Privacy at Lugga

Controller

The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:

In short

Lugga shows the photos from your own Synology NAS on your Mac. I run no server for Lugga; there is no account, no analytics, no advertising and no crash reports to third parties. I receive nothing from you through the app. Data only goes to your NAS and, for two features, to Synology and Apple.

What is stored on your Mac

Lugga stores the address, user name and password of your NAS as well as your settings. The password is kept in the macOS keychain. The app caches thumbnails and capture details of your photos so it loads quickly. Detecting where faces are in a photo runs on your Mac itself; nobody is identified and nothing is transmitted.

To the extent I process anything at all, the legal basis is Art. 6(1)(b) GDPR: the app needs these details to do what you ask of it.

Connecting to your NAS

Lugga talks to the NAS you enter. User name, password and, where applicable, your two-factor code go there; your photos come from there.

If you enter a QuickConnect ID instead of an address, the app asks Synology’s QuickConnect service at which address your NAS can be reached. Synology learns the ID and your Mac’s IP address. If the app can only reach your NAS through Synology’s relay, the connection runs through Synology’s servers. You set up QuickConnect for your NAS with Synology; Synology’s terms apply. Synology is based in Taiwan; according to Synology, transfers rely on standard contractual clauses. Without a QuickConnect ID, Synology is not contacted.

Synology Inc.

9F, No. 1, Yuan Dong Rd., Banqiao, New Taipei 220056, Taiwan

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Map view

For the map, Lugga loads map data from Apple Maps. The app sends place names from your photo library to Apple to turn them into map positions. Apple learns the place names, the visible map area and your Mac’s IP address, but not your photos. This only happens when you open the map view.

The legal basis is Art. 6(1)(b) GDPR.

Apple Distribution International Ltd.

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Mac App Store

You download the app from the Mac App Store; whatever Apple processes there (for example about download and purchase) is Apple’s own responsibility.

Apple Distribution International Ltd.

Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

Transfers to a country outside the EU are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Provider’s privacy policy

Retention and deletion

The details and cached thumbnails stay until you delete them in the app or remove the app. You can also delete stored passwords in the macOS keychain. Because I hold no data about you, you exercise your rights for the app directly by deleting the data on your Mac; for questions, reach me at the address above.

Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests (Art. 21). An email to the address above is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in the country where you live.