What we keep

Everything the app stores about you, in plain English, and how long it stays. The short version from the app’s own Settings: your prints and comments stay until you delete them. Nothing vanishes on its own, and we don’t promise that it does.

Your account

Prints

One photo becomes three JPEGs — a 400px thumbnail for the wall, a 1200px one for the viewer and share card, and a 2400px one for saving to Photos — plus, if you record one, a voice note (m4a). Each is re-drawn on your phone before upload, which strips the camera’s metadata: no GPS, no device model, no time of day beyond the one you see on the print.

They live in a private storage bucket. Nothing in it has a public address; the app fetches a print with a short-lived signed link, issued only to someone on that roll. The website never shows a print — an invite page shows the roll’s cover and nothing further.

With each print: the caption, when it was taken, the pixel size of the original, which roll it is on and who took it.

Around a print

• Reactions — which emoji, from whom, on which print.
• Comments — the text (up to 500 characters), who wrote it, when.
• Views — one row per person per print they have opened, with the first and last time. This is what Seen by reads, and it is only written while you have Seen by on: with it off you are not marked as having looked at anything. It is only ever shown to members of the roll who have Seen by on themselves.

Rolls and friends

• Each roll: its name, owner, members and when they joined, its cover, and whether it is members-only or public.
• Invites: a hash of the link’s token, when it expires, how many joins it allows and how many it has had. The token itself is not kept.
• Friendships: who is friends with whom, who asked, and whether a pair is pending, accepted or blocked.

Contacts

When you look for friends from your address book, your phone hashes every email and phone number (SHA-256) and sends only the hashes. They are compared and thrown away — not stored. What is stored, for each account, is a hash of the email it signed in with and, if you add one, a hash of your phone number, so that friends who have you in their contacts can find you. A hash cannot be turned back into the number.

Notifications

A push token — the address Apple gives your phone so a notification can reach it — and whether it is a test or App Store build. Removed when you sign out or delete the account.

Usage counts

An anonymous per-install id with daily counts of a handful of events (a print taken, a roll made, and so on) and how long some of them took, so we can see what is slow. No content, no identity, no third-party analytics or advertising SDK of any kind.

How long

• Prints and comments stay until you delete them. Deleting hides them for everyone at once; the row and the files are removed by a nightly sweep after 30 days. Until then they are not visible to anyone.
• Invites expire after at most a week and are cleared 30 days after that.
• Everything else stays while the account exists and goes with it. See Your account for exactly what Delete Everything removes.
• On your phone, cached pictures and voice notes sit in a cache iOS may clear at any time; stamps you have collected are on the phone only and are never uploaded.

What we never keep

• Your address book, or any name, number or email from it.
• Where a picture was taken, or any photo metadata.
• Your photo library. The album you see when you tap upload is read on the phone; only the one picture you pick is printed.
• A password.
• Your card or any payment detail — Apple handles the purchase.
• Anything from an advertising or tracking SDK; there is none in the app.
• The raw invite token; only its hash.

For your rights and who else processes this, see Data protection and the Privacy Policy.