Privacy
policy

Last updated: [DATE] · Applies to: CardSync for Google Photos, version [X.Y]

CardSync runs on your Mac and reads photos from memory cards you insert. This page explains what it does with them, what leaves your computer, and what never does.

The short version

• Your photos and videos go to your Google Photos library and nowhere else.
• The record of what has already been uploaded stays on your Mac.
• Crash reports and anonymous counters are sent to Sentry. Filenames, paths, card names, EXIF, camera serials and your Google account are never included.
• Nothing on a memory card is ever modified or deleted.

What stays on your Mac

CardSync keeps a local record of every file it has successfully uploaded, so it never sends the same photo twice. It lives at ~/Library/Application Support/PhotoUploader/ledger.sqlite and holds file fingerprints and capture metadata — not the photos themselves. You can reveal or clear it from Settings → History.

Your Google refresh token is stored in the macOS keychain, which is protected by your account and by CardSync's code signature. It is the only secret the app stores.

What is sent to Google

The photos and videos you choose to upload, and nothing else. CardSync uses the Google Photos API with the photoslibrary.appendonly scope, which allows it to add items to your library and does not allow it to read anything already in your account.

Signing in uses Google's standard OAuth flow with PKCE. The browser window that opens is Google's own; CardSync never sees your Google password. The redirect is caught on a temporary listener on 127.0.0.1, so nothing is exposed to your network. Google's handling of what you upload is governed by the Google Privacy Policy.

Diagnostics and crash reports

CardSync sends crash reports, usage counters and any feedback you type into Settings → Feedback to Sentry, which we use to find out when the app has broken.

What is sent

• Counts and durations: files scanned, uploaded, already uploaded, skipped, failed; total bytes; how long a scan or import took.
• Whether a card was read as a mounted volume or through ImageCaptureCore.
• Which answer you gave the new-card prompt.
• Crash reports, and anything you type into the feedback box.

What is never sent

• Filenames and file paths.
• Card or volume names.
• EXIF data and camera serial numbers.
• Your Google account details.
• Your IP address — Sentry's sendDefaultPii is switched off.

As a second line of defence, anything path-shaped is stripped from event and breadcrumb text before it is sent. [CONFIRM: whether diagnostics can be turned off in Settings, and add the instructions here if so.]

Your photos

CardSync opens files on a card to read them and copies them to Google Photos. It never writes to, renames or deletes anything on a card. Photos are not sent to BitesizeBureau, are not stored on any server we run, and are not used to train anything.

Permissions the app asks for

• Files and Folders → Removable Volumes, so it can read memory cards.
• Notifications, if you leave notifications switched on.
• Keychain access, to read the stored Google refresh token.

Deleting your data

• Upload history: Settings → History → clear. Note that this makes every card look new again.
• Google access: sign out in Settings, and revoke the app at myaccount.google.com/permissions.
• Photos already uploaded: delete them in Google Photos. CardSync cannot remove them for you — its access is append-only.
• Diagnostics: email us and we'll delete what we hold. [CONFIRM retention period with Sentry settings.]

Children

[TO BE COMPLETED — state the minimum age if the store listing requires one.]

Changes to this policy

If this policy changes in a way that matters, the date at the top changes and the previous version stays in the site's git history.

Contact

Questions about any of this: hello@bitesizebureau.com. [CONFIRM: postal address / data controller name, if required for the app store listing.]

← Back to CardSync