Privacy Policy for Lesiya

Effective date: September 3, 2026

Lesiya is a gallery for user-managed sources such as Immich, SMB and WebDAV. Lesiya does not operate a photo cloud, advertising platform or analytics backend.

Data processed on your device

The app processes connection details you enter, media and file metadata, previews, offline files, search-index data, favorites, local notes, backup history and local crash diagnostics. Credentials are stored locally using Android Keystore protection. Runtime credentials are not written into media, album, trash or startup-cache payloads.

To keep device-specific backup folders stable, Lesiya locally derives a short SHA-256 hash from Android's app- and signing-scoped device identifier. The raw identifier is neither stored nor sent to Lesiya, advertising, analytics or crash services. The hash only appears as part of the folder name on storage connected by the user.

Network connections

The app connects to sources you configure. HTTPS is recommended. Cleartext HTTP is limited technically to private local-network, link-local and loopback addresses. Immich search may send a query to your own Immich server.

For SMB, WebDAV and local device media, Lesiya may analyze thumbnails on the device. Image labels, visible text and detected face counts are stored only in the local search index; faces are not linked to identities. By default, analysis uses thumbnails that are already available. The user may explicitly allow missing gallery thumbnails to be fetched over Wi-Fi; originals are never downloaded solely for analysis. Images and analysis results are not sent to Lesiya. Immich intelligent search remains on the Immich server configured by the user.

Lesiya uses Google ML Kit for this optional on-device analysis. Images, videos, recognized text and analysis results are processed on the device and, according to Google, are not sent to Google servers. ML Kit may nevertheless send encrypted technical device and app information, installation identifiers, performance metrics, API usage events and error codes to Google to diagnose, maintain and analyze use of the SDK. Intelligent search is optional and can be disabled in settings.

If you explicitly enable online maps, Lesiya loads the map style and map tiles from MapTiler. MapTiler therefore receives your IP address and the requested map areas. Requested map areas may allow inferences about the approximate places represented by media on the map. Photos, videos, credentials and EXIF files are not sent to MapTiler. No online map is loaded without your consent, and you can disable that consent again in Settings.

Backup and offline storage

If you enable backup, Lesiya transfers selected phone media to your selected Immich, SMB or WebDAV destination. Backup status and verification data remain on the device. Local originals are only eligible for optional storage optimization after a verified upload and Android system approval. Offline originals are downloaded only through an explicit offline action or rule.

Sharing and diagnostics

Lesiya does not sell personal data. Android sharing sends only selected files to the app you choose. Crash and ANR diagnostics remain local and are not uploaded automatically. On Immich, an explicit sharing action can create links on the user's own server with an optional password, expiry date and guest-upload permission.

Deletion

You can remove saved connections, offline media, previews, backup history and local diagnostics. App data can be deleted through Android. Trash items can be restored or permanently deleted.

Hosting of the public website

Lesiya's public privacy, support and legal-notice website is hosted on Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the website is accessed, Cloudflare processes technically necessary connection and log data, in particular the IP address, time, requested address, browser and system information. This processing serves the secure, reliable and efficient delivery of the website and is based on our legitimate interest under Article 6(1)(f) GDPR. Lesiya does not use its own analytics or advertising services on this website.

Cloudflare may process data outside the European Economic Area, including in the United States. According to Cloudflare, such transfers rely, among other safeguards, on the EU-US Data Privacy Framework and, where required, Standard Contractual Clauses. Further information is available in Cloudflare's Privacy Policy.

Controller and contact

Lesiya
Ibrahim Ayaz
Tannenweg 13
63741 Aschaffenburg
Deutschland

Privacy: lesiya.support@gmail.com
Support: lesiya.support@gmail.com