Privacy Policy / Datenschutzerklärung

English Version

Privacy Policy for MediaStashBox

Last Updated: November 2, 2026

1. Summary

MediaStashBox ("App") is a local-first app for cataloguing your personal media collection (books, manga and comics, films and TV shows, and music). In short:

• Your library stays on your device. We do not operate user accounts, cloud storage or a user database, and we have no access to your library.
• No tracking. The App contains no analytics, advertising, crash-reporting or tracking tools, and we do not sell or share your data.
• Internet is used only for lookups and the images they return. When you look up a book by ISBN or check a source link, the ISBN or the source's catalog ID is sent to metadata services so they can return titles, descriptions and cover images; the App then loads these cover images and author photos from the services (see Section 5). The optional AI model for cover scanning is downloaded only if you choose to (see Section 6).
• Scanning happens on your device. Barcode and cover recognition, including the optional AI model, run locally; camera images are never uploaded.

2. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) and other applicable data protection laws is:

BechtStudio
Maxim Becht
Friedenstraße 59
71636 Ludwigsburg
Germany
Email: support@bechtstudio.com
Phone: +49 179 1691479

We are not required to appoint a data protection officer. For all privacy matters, please contact us at the address above.

3. Scope

This Privacy Policy applies to the MediaStashBox mobile app for iOS and Android. It does not apply to the Apple App Store or Google Play Store themselves, or to third-party websites you open from the App; their own privacy policies apply there.

4. Data Stored Only on Your Device

The App stores the following information locally on your device, in the App's private storage:

• Library data: media entries and their details (e.g. title, ISBN or barcode, description, cover image, tracklist, genres, tags, series, storage locations, reading progress, favorites)
• Your own entries: ratings, notes and any other text you enter
• Lending information: names of people or organizations you lend items to or borrow items from, and due dates
• People records: names, biographical details and photos of authors, cast or crew that you add or that are loaded with a media entry
• Images: photos you take or select from your photo library, and cover images downloaded for your entries
• Recent searches and settings: your recent in-app search terms, theme, language and similar preferences, and when the App last asked you for a rating
• Previous library: when you restore a backup or reset the App, your library until then is kept on the device so you can return to it
• Reminder schedule: the dates of lending reminders you have set

We do not receive this data. It is not transmitted to us or to any third party, except for the lookup data described in Section 5 and the backups described in Section 9. Because we cannot access this data, we also cannot view, correct, restore or delete it for you; you control it directly in the App (see Section 13).

Information about other people: If you record the names of people you lend items to, please only store information you are entitled to keep for this personal purpose. This data remains on your device and is not shared by us.

5. Online Metadata Lookups

To fill in details and cover images, the App connects to the following services only in these cases:

• when you use a lookup function (e.g. scanning a barcode, entering an ISBN, checking a source link in the edit form);
• when cover images or author photos from these services are displayed, and when the App saves the cover images of your entries on your device. Covers that are not saved yet are downloaded in the background when the App starts;
• when you open a book that has no saved source link: the App checks whether Open Library has a page for its ISBN, so it can include that page when you share the book;
• when you download the optional AI model.

Technical data: As with any internet connection, the receiving service necessarily receives your device's IP address, the time of the request and basic technical information (e.g. operating system and app network library). We do not send any account name, device identifier, advertising ID, your library contents, photos or location.

Our book lookup: Requests to our book lookup are processed by Cloudflare on our behalf under a data processing agreement (Art. 28 GDPR). Our lookup forwards only the ISBN (or, when you check a Google Books source, its Google Books ID) to the underlying metadata sources (Google Books, Open Library, Apple iTunes), not your IP address. Your IP address is used only briefly (about one minute) to limit the number of requests and protect the service against abuse. It is not logged, not linked to your lookups and not used to build any usage profile. Lookup results are cached only by ISBN or catalog ID. Cloudflare may process connection data briefly for delivery and security purposes (e.g. protection against attacks) in accordance with its privacy policy.

Direct requests: Google, Internet Archive, Apple and Hugging Face receive requests directly from your device (fallback lookups, cover images, author photos, source and share link checks, model download) and process the data as independent controllers under their own privacy policies. Hugging Face delivers the model files through a content delivery network (Amazon CloudFront).

Music: There is no online lookup for music. A barcode you scan from a record, CD or cassette is only stored with your entry on your device and is not sent to any service.

Legal basis: Art. 6(1)(b) GDPR (providing the function you requested) and Art. 6(1)(f) GDPR (our legitimate interest in providing reliable metadata and protecting our service). Access to your device for these purposes is strictly necessary to provide the service you requested (§ 25(2) No. 2 German TDDDG).

If you do not want any data sent: you can add and edit entries manually without using the lookup functions.

6. Camera, Photos and On-Device Recognition

• Barcode scanning and cover recognition use your camera. The analysis (barcode reading, text recognition, cropping) is performed entirely on your device using the operating system's built-in frameworks (Apple Vision on iOS, Google ML Kit on-device models on Android) and, if you downloaded it, the optional AI model. Camera images and recognized text are not uploaded to us or to third parties. Only a recognized ISBN may be used for a lookup as described in Section 5.
• Optional AI model: To read covers more reliably, you can download a small AI vision model (LFM2.5-VL-450M by Liquid AI, Inc., about 300 MB) when you first open the cover scanner or in the settings. It is downloaded once from Hugging Face (see Section 5), stored in the App's private storage and runs entirely on your device. Neither Liquid AI nor Hugging Face receives your images or results. You can delete the model in the settings at any time.
• Photos: When you take a photo or select one from your photo library (e.g. a cover or a person's photo), the App saves a compressed copy in its private storage. The App does not save images to your photo library and does not read any other photos.
• Temporary scan images are stored in the App's cache and may be removed by the operating system at any time.

7. Notifications

If you set reminders (e.g. for due dates of lent items) and allow notifications, the App schedules local notifications on your device. No push notification service or server is involved, and no data is transmitted for this purpose. Reminders show the title of the item and, if recorded, the name of the person involved. Depending on your device settings, they may be visible on your lock screen or on connected devices (e.g. a smartwatch). You can withdraw notification permission at any time in your device settings.

8. Permissions

The App only requests permissions when you use the related feature. You can grant or revoke them at any time in your device settings; the rest of the App will continue to work.

The App does not access your location, contacts, microphone or other device data.

9. Backups and Export

• Manual export: You can export your library as a backup file (.msb). The file is created on your device and saved or shared only where you choose (e.g. a folder, cloud drive or messaging app). The backup file is not encrypted; please store and share it carefully. We do not receive it.
• Import: You can restore a backup file you select. It is processed locally.
• System backups: Depending on your device settings, the operating system may include App data in device backups (e.g. iCloud Backup on iOS or Android Backup with Google). These backups are provided by Apple or Google under their terms and privacy policies, and we have no access to them. You can manage them in your device settings.

10. What We Do Not Do

• No user accounts, registration or login
• No analytics, advertising, crash reporting or tracking SDKs
• No tracking across apps or websites of other companies, and no use of advertising identifiers
• No sale or "sharing" of personal data (including within the meaning of the California Consumer Privacy Act)
• No profiling or automated decision-making within the meaning of Art. 22 GDPR

If we introduce features that change this (e.g. optional cloud sync), we will update this Privacy Policy beforehand and, where required, ask for your consent.

11. App Stores

The App is downloaded through the Apple App Store or Google Play Store. The respective store operator processes data related to your download, purchases and account (e.g. Apple ID or Google account) as an independent controller. We have no influence on this processing. If you have enabled the sharing of diagnostics with app developers in your device settings, Apple or Google may provide us with aggregated, non-identifying statistics (e.g. installs, crash rates). When the App asks for a rating, it uses the store's own rating dialog (Google Play In-App Review, Apple StoreKit); whether the dialog appears, and any rating you submit, are handled by the store operator. Please see the privacy policies of Apple and Google.

12. Contacting Us

If you contact us by email (e.g. via the in-app feedback button), we process your email address, name (if provided) and the content of your message to handle your request. Legal basis: Art. 6(1)(b) GDPR (where your request relates to the App) or Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries). We delete this data once your request has been fully handled, unless statutory retention obligations apply. Please do not send us backup files or sensitive information unless necessary.

13. Retention and Deletion

• Data on your device is kept until you delete it. You can delete individual entries at any time, reset all App data in Settings → Reset, or uninstall the App, which removes all App data from the device. Copies in exported backup files or system backups must be deleted separately.
• Lookup data (Section 5) is not stored by us. The third-party services retain data according to their own policies.
• Support emails are handled as described in Section 12.

14. International Data Transfers

Some of the services in Section 5 are operated by companies in the United States. For Cloudflare, Google and Apple, transfers are based on the EU–U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR) and/or Standard Contractual Clauses (Art. 46 GDPR). Internet Archive and Hugging Face are not certified under the Data Privacy Framework. Hugging Face has its main EU establishment in France (Hugging Face SAS), but the model files may be delivered from servers in the United States or other countries. For these two services, the transfer is carried out because it is necessary to provide the lookup or download you requested (Art. 49(1)(b) GDPR). Data protection in such countries may be lower than in the EU. You can avoid these transfers by entering data manually and by not downloading the AI model.

15. Security

App data is stored in the App's private storage area, which the operating system protects from other apps and, if you use a device passcode, encrypts. All network connections of the App use encrypted HTTPS. Please protect your device with a passcode and keep the operating system up to date. No method of storage or transmission is completely secure.

16. Your Rights

Regardless of where you live, you have the right to:

• Access the personal data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
• Object to processing based on legitimate interests (Art. 6(1)(f) GDPR) on grounds relating to your particular situation (Art. 21 GDPR)

Please note that we generally hold no personal data about you, because your library data never reaches us. You can view, export, correct and delete it yourself in the App. Residents of the United Kingdom, Switzerland, California and other U.S. states, Brazil, Canada and other jurisdictions have comparable rights under their local laws; you can exercise them in the same way. We will not discriminate against you for exercising your rights.

To exercise your rights, contact us at support@bechtstudio.com. We will respond within one month (Art. 12(3) GDPR), or within the period required by your local law.

Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
https://www.baden-wuerttemberg.datenschutz.de

A list of all EU/EEA supervisory authorities is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

17. Children

The App is intended for a general audience and is not directed specifically at children. We do not knowingly collect personal data from anyone, including children under 13 (or the minimum age under your local law). Lookups do not transmit personal information beyond the technical data described in Section 5. If you believe a child has sent us personal data (e.g. by email), please contact us and we will delete it.

18. Changes to This Privacy Policy

We may update this Privacy Policy when the App's functions or legal requirements change. The current version is always available on our website and in the App, with the date of the last update shown at the top. If a change requires your consent, we will ask for it in the App before the change takes effect.

19. Contact

BechtStudio
Maxim Becht
Friedenstraße 59
71636 Ludwigsburg
Germany
Email: support@bechtstudio.com