1.1 These terms of use apply to the use of the SafetyImg app and the associated server services (together, “the service”). The provider is Lutz Maier (“we”).
1.2 The service is aimed at consumers and at businesses. Terms of the user that differ from these do not apply, even if we do not expressly object to them.
2.1 SafetyImg lets users make photos and videos available to individual other users of their choosing. The content is encrypted on the sender's device and leaves it in encrypted form only. What sits on our servers is ciphertext and nothing else. We cannot decrypt the content and we cannot look at it.
2.2 Recipients can view a medium that has been shared with them. The app gives them no way to save it, forward it, export it or copy it into the device gallery. On unmodified Android devices, screenshots are blocked by the operating system; where an attempt to capture is detected, we report it to the sender.
2.3 Express notice of the limits of this protection. Nobody can prevent a recipient from photographing or filming their screen with a second camera. That is technically impossible, and we claim otherwise nowhere. Access by users who have modified their device (“rooted” it) or built a modified version of the app is likewise not ruled out.
Anyone who shares a medium gives up a degree of control over it. The service makes copying considerably harder; it does not prevent it. This limitation forms part of the contractual description of what is provided.
2.4 Withdrawing a share takes effect from the moment of withdrawal: the recipient can no longer retrieve the medium after that. What they saw before, or captured by other means, we cannot bring back.
2.5 The service includes no text messages, no groups, no public channels and no web or desktop version.
3.1 Use is permitted exclusively to persons who have reached the age of 18.
3.2 By registering, the user confirms that they are of full age. Where we learn that an account is held by a minor, we suspend and delete it.
4.1 The contract comes into being when the email address is confirmed. There is no entitlement to conclude it.
4.2 One account per person is permitted. Details given on registration must be accurate; a real name is not required.
4.3 Access credentials must be kept secret. Anyone who suspects that a third party has access to their account must change the password without delay and inform us.
5.1 The key protecting a user's content exists on that user's devices alone. So that changing devices remains possible, the app deposits an encrypted copy of that key with us. It can only be opened with the recovery passphrase or the 24-word recovery code. We know neither.
5.2 If the passphrase and the code are both lost, access to all content is lost for good. We cannot restore it — not on request, not on production of an identity document, not on official order. This is not unhelpfulness but the unavoidable other side of the fact that nobody but the user can read the content.
5.3 The app points this out expressly during setup and requires the recovery code to be confirmed before setup is completed.
6.1 The user must not distribute content through the service that infringes applicable law or the rights of third parties. In particular, the following are prohibited:
6.2 The user must ensure that they hold the necessary consent of the persons depicted in a medium before sharing it.
6.3 The service must not be used in an automated manner, for mass distribution, or with modified clients where this circumvents protective mechanisms.
7.1 The rights in shared content remain with the user. We acquire no rights of use beyond what operating the service requires.
7.2 The user grants us the non-exclusive right, unlimited in territory and limited to the term of the contract, to store the encrypted data, to reproduce it (backup copies) and to transmit it to the recipients they choose. Analysing the content is technically impossible for us and contractually not permitted.
8.1 Recipients can report a medium in the app. In doing so, the reporting user's device decrypts the medium and transmits a copy to us. That is the only way we can examine a report at all. The details are set out in our reporting procedure.
8.2 Where a report is confirmed, we may delete the medium concerned and suspend the account. In choosing the measure we take into account the nature and gravity of the infringement, whether it was repeated, and what the measure means for the user.
8.3 We inform the user concerned of the measure and its reasons, so far as we are legally able to (Article 17 Digital Services Act). They may challenge the decision at the address named in the reporting procedure.
8.4 Where an account is suspended, its data is kept for 30 days and deleted afterwards. That period exists so that a wrong decision can be corrected.
9.1 The service is currently provided free of charge. We promise no particular level of availability. We announce maintenance in the app so far as that is possible.
9.2 We may develop the service further and change or discontinue individual features, provided the purpose of the contract is preserved. Where an essential feature is permanently withdrawn, we give reasonable notice and the user may terminate the contract.
9.3 The storage quota is currently 2 GB per account. Once it is used up, no new media can be uploaded; existing media remain and stay retrievable.
10.1 We are liable without limitation in cases of intent and gross negligence, for injury to life, body or health, under the Produkthaftungsgesetz (the German Product Liability Act), and to the extent of any guarantee given.
10.2 In cases of ordinary negligence we are liable only for breach of an obligation whose fulfilment makes the proper performance of the contract possible in the first place and on whose observance the user may regularly rely (a cardinal obligation), and limited to the foreseeable damage typical of this kind of contract at the time it was concluded.
10.3 Liability is otherwise excluded. This applies in particular to:
10.4 Users back up the media they contribute themselves. They remain responsible for their own backup copies.
Where a user culpably breaches their obligations under clause 6 and claims are brought against us by third parties as a result, they shall indemnify us against those claims and reimburse the necessary costs of legal defence. We will inform them without delay and give them the opportunity to comment.
12.1 The contract runs for an indefinite period. The user may delete their account at any time in the settings; the contract ends with that.
12.2 We may terminate the contract on 14 days' notice to the end of the month. The right to terminate for cause remains unaffected; cause exists in particular where there is a serious breach of clause 6.
12.3 On deletion of the account we remove all the user's folders and media, every key envelope to and from them, their connections, the deposited encrypted key copies and their push tokens. The username then remains blocked for twelve months, so that nobody can take over an existing identity.
13.1 We will change these terms where this becomes necessary because of changes in the law, in case law, or material changes to the service.
13.2 We will give notice of a change at least six weeks in advance, in the app and by email. The change takes effect only if the user agrees to it. If they do not agree, the contract continues unchanged; we may then terminate it under clause 12.2.
14.1 German law applies. Where the user is a consumer habitually resident in another Member State of the European Union, the mandatory consumer protection provisions of that State remain unaffected (Article 6 Rome I Regulation).
14.2 Where the user is a merchant, a legal person under public law or a special fund under public law, the place of jurisdiction is Hamburg.
14.3 Should any provision of these terms be ineffective, the contract remains effective in all other respects; the statutory provisions take the place of the ineffective provision.