The short version
- Brumo Cleaner scans your phone on the device. The content of your photos, videos, contacts, calendar events and files is never uploaded to us.
- The app uses service providers for subscriptions, app analytics, crash reports and install attribution. They receive technical and usage data, not your files.
- We do not sell personal data. The app shows no ads.
- You can withdraw any permission in Android settings at any time.
1. Who we are
Brumo Cleaner: Free up Space (the “App”) and the website brumo-cleaner.com are provided by CONSILIORA NEXUS CONSULTING LTD (“we”, “us”), a company registered in the Republic of Cyprus under number HE468919, MITSIS 3, Floor 3, 1-7 Makariou III, Nicosia 1065, Cyprus. We are the controller of the personal data described in this policy under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Cyprus Law 125(I)/2018.
Contact: consiliora.nexus.ltd [at] gmail.com
2. Data that stays on your phone
Cleaning a phone means looking at what is on it. The App does this work on your device, and only after you grant the related Android permission. The App asks for each permission only when a feature needs it, and you can withdraw it in Android settings at any time.
| Permission | What the App does with it |
|---|---|
| Photos and videos | Finds similar and duplicate photos and videos, screenshots and large videos; lets you sort photos in Swipe, compress videos and move items to Secret Space. To make the next scan faster, it keeps a local cache of item identifiers, sizes, dates and image fingerprints (perceptual hashes) in its private storage. |
| All files access | Lets File Manager find large files so you can review and delete them. Requested only when you open File Manager. |
| Contacts | Finds duplicate and incomplete contacts and lets you merge, delete or back them up, or move contacts to Secret Space. Backups are stored on your phone, in the App’s storage. |
| Calendar | Finds duplicate events and past events and deletes the ones you choose. |
| Usage access | Lets App Manager show how much space each app takes and when you last used it. Requested only from App Manager. |
| Notifications | Lets the App notify you about its own features, such as a finished scan or backup, if you allow notifications. |
| Fingerprint or face unlock | Lets you unlock Secret Space. Recognition is done by Android; the App never receives your biometric data. |
Nothing is deleted without your confirmation. Photos and videos are removed through Android’s own confirmation dialog; on Android 11 and later they go to Recently deleted and are removed for good after 30 days, on earlier versions deletion is immediate.
Secret Space stores the items you move there in the App’s private storage, encrypted on your phone (AES-GCM) with a key protected by the Android Keystore. Your PIN is stored only as a salted hash. We have no copy of the key and cannot open or recover the vault.
3. Data collected through the App
To run subscriptions, understand how the App is used and fix errors, the App uses the service providers listed below. They receive technical and usage data — never the content of your photos, videos, contacts, calendar events or files.
- Subscriptions — Google Play Billing and Adapty. Google processes payments; we never receive your card details. Adapty helps us manage subscriptions and receives the product you bought, subscription and trial status, purchase dates, transaction identifiers, an identifier generated for your installation, and device, app and store-country information.
- App analytics — Google Firebase Analytics. Usage events such as opening the App, finishing onboarding, granting or denying a permission, the result of a scan or cleanup (category, number of items and total size), paywall views, purchases and opened tools; together with an app instance identifier, device and app information and an approximate location (country or region) derived from your IP address.
- Crash reports — Google Firebase Crashlytics. Technical details of crashes: stack traces, device model, operating system version, app state at the time of the crash and an installation identifier.
- Remote configuration — Google Firebase Remote Config. An installation identifier used to deliver feature settings to the App.
- Install attribution — AppsFlyer. Your device’s advertising ID, the install referrer, IP address, device and app information, and install and subscription events. This tells us which advertising campaign led to an install or a subscription. Trial and purchase events reach AppsFlyer from Adapty, server to server.
- Ratings and feedback. If you rate the App, Google Play’s in-app review handles the rating under Google’s terms. If you send us feedback or write to us, we receive your message and your email address.
4. The website
brumo-cleaner.com is an information site. It sets no cookies and uses no analytics, advertising or tracking code. Our web server records standard access logs — IP address, date and time, the page requested, the referring page and the browser’s user-agent — and keeps them for 14 days. The site is hosted by Hetzner Online GmbH in Germany; Cloudflare, Inc. provides DNS and content delivery and may set a strictly necessary security cookie to filter automated traffic.
5. Why we use data and on what legal basis
| Purpose | Legal basis (Article 6(1) GDPR) |
|---|---|
| Providing the App and its features | Performance of a contract (b) |
| Selling and managing subscriptions | Performance of a contract (b) |
| Fixing crashes and errors | Legitimate interests (f) — a working, safe App |
| Understanding how the App is used | Legitimate interests (f), or consent (a) where the law requires it |
| Measuring which campaigns lead to installs | Consent (a) where required; otherwise legitimate interests (f) |
| Answering your messages | Performance of a contract (b) or legitimate interests (f) |
| Accounting and legal duties | Legal obligation (c) |
You may object to processing based on legitimate interests and withdraw consent at any time; this does not affect processing that took place before. We do not make decisions about you based solely on automated processing.
6. Who receives data
We do not sell personal data. We share it only with the service providers named above (Google, Adapty, AppsFlyer, Hetzner, Cloudflare), who process it on our behalf or as independent controllers under their own terms; with professional advisers bound by confidentiality; with authorities where the law requires it; and with a successor if our business or the App is transferred, under this policy.
7. International transfers
Some providers process data outside the European Economic Area, for example in the United States. Such transfers rely on an adequacy decision of the European Commission (such as the EU–U.S. Data Privacy Framework for certified companies) or on the Commission’s Standard Contractual Clauses.
8. How long data is kept
- Data on your phone (scan cache, Secret Space, contact backups, settings) stays until you delete it or uninstall the App. Uninstalling or clearing the App’s data permanently deletes Secret Space and contact backups.
- Analytics events are kept for up to 14 months; crash reports for up to 90 days.
- Subscription records are kept while your subscription is active and afterwards for as long as tax and accounting law requires.
- Attribution data is kept only as long as needed to measure campaigns and prevent fraud.
- Website logs are deleted after 14 days; emails are kept up to 24 months after your request is resolved.
9. Your choices and rights
- Withdraw any permission in Android settings — the related feature stops working until you grant it again.
- Reset or delete your advertising ID in Android settings (Google › Ads, or Privacy › Ads, depending on the device).
- Delete the data on your phone by uninstalling the App.
Under the GDPR you also have the right to access, correct and erase your personal data, to restrict or object to processing, to data portability and to withdraw consent. Write to consiliora.nexus.ltd [at] gmail.com. The App has no accounts, so to find data held by our providers we may ask for details such as your Google Play order number. We reply within one month.
You can lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or with the supervisory authority where you live.
10. Children
The App is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
11. Security
We keep processing on the device wherever possible, encrypt Secret Space, use encrypted connections (HTTPS) and limit access to personal data to people who need it. No method of storage or transmission is completely secure, but we work to protect your data and will notify you and the authorities where the law requires.
12. Changes to this policy
We may update this policy when the App changes or the law requires. The new version will be published on this page with a new effective date; significant changes will also be announced in the App.
13. Contact
CONSILIORA NEXUS CONSULTING LTDMITSIS 3, Floor 3, 1-7 Makariou III, Nicosia 1065, Cyprus
Email: consiliora.nexus.ltd [at] gmail.com