Kadre Privacy Policy

Effective Date January 3, 2026
Document Version 1.0 (First version)
Jurisdiction Worldwide (GDPR, CCPA, LGDP, PIPEDA, APP Compliance)
Classification Legal Binding Agreement

Preamble: Privacy-by-Design Philosophy

This Privacy Policy represents our commitment to protecting the fundamental right to privacy as recognized by international human rights law, including Article 12 of the Universal Declaration of Human Rights and Article 8 of the European Convention on Human Rights. The Kadre application has been architected from inception using Privacy-by-Design principles as codified in GDPR Article 25, ensuring that data protection is not an afterthought but the foundational pillar of our technical infrastructure.

We recognize that in the digital age, users entrust applications with access to sensitive personal content, including photographs and media that may contain intimate moments, family members, and private spaces. We have therefore implemented a "Zero-Knowledge Architecture" whereby we maintain no persistent knowledge of user activities, content, or identity. This policy explains in exhaustive detail the limited, ephemeral, and purpose-bound data processing operations that occur within the Kadre ecosystem.

1. IDENTIFICATION OF THE DATA CONTROLLER

1.1. Responsible Entity

The data controller—the entity responsible for how your data is handled when you use Kadre—is The Kadre Development Team/Project Owner (referred to throughout this document as "We", "Us", or "Our").

What "processing" means: Under data protection law (specifically GDPR Article 4(2)), "processing" includes any action taken with personal data, whether automated or manual. This includes collecting, recording, organizing, storing, adapting, retrieving, using, disclosing, erasing, or destroying data.

1.2. Contact Information and Correspondence

If you want to exercise your privacy rights, ask questions about this policy, or raise concerns, you can reach us at:

  • Primary Email: victorigorrubiodominguez@gmail.com
  • Response Time: We aim to respond as soon as possible.
  • Subject Line: Please use "Kadre Privacy Inquiry" to ensure your message reaches the right person quickly

We will acknowledge receipt of your message within 48 hours and provide a complete response within the timeframes required by applicable data protection laws (typically 30 days under GDPR).

1.3. Data Protection Officer Designation

Under GDPR Article 37(1), we've assessed whether we need to appoint a formal Data Protection Officer (DPO). We've determined that a DPO is not legally required for these reasons:

  • We are not a public authority or government body
  • Our core activities don't involve large-scale systematic monitoring of users
  • We don't process large amounts of sensitive personal data (as defined by GDPR Article 9)

However, our Lead Technical Architect takes functional responsibility for all privacy-related decisions, security implementations, and compliance oversight.

2. DETAILED INVENTORY OF DATA COLLECTED

We follow the principle of "data minimization" required by GDPR Article 5(1)(c). This means we only collect data that is absolutely necessary for the application to work. Here's exactly what we do and don't collect:

2.1. Data Provided Directly by the User Through Affirmative Action

2.1.1. Visual Content (Images/Photographs)

What this is: When you select an image to edit in Kadre, you're giving the application access to that specific image file. This can be in common formats like JPEG, PNG, WEBP, or HEIC.

How collection works: You select the image using your computer's standard file dialog (like Windows File Explorer). The application only gets access to the exact file you choose—it doesn't have access to your entire photo library or any other files on your computer.

What we do with it:

  • Local Processing Only: All editing operations (applying frames, extracting colors, adjusting filters) happen entirely on your own computer using your CPU and RAM. We use bundled software libraries (Pillow and NumPy) that run locally on your machine.
  • No Uploads: Your images are NEVER uploaded to any server, cloud service, or sent over the internet. They stay on your device.
  • Temporary Memory Storage: When you're editing an image, it's temporarily held in your computer's RAM (volatile memory). As soon as you close the application or finish editing, this data is automatically cleared.

Retention Period: While the app is open: Stored in RAM during editing. After closing: Automatically deleted from memory. Server-side: Not applicable—we never receive your images.

2.1.2. User Preferences and Configuration Settings

What this is: The application remembers your preferences to make your experience better. This includes: Theme choice, History of colors, Favorite colors/frames, Window size/position.

How it's stored: These settings are saved in a simple text file (JSON format) called config.json on your own computer, in a folder specifically for Kadre within your user directory.

Security: This file is stored in your personal user folder, which means only you (and computer administrators) can access it. It's protected by your computer's standard file permissions.

Retention: These settings remain on your computer indefinitely until you uninstall Kadre or manually delete the configuration file.

2.2. Data Collected Automatically Through Permissions and System Sensors

2.2.1. Network Connectivity Status Verification

  • Data Accessed: TCP/IP connectivity status, DNS resolution.
  • Collection Mechanism: The application performs a lightweight TCP socket connection to Cloudflare's public DNS resolver at IP address 1.1.1.1 (port 53 or 443) to verify active internet connectivity.
  • Purpose and Justification: This verification prevents the application from attempting to upload images or fetch resources when no internet connection is available.
  • Data Minimization: The connectivity check consists solely of establishing and immediately closing a TCP connection. No HTTP request is made, no user-agent string is transmitted, and no payload data is exchanged beyond the TCP handshake.

2.2.2. Device Metadata (Technical Telemetry)

What's collected: Your Windows operating system version, The version number of Kadre you're running, and if the application crashes, a log file (Kadre_error.log) is created locally on your computer containing technical details about what went wrong.

Purpose: This information helps diagnose and fix problems if something goes wrong. The crash log is stored only on your device and is not automatically sent to us unless you choose to share it when reporting a bug.

Legal basis: Legitimate interest in maintaining application stability (GDPR Article 6(1)(f)).

2.3. Data We STRICTLY DO NOT Collect (Negative Declarations)

Legal Effect: These negative declarations are made under penalty of perjury and serve as binding commitments. Any deviation from these representations would constitute a material breach of this policy and trigger mandatory notification obligations under applicable data breach laws.
  • Personal Identifiers: No full legal name, emails, phone numbers, physical addresses, social media usernames, or government IDs.
  • Biometric Data: No facial recognition, fingerprints, iris scans, or voice prints.
  • Device Identifiers: No IMEI, MAC address, Google Advertising ID (GAID), Android ID, or Serial numbers.
  • Precise Location Data: No GPS coordinates, cell tower triangulation, or WiFi positioning.
  • Communication Content: No SMS, emails, call logs, or contact lists.
  • Financial Information: No credit cards, bank info, or payment history.
  • Health Information: No medical records or fitness data.
  • Behavioral Analytics: No session tracking, heatmaps, or user interaction recordings.

3. PURPOSE OF PROCESSING AND LEGAL BASIS

3.1. Core Functionality: Image Editing and Enhancement Services

What we do: We locally process the image files you select, apply the filters/frames you choose, perform color corrections, and export the edited images back to your computer.

Why we do it: This is the fundamental purpose of Kadre—to provide you with image editing tools. Without processing your images, the application couldn't function.

Legal basis: Contractual necessity under GDPR Article 6(1)(b). When you use Kadre, there's an implied contract that we'll provide the editing services described. Processing your images is strictly necessary to fulfill that agreement.

3.2. Security, Fraud Prevention, and System Integrity

What we do: We verify that image files are in valid formats, handle errors gracefully when something goes wrong, and maintain logs of technical errors locally on your device.

Why we do it: To prevent crashes, protect your computer from corrupted files, and ensure the application works reliably.

Legal basis: Legitimate interest under GDPR Article 6(1)(f). We have a legitimate need to maintain a stable, secure application, and this processing doesn't override your privacy rights because it's minimal and local-only.

3.3. Legal Compliance and Regulatory Obligations

Current status: Because of our Zero-Knowledge Architecture (where we don't receive or store your data), we're not subject to any legal requirements to retain user data or respond to data disclosure requests. It's technically impossible for us to comply with requests for user data because we simply don't have it.

4. DATA SHARING, THIRD PARTIES, AND PROCESSOR RELATIONSHIPS

The short answer: we don't share your data because we don't have access to it in the first place. However, for complete transparency, here are the only external services that may process minimal technical information:

4.1. Data Processors (Infrastructure Service Providers)

Cloudflare, Inc. (USA): Domain Name System (DNS) resolution and network connectivity verification.

  • Data Shared: User's IP address (inherent to TCP/IP protocol).
  • Privacy Commitments: Cloudflare operates the 1.1.1.1 DNS resolver under a specific privacy commitment not to sell user data.

4.2. Absence of Marketing, Analytics, and Advertising SDKs

We want to be crystal clear about third-party services we do not integrate, use, or share any data with:

  • Google Services: No Google Analytics, Google Ads, AdMob, Firebase Analytics, Tag Manager, or any other Google tracking or advertising products
  • Meta/Facebook Services: No Facebook SDK, Meta Pixel, or any Facebook/Instagram tracking tools
  • Third-Party Analytics and Attribution: No AppsFlyer, Adjust, Mixpanel, Amplitude, or similar analytics platforms
  • Advertising Networks: No Unity Ads, IronSource, or any other ad networks
  • Social Media Integration: No social media sharing SDKs or tracking pixels

4.3. Government and Law Enforcement Disclosure

Disclosure Principles: We respect user privacy while acknowledging legal obligations to cooperate with lawful government requests in certain limited circumstances.

Threshold Requirements: We will only disclose user data to government authorities when:

  1. Presented with a valid legal process (subpoena, court order, or search warrant).
  2. The request meets applicable legal standards (probable cause, relevance, specificity).
  3. The request is not overbroad or in violation of user rights.
  4. Disclosure is legally compelled and not voluntary.

Practical Limitation: Given our Zero-Knowledge Architecture, we typically possess minimal data to disclose. In most scenarios, we can honestly represent to authorities that we do not maintain the requested data (e.g., user identity, content history, location data).

Transparency Report: We commit to publishing an annual transparency report disclosing the number and nature of government data requests received, the number complied with, and the number challenged or rejected.

5. SECURITY MEASURES AND DATA RETENTION

The Kadre application uses a security framework we call "Nuitka" (Desktop Adaptation). Here's how it protects your privacy and security:

5.1. The "Nuitka" Security Standard and Cryptographic Architecture

  • Executable Encapsulation: The application is compiled as a standalone executable using industry-standard packaging (PyInstaller). This bundles the Python interpreter and all dependencies into a single package, preventing external code injection or unauthorized modifications.
  • Localhost Isolation: The internal web interface (which provides the visual editing interface) runs on a local web server (Flask) that only listens on your computer's "loopback" interface (127.0.0.1). The interface is completely inaccessible from other devices on your network or from the internet.
  • Memory Security: Image data in RAM is managed by Python's automatic garbage collector. When an editing operation completes or you close the application, this memory is immediately released and overwritten.

5.2. Web Environment Hardening and Runtime Security

Browser Engine Configuration: The embedded browser that displays the editing interface is configured to prevent navigation to external websites (except for opening this privacy policy or similar documentation links in your default browser). Cross-origin requests are blocked.

5.3. Data Retention Policies and Timelines

  • Volatile Memory (RAM): Your images are loaded into RAM only while you're actively editing them. As soon as you finish and close the application, this data is cleared.
  • Server-Side Storage: Not applicable—we don't have servers that store user data.
  • Local Configuration (on your device): Your preferences in config.json remain until you uninstall Kadre or manually delete the file.
  • Exported Images: When you save an edited image, it's saved to your chosen location on your computer. These files are entirely under your control.
  • Backups: We do not create or maintain any backups of user content.

6. USER RIGHTS (YOUR DATA SOVEREIGNTY)

Under data protection laws worldwide, you have comprehensive rights regarding your personal data. Here's what each right means and how to exercise it with Kadre:

  • Right to Access (GDPR Article 15): You can request confirmation of what personal data we're processing about you. Contact us at victorigorrubiodominguez@gmail.com.
  • Right to Rectification (GDPR Article 16): You can correct inaccurate personal data. For local preferences, you can modify them directly in the application's settings.
  • Right to Erasure/"Right to be Forgotten" (GDPR Article 17): You can request deletion of your personal data. Simply uninstall Kadre from your computer.
  • Right to Data Portability (GDPR Article 20): You can receive your personal data in a machine-readable format. Your configuration file (config.json) is already in a standard, portable format (JSON).
  • Right to Restriction of Processing (GDPR Article 18): You can limit how your data is processed. You can choose not to use specific features of Kadre.
  • Right to Object (GDPR Article 21): You can object to processing based on legitimate interests. Contact us to object to any processing operations.
  • Right to Withdraw Consent: If processing is based on your consent, you can withdraw it at any time.
  • Right to Lodge a Complaint: You can file a complaint with a data protection authority if you believe we've violated your privacy rights.

7. CHILDREN'S PRIVACY (COPPA, GDPR-K, and Global Standards)

We're committed to protecting children's privacy in compliance with COPPA (Children's Online Privacy Protection Act), GDPR-K (GDPR provisions for children), and equivalent global standards.

Age Restrictions and Verification

Our approach: Kadre is a general-purpose utility tool for image editing. We don't implement age verification gates because we don't collect personal information that would require parental consent.

COPPA Compliance (Under 13 in the United States): We comply by design: we don't collect names, email addresses, locations, photos (they stay local), or any other personal information. Because we don't collect this data from anyone—child or adult—we're automatically COPPA-compliant.

GDPR-K Compliance (Under 16 in the EU): We don't offer services that require consent (like creating accounts, posting content online, or social features). All processing is local.

Parental Controls

Parents and guardians can use their operating system's built-in parental controls to restrict which applications children can install and use.

8. INTERNATIONAL DATA TRANSFERS AND CROSS-BORDER DATA FLOWS

Data protection laws restrict transferring personal data across international borders. Here's our status:

User Content (Your Images)

Transfer status: There are NO international transfers of your images or editing data. All image processing happens entirely on your local device.

Technical Metadata (Connectivity Checks)

Limited processing: When Kadre checks internet connectivity by connecting to Cloudflare's 1.1.1.1 DNS service, your IP address is inherently transmitted as part of the TCP/IP protocol.

  • From: Your location (wherever you use Kadre)
  • To: Cloudflare's global infrastructure (including servers in the United States)
  • Data transferred: Your IP address only
  • Safeguards: Cloudflare is certified under the EU-U.S. Data Privacy Framework and complies with GDPR.

9. DATA BREACH NOTIFICATION AND INCIDENT RESPONSE

  • Definition: Accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal data.
  • Notification: We will notify supervisory authorities within 72 hours and affected individuals without undue delay if there is a high risk to rights and freedoms.
  • Risk Assessment: The likelihood of a material breach is extremely low because no persistent user accounts or credentials exist to be compromised.

10. COOKIES POLICY AND STORAGE TECHNOLOGIES

This application operates as a secure desktop interface integrating web services. To ensure functionality, customization, and the security of your data, we utilize various storage mechanisms on your computer. Below, we detail the technologies used, storage locations, and technical purposes:

10.1. Session and Navigation Cookies (Secure WebView)

  • What they are: Small encrypted text files managed by the application's integrated navigation engine.
  • Purpose: Strictly necessary to identify you as a registered user and maintain an active session.
  • Specific Use: Our application utilizes these cookies to manage your session. Thanks to the implementation of SSL encryption (HTTPS) in local communication, these cookies are transmitted and stored securely, allowing the application to recognize you between restarts without compromising your credentials.

10.2. Browser Local Storage (DOM Storage)

  • What it is: Memory space reserved within the web navigation component (localStorage and sessionStorage).
  • Purpose: Enables the interface to load faster and remember visual preferences (such as dark/light mode) or application state across different screens, without constantly reloading all information from the local server.

10.3. System Preference Files (Local File Storage)

  • What it is: Configuration and log files stored within your operating system's user directory.
  • Purpose: The application generates and updates local files, such as diagnostic logs (Kadre_error.log) or favorites configuration files.
  • Specific Use: These files allow for the diagnosis of critical errors and ensure that your preferences and saved items are restored immediately upon opening the application, even without an internet connection.

10.4. Third-Party Cookies and Security

  • What they are: Cookies generated by external providers.
  • Purpose: Currently, the application operates under a strict Content Security Policy (CSP) that blocks the execution of scripts and cookies from unauthorized domains by default to maximize your privacy.
  • Note: If explicit external services (such as payment gateways or multimedia content viewers) are integrated in future updates, these services may require the storage of their own cookies, always subject to the security protocols defined by the application.

10.5. Client Identifiers (User Agent)

  • What it is: A text string identifying the navigation software used.
  • Purpose: The application modifies this identifier using the "KadreApp Desktop" tag. This allows our servers to recognize that access originates from the official desktop application and serve the version optimized and secured for this environment.
Management and Deletion: Since this data is stored locally on your computer, you have full control. Navigation data and cookies are stored in the application cache folder managed by the operating system. You can delete them by uninstalling the application or manually deleting the temporary data folder associated with "Kadre" in your user directory. Please note that this will close your session and may reset your local preferences.

11. ACCESSIBILITY AND LANGUAGE

We've designed this privacy policy to be accessible to everyone, in accordance with WCAG 2.1 Level AA standards:

  • Readability Features: Clear language, Logical structure, High contrast, Responsive design.
  • Alternative Formats: If you need this privacy policy in an alternative format (such as large print, audio, or a different language), please contact us at victorigorrubiodominguez@gmail.com.

12. DISPUTE RESOLUTION AND GOVERNING LAW

12.1. Informal Dispute Resolution

We encourage users to contact us directly with any privacy concerns or complaints before pursuing formal dispute resolution mechanisms. Many concerns can be resolved quickly and amicably through direct communication.

12.2. Governing Law and Jurisdiction

This Privacy Policy and all related matters shall be governed by and construed in accordance with the laws of the European Union and its member states.

13. CONTACT INFORMATION AND DATA PROTECTION INQUIRIES

General Inquiries: victorigorrubiodominguez@gmail.com
Response Time: We aim to respond as soon as possible.

13.1. Security Vulnerability Reports

If you discover a security vulnerability in the Kadre application, we encourage responsible disclosure:

  • We commit to acknowledging security reports within 24 hours.
  • Providing updates on investigation and remediation within 7 days.

13.2. Supervisory Authority Contact

Users have the right to contact their local data protection supervisory authority with complaints or concerns. We will cooperate fully with supervisory authority investigations.

14. CONCLUSION AND CONTROLLER'S COMMITMENT

The Kadre application represents a commitment to a new paradigm of privacy-respecting application design where user privacy is not an afterthought but the foundational architectural principle. The Controller's Zero-Knowledge Architecture ensures that we cannot abuse, misuse, or mishandle your personal data—because we fundamentally do not possess it.

Core Commitments:

  • We will never sell your data to third parties.
  • We will never use your data for advertising or behavioral profiling.
  • We will never retain your data longer than necessary for immediate processing.

By using Kadre, you act with full knowledge of your digital rights.