threshold). If you believe a child's data has somehow reached us, contact us and we will delete it.

15. Changes to this policy

If this policy changes materially — for instance when phone sign-in is retired in favour of on-TV sign-in (§6) — we will update the date at the top of this page and describe what changed. Because the app has no account and no notification channel, this page is where changes are published; the version and date above tell you whether you are reading the current one.

16. Contact

Questions, data requests and security reports: info@dsa.team.

Art Frame TV is not affiliated with, endorsed by, or sponsored by Google or Samsung. Google TV, Android TV, Google Photos and Google Play are trademarks of Google LLC.