Privacy Policy — Sofi (Google Photos)

Effective date: April 19, 2026

Application: Sofi (Synchronised frames over the internet) — software that displays photos from Google Photos on a local device (for example, a Raspberry Pi with an e‑paper display).

Contact: Atharv’s Studio — atharv228.as@gmail.com — Source code repository is not publicly available at this time.

1. Who this policy covers

This software is run on hardware you control (for example, your Raspberry Pi). The operator of that device—typically you, or your employer if they provisioned it—decides whether to install and use the application and is responsible for the device and its network.

If you received the software from a publisher (company or individual) who provides support or updates, that publisher may publish additional notices; where those notices conflict on matters they control (for example, a hosted support portal), their terms apply to that service.

2. Summary

• The application is used to show your own Google Photos content on a physical frame via Google’s Photos Picker API and/or Photos Ambient API, with your explicit sign-in.
• Google processes authentication and Photos data according to Google’s policies.
• We do not sell your personal information. We do not use Google user data for advertising, including personalized or retargeted ads.
• Limited Use: Our use of information received from Google Photos APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
  Statement: The use of information received from Google Photos APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Information the application processes

3.1 You provide (configuration)

• OAuth client configuration (for example, client IDs and secrets in config.json) supplied by you from Google Cloud Console. This file stays on your device.

3.2 Google provides (after you sign in)

With your consent through Google’s OAuth or device authorization flow, the application may obtain and store locally on the device:

• OAuth tokens (access token, refresh token where issued) and related expiry metadata
• Account profile from Google’s userinfo endpoint when available (for example, name, email address, profile picture URL) — used only to show which account is connected and to support disconnect
• Picker mode: session identifiers and management URLs returned by the Photos Picker API
• Ambient mode: device identifiers and management URLs returned by the Photos Ambient API
• Operational metadata returned by Google APIs (for example, flags indicating whether you have finished selecting media or sources)

3.3 Photos content

The application requests image bytes from Google only for items you have authorized through Picker or Ambient, in order to render them on the connected display. Processing occurs on the device; the application does not upload your photos to a separate server operated by Atharv’s Studio for the self-hosted use described here.

3.4 What we do not do (application behavior)

• No third‑party advertising or analytics SDKs are included in this repository’s application code.
• No sale of personal information.
• No use of Google Photos API data to build or train generalized machine learning models, or for automated credit, lending, or advertising decisions.

4. Purposes of processing

5. Legal bases (where GDPR / UK GDPR applies)

If the operator is in the European Economic Area or United Kingdom, processing of Google account and Photos data is based on your consent when you complete Google’s authorization flow. Local configuration and token storage are necessary to perform the service you requested (displaying your chosen photos).

6. Sharing and subprocessors

• Google LLC (and affiliates) provides sign‑in, OAuth, and Google Photos APIs. Processing is governed by Google’s terms and privacy policies: see Google Privacy Policy and Google APIs Terms of Service.
• Atharv’s Studio does not route your tokens or photos through infrastructure we operate solely by virtue of you running the software on your own device.

If you use a tunnel, reverse proxy, or remote desktop to reach the setup UI, operators of those tools may process network traffic under their own policies.

7. Retention and deletion

• Data written by the application (including photo_frame_data.json) remains on your device until you delete it or use the application’s disconnect flow where implemented (which removes stored credentials on the device).
• Revoking the app in your Google Account → Security → Third‑party access stops authorization on Google’s side; you should still delete local data files if you wish to remove copies from the device.
• Google retains information under Google’s data retention practices.

8. Security

• Communications with Google use HTTPS where the APIs require it.
• OAuth tokens and secrets are sensitive. You should protect the device (OS updates, strong passwords, full‑disk encryption where available, physical security).
• Restrict network access to the setup web interface (firewall, local network only) if you expose it beyond localhost.

9. Children’s privacy

The application is not directed at children under 13 (or the age required by your jurisdiction). Operators should not authorize the frame with a child’s account unless parental authority or consent applies as required by law.

10. International transfers

Google may process data in countries where it operates. See Google’s documentation and privacy policy for international transfers and safeguards.

11. Your rights

Depending on your region, you may have rights to access, correct, delete, restrict, or object to processing of personal data, and to withdraw consent (for example, by disconnecting the app and revoking access in your Google Account). Because deployment is self‑hosted, requests to delete local files are fulfilled by you or your organization’s administrator on the device.

12. Changes

We may update this policy when the software or legal requirements change. The effective date at the top will be revised; material changes should be reflected in your published copy before you rely on it for compliance filings.

13. Regulatory / program references

Use of Google user data is also subject to:

• Google API Services User Data Policy
• Google Photos APIs — User Data and Developer Policy

← About Sofi  ·  Home