Privacy Policy for NukoGallery

Last updated: 29 Oct 2026

NukoGallery ("the app") is an Android app for browsing the photos and videos on your own NAS or PC, developed by Nuko ("we", "our"). This page explains what data the app handles — and what it does not collect.

Short version

Your photos and videos travel only between your phone and the servers you register yourself (a NAS, a PC and so on); they are never sent to us (we do not run any server). Server settings, passwords, the index, tags and thumbnails are stored only on your device. When you open the map, map images are loaded from OpenStreetMap. The free version shows ads, so Google's ad SDK (AdMob) handles data such as the advertising ID (details below). The Pro version (one-time purchase) shows no ads.

How the app uses your servers

• Reading: the app reads folder listings and the files it shows (thumbnails, photos, videos) directly from the servers you register, using the protocol you choose (SMB, SFTP, WebDAV, FTP/FTPS). Whether the connection is encrypted depends on the protocol and your server (SFTP, HTTPS and FTPS are encrypted; plain FTP and HTTP are not, so use them only inside your home network).
• Writing: the app writes to a server only when you choose to copy, move or delete files. It never changes files on the server otherwise.
• External players: when you open a video in another player app, the app serves it through a temporary stream that only accepts connections from the device itself (127.0.0.1). Nothing outside the device can connect to it.

The map and photo locations

• Photo locations: the place a photo or video was taken (location metadata such as EXIF) is read when its thumbnail is made, or when you tap "Read locations" on the map, and is kept only in the index on your device. It is never sent to us. The app never uses your device's current location.
• Map images: when you open the map, images for the area on screen are loaded from OpenStreetMap's tile servers (tile.openstreetmap.org), so your IP address and the area you are viewing reach the OpenStreetMap Foundation. Your photos and the list of their locations are not sent. See the OpenStreetMap Foundation's privacy policy.

What is stored on your device

• Server settings: host name, port, share name, user name, and the host key fingerprint of SFTP servers.
• Passwords: encrypted with a non-exportable key held by the Android Keystore.
• Index: names, sizes and dates of the folders and files in the folders you chose, plus photo dimensions, dates and locations, video lengths and playback positions. It is used to show lists quickly and to reduce reads from your NAS.
• What you add: galleries, favorites, tags, smart albums and which albums are private.
• Caches: thumbnails, photo previews and the parts of videos you played. You can set their limits or clear them in Settings.
• This data is excluded from Android's cloud backup and is deleted when you uninstall the app.

App lock (Pro)

The app lock and showing private albums use your device's own screen lock (fingerprint, face, PIN or pattern) through Android's standard BiometricPrompt. The app never receives or stores a password or biometric data.

Advertising (free version)

The free version shows a small banner ad from Google AdMob at the bottom of list screens (never while a photo or video is shown). AdMob may collect and use the advertising ID, device information and approximate location (inferred from the IP address) to serve and measure ads and to prevent fraud. Users in the EEA, the UK and similar regions are asked for consent through Google's User Messaging Platform, and can change it at any time from "Ad privacy options" in Settings. See how Google uses information from apps that use its services. You can reset or delete the advertising ID in your device settings.

In-app purchase

Purchasing Pro is handled entirely by Google Play. Payment details never reach us.

Permissions

• INTERNET / ACCESS_NETWORK_STATE: to talk to your servers, and for map images, ads and the in-app purchase.
• ACCESS_LOCAL_NETWORK: to connect to a NAS on your home (local) network, on Android 17 and later. The app only connects to the servers you register; it doesn't scan for or record other devices on the network.
• FOREGROUND_SERVICE_DATA_SYNC / POST_NOTIFICATIONS: to keep streaming while you watch a video in another player, with a notification saying so.
• MODIFY_AUDIO_SETTINGS: to boost the volume above 100% in the built-in player.
• USE_BIOMETRIC: to check your screen lock for the app lock (Pro).
• AD_ID: for ads in the free version (see "Advertising" above).
• The app has no current-location, camera, contacts, on-device photos or all-files-access permission.

What we do not collect

• Your photos and videos, their names, contents or locations
• Server addresses, user names or passwords
• Personal information such as your name or e-mail
• Usage analytics or crash reports sent to us

Children's privacy

The app is not directed at children under 13 (or the relevant age in your country) and does not knowingly collect information from them.

Changes to this policy

If this policy ever changes, this page will be updated and the "Last updated" date above will change accordingly.

Contact

Questions about this policy or the app can be sent to:

contact@nukoapps.fyi