NextGallery – Android app privacy policy
Updated: 4 October 2026
Provider and contact
Paul Wolfmajer
Forstsiedlung 20
8074 Raaba-Grambach, Austria
support@wolfmajer.com
What the app processes
NextGallery is a gallery client for a Nextcloud chosen by you. To connect, the app processes your server address, sign-in name and an app password. It reads your selected folders and subfolders, file names, paths and identifiers, previews, photos, videos and available metadata. Metadata may include capture dates, image dimensions, video duration and GPS coordinates embedded in photos. These data support the gallery, chronological ordering, playback, map and offline browsing.
Connections and recipients
The app communicates directly with your selected Nextcloud over HTTPS. The app provider operates no intermediary service for these functions and receives no gallery, account or location data through the app. Your Nextcloud and its hosting provider receive requested URLs, authentication, your IP address and technical connection information and may keep their own logs. Their privacy information also applies. The location and international transfers of a server you choose outside the EEA depend on its operator.
Local storage
Your device password is encrypted with AES-GCM, using a key kept in Android Keystore. Folder, file, date and available GPS details are stored in a local database within the protected app storage. Previews are cached locally; explicitly saved previews remain until removal or sign-out. Photos and videos are loaded when opened. Local media and the database are protected by Android app storage but are not additionally encrypted using an app-specific key. Protection may be limited on an unlocked, compromised or rooted device. Android backup and device transfer are disabled for app data.
Map and permissions
The world map uses bundled map data. No external map or geocoding service is contacted. Only location metadata embedded in your photos is used; the app does not request your current location, camera, microphone, contacts or broad media access. It needs Internet access and network-state information.
Advertising and analytics
This version contains no advertising, analytics, tracking, advertising-ID or crash-reporting services. It automatically sends no usage information to the app provider. The optional sample gallery consists entirely of synthetic media. You do not need to register an account with the app provider. Future advertising integrations require an updated policy and applicable consent before activation. The current Support me dialog only offers feedback; it does not load ads or unlock paid features.
Retention and removal
Temporary image copies are replaced within a bounded cache. Remove offline previews in the Offline section. Signing out deletes this account's credentials, database and local media copies. The app also tries to revoke exactly the app password it used in Nextcloud. If this cannot be done offline, remove the device in Nextcloud under Security → Devices & sessions. A server-requested device wipe is checked after a failed authentication and removes local account data. Your Nextcloud account and server originals are preserved. Android removes local app data when you uninstall; revoke server access separately if needed.
Legal bases and responsibilities
Local processing and the connection you request provide the selected app functions. Where the provider processes personal data to perform a user contract, Article 6(1)(b) GDPR applies. Your Nextcloud operator is responsible for processing on its server, access permissions, legal bases, retention and possible international transfers. The app provider cannot access your gallery and cannot retrieve or delete its originals remotely.
Support correspondence
If you contact the provider by email, your email address, message and voluntarily provided information are processed to answer your request. Please do not send passwords or private photos. Contract-related requests are handled under Article 6(1)(b) GDPR, privacy-rights requests under Article 6(1)(c), and other enquiries under the legitimate interest in providing support under Article 6(1)(f). Recipients are the provider and the email-service provider used for this address. Messages are kept only as long as needed to handle your request and satisfy applicable legal retention obligations or necessary legal claims; they are not used for marketing.
Your rights
You may ask the responsible controller for access, rectification, erasure, restriction and portability where the law provides these rights. You may object to processing based on legitimate interests. Where consent is used, you may withdraw it for the future. There is no automated decision-making with legal effects. You may complain to a supervisory authority, including the Austrian Data Protection Authority at https://www.dsb.gv.at. Device credentials are necessary to connect; without them, you can use the sample gallery.
Website hosting
The legal and support website is hosted through Cloudflare. Visiting the website discloses technical request data, including IP address, URL, time, referrer and browser information to Cloudflare to deliver content, terminate TLS and protect against abuse. The legal basis is the legitimate interest in operating a reliable, secure information service, Article 6(1)(f) GDPR. The website uses no advertising, analytics or profiling scripts and sets no application cookies. Request and security retention depends on the activated Cloudflare services and account settings; contact the provider for the settings applying to your request. Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, provides hosting infrastructure; its processing may take place outside the EEA. Applicable safeguards depend on the recipient and processing, including an applicable adequacy decision or standard contractual clauses and supplementary measures where required. See https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/cloudflare-customer-dpa/. No blanket claim is made that every transfer is covered by the EU–US Data Privacy Framework.
Google Play
Google processes downloads and updates under its own policies. The app functions described above do not transmit your gallery to Google or the app provider. If the website's hosting changes, this information must be updated before that change takes effect.