Privacy Policy

Last updated: 2026-07-21

Cullstack is a desktop application made by Aviastone LLC ("we", "us"). We designed Cullstack around a simple principle: your photos and the metadata you create about them stay on your machine. This page explains exactly what data we do and don't collect.

What stays on your machine

• Your photo and video files stay put. Cullstack reads them in place from wherever they live (local disk, NAS, cloud, phone) and never uploads them to any Aviastone server.
• Ratings, tags, comments, color labels, and collections are stored in a local database on your computer. Cullstack can also write standard XMP sidecar files next to your photos so other applications can read them.
• Connection details and cloud-storage authentication tokens (Dropbox, OneDrive, Google Photos, WebDAV, SFTP) are stored locally on your computer, never in any Aviastone-controlled location. Passwords and key passphrases in the local connection file are obfuscated but not encrypted; for sensitive servers we recommend SSH key authentication with a passphrase you enter at connect time.
• AI inference: every AI feature (CLIP semantic search, face detection, closed-eye flagging, NSFW flagging, AI auto-stacking, face-identity clustering) runs on your device using ONNX models stored locally. No image data is ever sent to Aviastone or any third-party AI service. Models are never trained on your photos.

What we collect

• License activation data. When you activate your license, we receive your license key, an instance identifier (e.g. "Studio iMac"), and the activation timestamp via our payment provider, Lemon Squeezy. This is used solely to enforce activation limits and process refunds.
• Update checks. Cullstack checks for new versions by requesting a static JSON file on our server. The request includes your platform (e.g. "macOS 14.5") and current Cullstack version. You can disable update checks in Settings.
• License-verification IP address. When Cullstack verifies your license, our licensing server records the IP address the request comes from. This is used solely to detect license sharing, for example the same key activating from many far-apart locations. It is never linked to your photos, file names, or in-app activity, never used for advertising or cross-site tracking, and is kept only as long as needed for license enforcement.

What we do not collect

• Photos, videos, or any image data of any kind.
• File paths, file names, or directory contents.
• In-app usage analytics, telemetry, behavioral data, or browsing history.
• Email address (unless you contact support or buy a license).

Third-party services

Cullstack interoperates with third-party storage services (Dropbox, OneDrive, Google Photos, iCloud, your SFTP/WebDAV servers) only when you explicitly connect them. These providers have their own privacy policies; Cullstack acts only as a client on your behalf and does not relay your data through Aviastone-controlled infrastructure.

Google user data (Google Photos)

When you choose to connect Google Photos, Cullstack uses Google's Photos Picker API with read-only access (photospicker.mediaitems.readonly) to display the photos and videos you select so you can browse and cull them on your own device. Cullstack’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, the Google Photos data you access:

• is shown and processed only on your own device, solely to provide the browsing and culling feature you asked for;
• is never transmitted to or stored on any Aviastone server;
• is never sold or transferred to third parties;
• is never used for advertising;
• is never used to train AI or machine-learning models;
• is not accessed by any human at Aviastone.

Cullstack requests read-only access only. It never writes to, modifies, deletes, or reorganizes your Google Photos. Your Google authorization token is stored only on your own computer and can be revoked at any time in your Google Account permissions or by removing the connection in Cullstack.

Data protection. All communication with Google’s APIs happens over encrypted HTTPS/TLS connections. Any photos or videos you pick are downloaded directly from Google to your device over those encrypted connections and saved only to the local folder you choose; they are never routed through, uploaded to, or retained on any Aviastone server. Your Google authorization token is stored only on your own computer and is used solely to make these read-only requests on your behalf. You remain in full control and can delete this data at any time by removing the files or the connection in Cullstack and revoking access in your Google Account permissions.

For payment processing and license issuance, we use Lemon Squeezy (a Stripe-owned company), which acts as Merchant of Record. Their privacy policy is at lemonsqueezy.com/privacy.

Our website (cullstack.com) uses GoatCounter, a privacy-first, cookieless analytics service, to understand aggregate traffic, which pages are visited most and visitors' approximate country. It sets no cookies, stores no personal data, builds no cross-site profile, and needs no consent banner. GoatCounter's policy: goatcounter.com/help/privacy.

Your rights (GDPR / CCPA)

You can request access to, correction of, or deletion of any data we hold about you (essentially: your purchase record and any opt-in crash reports) by emailing legal@aviastone.com. We respond within 30 days.

Contact

Aviastone LLC
Email: legal@aviastone.com