Fujirama
Sign up

Privacy Policy

Last updated: June 2026

Privacy Policy

This Privacy Policy explains how personal data is processed when you use the Fujirama app, the website at https://get.fujirama.app and the underlying backend services (together, the "Service"). We process personal data solely on the basis of applicable law (GDPR, German BDSG).

1. Controller

The controller within the meaning of Art. 4(7) GDPR is the provider of the Fujirama app. The full contact details (name and address) are available in the current version at https://get.fujirama.app/privacy.

Contact for privacy requests: privacy@fujirama.app. We are not legally required to appoint a Data Protection Officer.

2. Scope

This Policy applies across platforms to:

  • the mobile app (connecting to your Fujifilm camera via Bluetooth/Wi-Fi, downloading photos/videos, managing and sharing recipes);
  • the website https://get.fujirama.app (registration, sign-in, managing and viewing recipes);
  • the backend/server services that store accounts, recipes and content.

3. Data we process

  • Account data: email address, username, password (stored only as a hash).
  • Profile data: optional profile picture, biography, Instagram handle.
  • Content data: recipes, recipe images, notes, collections, comments (website).
  • Interaction data: likes, follows, remixes – only for logged-in accounts.
  • Subscription data: purchase/subscription status (Premium/trial) via the app store.
  • Connection/device metadata: camera model, technical connection and (for feedback) device information.
  • Server log data: IP address, timestamp – to secure the Service.
  • Diagnostics data: crash/error reports (release builds only).
  • Waitlist data: email address and camera model (if you sign up).

4. Purposes and legal bases

We process data in particular to:

  • provide and operate the app, website and account features (Art. 6(1)(b) GDPR);
  • manage your account and authenticate you (lit. b);
  • store recipes and – only at your explicit request – publish them in the public Discover feed (lit. a/b);
  • process in-app purchases/subscriptions (lit. b);
  • ensure security, stability and abuse prevention (lit. f);
  • communicate with you, e.g. waitlist/support (lit. a/b).

5. Registration & sign-in

To create an account we process your email address, a username and your password. The password is never stored in plain text, only as a bcrypt hash (Art. 6(1)(b) GDPR).

Alternatively you can sign in with Sign in with Apple or Google Sign-In. We receive an authentication token, a pseudonymous provider ID and – depending on your consent – an email address, used solely for sign-in, not for tracking.

6. Profile, recipes & interactions

Profile details (picture, bio, Instagram handle) are voluntary and editable. Recipes are private by default; only when you explicitly publish them do they – including your username and any images – become visible in the public Discover feed.

When logged in you can like recipes, follow others, remix recipes and – on the website – comment. Such interactions are linked to your account and may be visible to others.

7. In-app purchases & subscriptions

Premium features and the trial period are handled through the purchase systems of the Apple App Store or Google Play and a subscription service. Payment is processed exclusively by the app store provider – we receive no full payment details (Art. 6(1)(b) GDPR).

8. Camera connection (Bluetooth/Wi-Fi)

The app connects directly to your camera via Bluetooth (BLE) and Wi-Fi. This communication takes place locally between device and camera; any data involved (e.g. the camera Wi-Fi SSID) is not transmitted to us.

Location permission: On Android, scanning for Bluetooth devices may require a location permission for system reasons. We use it solely to find the camera and do not collect your location.

9. Photos, local storage

Photos/videos downloaded from the camera are stored locally on your device or in your photo library and are not automatically sent to our servers. An upload happens only if you actively add an image to a recipe or publish it.

The following also remain locally on the device: sign-in tokens in protected storage (Keychain/Keystore), recipes in a local database, and app settings.

10. Server logs & diagnostics

When accessing our backend services, technical access data (IP address, timestamp, endpoint) is processed in server logs – for operational security and abuse prevention (Art. 6(1)(f) GDPR), generally 7 days.

In published versions, crash reporting may capture technical diagnostics (error message, stack trace, device/app data) on crashes (lit. f). No behavioral tracking takes place.

11. Waitlist, support & notifications

If you join the waitlist, we process your email address and camera model based on your consent (Art. 6(1)(a) GDPR; withdrawable at any time). For support/feedback we process your input and possibly technical device/app information.

Push notifications via external services are currently not active. We will inform you separately if enabled in the future.

12. Cookies & tracking

We use no tracking, advertising or analytics cookies. For sign-in we use strictly necessary mechanisms: in the app, secure JSON Web Tokens (JWT) in protected device storage; on the website, strictly necessary cookies or comparable storage (§ 25(2) TDDDG).

13. Recipients & third countries

We use the following processors to provide the Service:

  • Hetzner Online GmbH – hosting/database/storage (Germany, EU);
  • Apple Inc. – Sign in with Apple, App Store purchases (USA/EU);
  • Google LLC / Google Ireland – Google Sign-In, Play purchases (USA/EU);
  • Subscription service (e.g. RevenueCat, Inc.) – subscription management (USA);
  • Crash reporting (e.g. Sentry) – error diagnostics (USA/EU);
  • Email provider (e.g. Resend) – waitlist/system emails (USA/EU).

For transfers to third countries (in particular the USA) we ensure an adequate level of protection via EU Standard Contractual Clauses (Art. 46 GDPR) and/or the EU-US Data Privacy Framework.

14. Retention & deletion

  • account, recipe and profile data: until account deletion;
  • server logs: generally 7 days;
  • authentication tokens: up to 90 days or until logout/revocation;
  • waitlist data: until the Service launches or until you withdraw consent.

Upon your request we delete your account and associated data within 30 days (Art. 17 GDPR), unless statutory retention obligations apply.

15. Your rights

  • Access (Art. 15 GDPR) to your stored data;
  • Rectification (Art. 16 GDPR) – possible yourself in your profile;
  • Erasure (Art. 17 GDPR) of your account and data;
  • Restriction (Art. 18 GDPR) of processing;
  • Data portability (Art. 20 GDPR) – export of your data;
  • Objection (Art. 21 GDPR) to processing based on lit. f;
  • Withdrawal of consent (Art. 7(3) GDPR) for the future.

You can exercise access, export and deletion – as far as technically possible – in the app, or by email to privacy@fujirama.app. You also have the right to lodge a complaint with a data protection authority (Art. 77 GDPR).

16. Data security

We use TLS/HTTPS for all server connections, store passwords only as a bcrypt hash, keep sign-in tokens in protected device storage and run our servers in the EU (Germany). The local app ↔ camera connection may be unencrypted for technical reasons but involves no transmission to our servers.

17. Minors & app stores

The Service is intended for persons aged 16 and over; we do not knowingly collect data from children under 16.

The app uses no cross-app tracking (no ATT prompt). Account deletion is available directly in the app. No automated decision-making within the meaning of Art. 22 GDPR takes place.

18. Changes

We may update this Policy. The current version is always available in the app under Profile → Privacy and at https://get.fujirama.app/privacy.