ShowMeMore privacy policy

ShowMeMore lets you publish the hidden version of a photo, which opens only with its code. To do that, it stores your photos, encrypted, on Google Firebase. No ads, no tracking, no account to create. Usage statistics and crash reports are sent only if you agree.

Last updated: October 27, 2026

Who we are

Wakirox.app, by Marius Gabriel Magadan, is the data controller for the ShowMeMore app for Android and iPhone. For any question: info@wakirox.app.

This page covers ShowMeMore only. The website and the other apps are in the general policy: wakirox.app/privacy-policy/.

What ShowMeMore stores, and where

ShowMeMore runs on Google Firebase (project “free-censorship”), run by Google: Firebase Authentication for your account and Cloud Firestore for the photos and the counts. Google keeps the data in its data centres, which may be outside the European Union, with the safeguards the law requires (adequacy decisions or standard contractual clauses).

  • Your account: a random id created by Firebase. No name, email or phone number is needed.
  • For each photo you publish: the shared version (the hidden picture with its code and, if you add one, your watermark), the sealed (encrypted) original, the date, the number of views and favourites, and the lock’s technical details (nothing secret).
  • A link between the photo’s code and your account, so the app knows who published it.
  • For each photo you unlock: a record with your account, the photo, when you opened it and whether you favourited it.
  • The reports, blocks and bans described below.

Photos and encryption

When you publish a photo, the original is sealed on your phone before it’s uploaded (libsodium: XChaCha20-Poly1305; with a password, the key also goes through Argon2id). The shared version is the hidden picture, with its code drawn on it.

Without a password, the code printed on the shared version is enough to open the original. Anyone who has the shared version can open it and, since we store it, technically so could we. Treat a photo without a password as visible to anyone who has the shared version.

With a password, the original opens only with the code and the password. The password never leaves your phone: we don’t store it, or anything it could be worked out from. Nobody can recover a lost password, not even us.

On a new phone, or after reinstalling the app, ShowMeMore reads each photo’s code from its stored shared version, on the phone, to open it again. Nothing new is stored: it’s the same code anyone with the shared version can already scan. Photos with a password still need the password.

Photos with a password published with versions before 1.2 stored the password in a form the app can read. If that matters to you, delete them and publish them again.

When you delete a photo, its images and the records of everyone who unlocked it are gone, for everyone. Only copies outside ShowMeMore stay: the shared version you posted elsewhere, and photos or screenshots someone already saved.

Unlocks, views and favourites

  • When you unlock a photo, ShowMeMore records it in Firestore: it’s your Unlocked list. The photo’s view count goes up by one; adding or removing the heart changes its favourite count.
  • The photo’s publisher can technically read these records (the counts need them), but they hold only random ids, not names or emails.
  • “Remove from Unlocked” deletes your record and forgets the photo’s key on your phone.
  • If you block a photo’s publisher, we keep your account, theirs and the date, until you delete your data.

Accounts and sign-in

  • On first start the app creates an anonymous account: a random id, no personal details.
  • On Android you can sign in with Google if you want, to keep your photos when you change phone. Google gives Firebase your email address and name: they stay in Firebase Authentication and you see them in Settings, but they don’t go into Firestore and other users don’t see them. You can sign out in Settings.
  • On iPhone you can sign in with Apple, for the same reason. The app asks only for your email, not your name; Apple may give us a relay address if you choose “Hide My Email”. The email stays in Firebase Authentication, as with Google. You can sign out in Settings.
  • To block fake requests, the app uses Firebase App Check: Google Play Integrity on Android, Apple’s App Attest on iPhone. They check that requests come from the real app on a real device; Google and Apple process device integrity information for this.

Reports and moderation

  • If you report a photo, ShowMeMore saves the photo’s code, the publisher’s id and yours, the reason and the date in Firestore, and takes the photo off your list.
  • Then the app opens a ready-made email to info@wakirox.app, which you send from your own mail app (if there’s none, the text is copied). The email holds a link with the photo’s key from your phone, so we can see the photo even if it has a password.
  • We may remove a photo that breaks the rules: its images are deleted and it no longer opens for anyone; a record that it was removed stays.
  • We may stop an account from publishing. We keep the account, the reason and the date while the ban applies. A banned user sees the reason and can contest it by writing to info@wakirox.app.
  • Reports are deleted 12 months after we review them.

What stays on your phone

  • Drafts (their images, settings and any password you set for a draft) stay only in the app’s private storage on your phone, until you publish or delete them. They are left out of backups and of moving to a new phone (Google backup and device transfer on Android, iCloud backup on iPhone).
  • Photo keys and the default password are encrypted in the system’s key store (Keychain on iPhone, Android Keystore on Android) and never go into backups.
  • Your phone’s backup may include the app’s other settings, such as the default watermark.
  • Unlocking with Face ID, Touch ID or a fingerprint is handled by the system: the app only gets a yes or a no.

Permissions

  • Camera: only to scan a photo’s code. The scanning happens on your phone, and camera images are neither saved nor sent.
  • Photos: on Android you pick photos with the system picker, which gives the app only the one you pick; on iPhone the app only asks to add photos, to save the hidden version.
  • Face ID, fingerprint: only if you turn on the app lock.
  • Internet: to publish, unlock and sync.

Services used

  • Google Firebase (Google LLC and Google Ireland Ltd.): Authentication, Cloud Firestore and App Check, on both platforms.
  • Usage statistics and crash reports, on Android and iPhone, only with your consent. The app asks once on the main screen (“Help improve ShowMeMore?”, with “No thanks” and “Share” as equal choices); nothing is sent before you answer. You can change your mind any time in Settings, under “Usage statistics and crash reports”. Development builds never send anything.
  • Usage statistics: Google Analytics for Firebase. The app’s automatic events (first open, sessions, screens viewed, app version, phone model, operating system, and the country and region Google works out from the IP address) and these ShowMeMore events: photo hidden, published, deleted, unlocked (saying only whether it had a password), wrong password, code not found, photo opened full screen, shared, copied, added to favourites, reported (with the reason’s category), publisher blocked, Google or Apple sign-in, review prompt shown, app update offered or installed, data deleted. They never include photos, codes or links, passwords, account ids, names or emails. Firebase uses an id for the app installation; we don’t use the advertising ID (on iPhone neither IDFA nor IDFV), and ad personalisation signals are off.
  • Crash reports: Firebase Crashlytics. After a crash it sends the error’s technical details, the phone model, the system and app versions and an installation id, never your photos. For iPhone release builds we also upload debug symbols, which hold no personal data.
  • Reading codes happens on your phone: Google ML Kit on Android, Apple’s Vision on iPhone.
  • Review prompts and, on Android, app updates go through the store’s own tools (Google Play, App Store), which handle them.
  • No ads, no tracking (ShowMeMore doesn’t use Apple’s cross-app tracking). We don’t sell data.

Why, and for how long

  • Photos, unlocks and accounts: they provide the service you ask for. They stay until you delete them, or until you delete your data.
  • Usage statistics and crash reports: only with your consent, which you can withdraw any time in Settings; turning it off also drops crash reports not yet sent. Statistics are kept for 2 months, crash reports for 90 days.
  • App Check, reports, removals and bans: legitimate interest in protecting the service and the people who use it, and legal obligations. Reports are deleted 12 months after review; bans are kept while they apply.

Deleting your data

In Settings, “Delete my data” deletes the photos you published (with their images), your unlocks, favourites and blocks, the drafts and keys on your phone, and finally your account. It can’t be undone.

Only these stay: copies outside ShowMeMore, reports others made about your photos (until 12 months after review) and a ban that still applies.

Usage statistics and crash reports already sent aren’t linked to your account, so “Delete my data” doesn’t touch them: they expire on their own (2 months and 90 days). If you want us to look for them and delete them sooner, write to info@wakirox.app.

If you linked a Google account, Firebase sometimes asks for a recent sign-in before it deletes the account: in that case all your data is still deleted, but the sign-in record (with your email) may stay in Firebase Authentication. Write to info@wakirox.app and we remove it.

If you linked your Apple Account, Apple asks you to confirm before the deletion, and the app revokes its Apple sign-in; if you cancel, nothing is deleted.

You can also ask by email to info@wakirox.app, for example if you no longer have the app: we’ll ask for what we need to find your account and reply within 30 days. This is the way to ask from the web, Google Play’s included.

Your rights

You can ask to see, correct or delete your data, limit its use, get a copy of it or object to its use, by writing to info@wakirox.app. You can also complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali).

Children

ShowMeMore is not meant for children under 14.

Changes

If this policy changes, we update the date at the top. For important changes, we tell you in the app first.