Privacy policy

Last updated: October 7, 2026.

Brisa Gallery is operated by J.R.SOSA & CO. LLC. Brisa works without a Brisa account. This policy covers the app's local media features and the separate data handled by advertising and purchase providers.

Privacy: privacy@jrsosa.co. Support: contact@jrsosa.co or Brisa support. Public policy: jrsosa.co/brisa/privacy.

Photos, videos, and organization

Brisa reads only media permitted by your device, including filenames, dates, thumbnails, and available saved photo details. Selected-photo access is supported where the operating system offers it. You can change your selection or revoke access in device settings. Cloud-backed originals may need to download through your device's photo service before opening, editing, sharing, or importing them.

Brisa does not upload photos or videos to J.R.SOSA & CO. LLC, AdMob, or RevenueCat. Sharing opens the device share sheet; your chosen destination handles the copy under its own policies. Editing saves a new JPEG copy after you choose to save, while retaining the original.

Favorites, local albums, trash selections, preferences, and discovery results stay in app storage. Albums organize references without moving originals. Brisa trash hides photos locally and allows restoration; it does not delete system originals. A separate confirmed action requests system-library deletion. On iOS, recover deleted originals in Photos' Recently Deleted collection for up to 30 days; Brisa cannot browse or restore it. iCloud Photos can synchronize deletion across devices. Android's separate permanent-delete action uses system confirmation.

On Android 11 or newer, an optional action within Brisa trash requests moving selected originals to device trash and restoring them, with Android confirmation. Brisa retains identifiers, media types, and minimal display details locally across restarts. Canceling keeps the previous state. Android controls expiration. Brisa tracks selections it moved; it does not list every app's deleted media.

Optional People and Places

People processes thumbnails on the device to find photos containing faces. It does not recognize or name individuals, store identity embeddings, or upload face images or templates. Matching photo identifiers are local and can be cleared in Settings.

Android uses bundled Google ML Kit. Images and results remain local, but Google can receive installation identifiers, device/app information, feature-use and performance diagnostics. These diagnostics are separate from advertising consent and ad removal. See ML Kit privacy information. iOS uses Apple's built-in Vision framework.

Places reads locations already saved with accessible photos and stores rounded coordinates, photo identifiers, and capture dates locally. Bundled GeoNames data supplies approximate nearby-city labels and an offline world overview. Visits group consecutive same-place photos with gaps of up to three days; these are metadata estimates, not proof of travel. No photo coordinates are sent to an online map or geocoding service.

Brisa does not request your current location. Android's optional saved-photo-location permission reads existing metadata. Photos without coordinates or with restricted metadata may not appear. You can clear Places results. The geographic attribution link opens GeoNames without including your photo coordinates.

Encrypted vault

Importing creates encrypted copies in private app storage. Originals remain in the system library, including any system photo-cloud service. The vault does not remove originals or provide backup.

Media, thumbnails, and the vault manifest use authenticated AES-256-GCM encryption. The key is held through operating-system secure storage and is not synchronized by Brisa. Supported biometrics or device passcode authentication unlocks the vault; Brisa receives neither biometric measurements nor your passcode. It locks when the app leaves the foreground. Temporary decrypted session files are removed on lock and the next app launch.

Uninstalling, losing the key, or moving encrypted files can make copies unrecoverable. Android app backup is disabled in Brisa's configuration. iOS system backup behavior can apply to app files; Brisa offers no vault recovery or synchronized keys. The vault does not prevent screenshots, secure a compromised device, or revoke exported copies.

Advertising and privacy choices

The free app may show labeled Google AdMob native ads in the photo feed. Brisa requests non-personalized ads after checking purchase status and applicable Google consent choices. The viewer, editor, vault, Home, and permission screens have no ad placements. An optional one-time purchase removes Brisa's ad placements.

Google's advertising and consent SDKs can handle IP-derived approximate location, app/device identifiers, impressions and interactions, and crash/performance diagnostics for advertising, analytics, service operation, and fraud prevention. Brisa removes Android's advertising-ID permission and disables Google's publisher first-party ID. On iOS, Brisa initializes the advertising SDK and requests ads only after you allow Apple's tracking permission and applicable Google consent permits ads. Advertising providers may combine authorized app/device information with information from other apps or websites for advertising measurement. Settings offers this optional Apple permission; Brisa never requests it automatically at launch. Declining, restricting, or leaving it undecided keeps ads off, without requiring a purchase or restricting gallery tools. You can change the permission in device settings. These choices do not mean SDKs collect no data. Brisa does not pass photo contents, saved photo locations, search queries, vault files, or installed-app lists to advertisers. Settings shows Google's privacy-choice entry when required. See Google's privacy policy.

Purchases

Apple or Google processes payment. RevenueCat receives store purchase records and an anonymous app-user identifier to validate ownership, restore the ad-free entitlement, prevent purchase fraud, and provide purchase reporting. Brisa does not submit contact attributes or advertising identifiers to RevenueCat and receives no payment-card details. See RevenueCat's privacy policy.

Ad removal does not remove store records, purchase validation, or Android ML Kit diagnostics. Purchases and refunds follow store terms. Provider records follow their retention policies and applicable obligations.

Optional Android Home

Home reads locally launchable app labels and icons to open apps and organize favorites and named folders. Membership and order stay on the device. Brisa does not transmit this inventory to the publisher or monetization providers. You decide whether Brisa becomes the default Home app and can change it in Android settings.

Adding widgets uses Android's binding and provider configuration screens. Brisa saves widget identifiers and layout preferences locally. Each widget belongs to another app and follows that provider's permissions and policy. Removing it removes its Brisa binding.

Retention, deletion, and contact

Local records remain while the app's data remains on your device unless you remove or clear them. You can revoke media access, remove albums and favorites, clear discovery, delete vault copies, and uninstall. Revoking permission alone does not erase all previously saved organization records. Uninstalling does not delete system originals, exported copies, system backups, or store/provider records.

For privacy or provider-data requests, contact privacy@jrsosa.co. We may need minimal information to locate an anonymous purchase record and will explain applicable retention or identification limits. Do not send private photos, vault keys, passcodes, or payment-card numbers. Requests do not automatically delete store purchases or issue refunds.

This policy may change with features or providers; the public page shows its revision date. Website visits and information deliberately sent to support are separate from local gallery processing. Your email service and the publisher handle those communications to answer your request.