Privacy Policy

Effective 13 October 2026

Draft: the bracketed details below are blanks in web/lib/legal.ts and need filling before this page is relied on.

This policy covers the Probably Late iOS app and the websites at probablylate.app, probablylate.com. The controller is [Company legal name], [Registered address]. The plain-English version is What we keep; this is the complete one.

1. What we collect, and why

Account

• Sign-in identity. When you sign in with Apple or Google, the provider gives us a signed token and the email address on the account (Apple may give a private relay address; that is fine). We use it to create and recognise your account. We never receive or store a password. Basis: performance of our contract with you.
• Profile. Username, display name, bio, profile photo, banner, and an avatar tint. These are public: they appear to anyone in the app and on your page at https://probablylateapp.vercel.app/your-handle. Basis: contract.
• Plus status. Whether you have Probably Late Plus and when it ends, so friends’ phones can show your badge. We do not receive your payment details; Apple handles the purchase. Basis: contract.

Content

• Prints. Each photo is re-drawn on your phone into three JPEGs (400, 1200 and 2400 pixels on the long edge), which removes all camera metadata including location, and is uploaded with its caption, the time it was taken, its original pixel size, the roll it is on and who took it. A voice note, if recorded, is uploaded as an m4a. Files are kept in a private storage bucket and served only through short-lived signed links to members of the roll. Basis: contract.
• Reactions, comments and views. Which emoji you reacted with, the text of comments you write, and — only while you have Seen by switched on — which prints you have opened and when. Basis: contract; Seen by on your consent, withdrawable in Settings.
• Rolls, members and invites. Each roll’s name, owner, members, cover and visibility; for an invite, a SHA-256 hash of the link token, its expiry, its use limit and its use count. Basis: contract.
• Friends. Who you are friends with, who asked, and whether a pair is pending, accepted or blocked. Basis: contract.

Finding friends from Contacts

Only if you allow access to Contacts. The app hashes each email address and phone number in your address book on the phone (SHA-256; emails lower-cased, numbers reduced to digits, with and without a country code) and sends the hashes, which are compared against the accounts here and then discarded — they are not stored. For your own account we keep a hash of your sign-in email, and, only if you add one, a hash of your phone number, so that friends who have you in their contacts can find you. No name, number or email from anyone’s address book is ever uploaded. Basis: your consent, withdrawable by turning off Contacts access in iOS Settings.

Notifications

If notifications are allowed, your phone registers a push token with us so that we can send you a friend request, a comment on your print, a new print on a shared roll, or an occasional notice from us. The token is deleted when you sign out or delete the account. Basis: contract; you can stop it in iOS Settings at any time.

Usage counts

The app counts a handful of events per day (a print taken, a roll made, and so on) and measures how long some of them take, against an anonymous per-install identifier that is not linked to your account. There is no third-party analytics, advertising or crash-reporting SDK in the app. Basis: our legitimate interest in keeping the app working and fast.

The website

The websites read two things without a sign-in: an invite’s preview (a roll’s name, cover, inviter, counts and a few member faces without names) and a public profile. Neither returns a print. Our host, Vercel, keeps ordinary server logs (IP address, user agent, URL, time) for a short period for security. The sites set no cookies and run no analytics.

Permissions the app asks for

• Camera — to take polaroids.
• Microphone — only when you record a voice note.
• Contacts — only for Find friends, as above.
• Photos — to save a print to Photos, and to show your album inside the app when you tap upload. The album is read on the phone only; nothing leaves it but the one picture you pick, re-drawn through a look. You can grant access to selected photos only.
• Notifications — as above.
• NFC — only when you tap “Tap to Collect” to read a cap’s chip for a stamp. Stamps stay on the phone.
• Bluetooth and local network — only in Hook Up and Trade, to find another phone nearby running the app. Nothing is sent to us.
• Motion — to tilt the shine on a stamp. Never recorded.

2. What we do not do

• We do not sell personal data, and we do not share it with advertisers. There is no advertising.
• We do not track you across other apps or sites.
• We do not read your photo library or your address book.
• We do not record where a picture was taken.
• We do not use your content to train models or for anything other than showing it to the people you chose.

3. Who else processes it

Each processes data on our instructions under its own terms. We disclose data otherwise only when the law requires it, or to protect someone from serious harm.

4. Where it is kept

The database, authentication and files are in one Supabase project in [Supabase region — check Project Settings → General]. The websites are served by Vercel’s global network. Apple and Google process sign-in and notifications in their own regions. Where a transfer leaves your region, it is covered by the processor’s standard contractual terms.

5. How long

• Account, profile, friendships, Plus status, contact hashes: while the account exists.
• Prints, voice notes, comments: until you delete them. A deleted item is hidden at once and permanently removed, files included, by a nightly sweep after 30 days.
• Views: until the print is removed or the account is.
• Invites: at most a week live; removed 30 days after expiry.
• Push tokens: until sign-out or deletion.
• Usage counts: anonymous; kept for the life of the project.
• When you delete your account, everything above goes with it immediately, except that a roll you own which has other members passes to its longest-standing member, and print files are cleared by the next sweep.

6. Your rights

Depending on where you live you have the right to access, correct, delete, export and restrict the use of your data, to object to processing, and to withdraw consent. In the app: Edit Profile corrects; Save to Photos exports a print; Settings → Danger Zone → Delete Everything deletes. For anything else, write to [privacy@example.com] from the address you signed in with. We answer within a month. You can also complain to your local data-protection authority.

7. Children

The service is not for anyone under 13. We do not knowingly collect data from them; if you believe we have, tell us and we will delete it. Read receipts (Seen by) are off by default for everyone, notices are capped and quiet overnight, and there is no public feed — see the Parent Centre.

8. Security

Every database table has row-level security switched on with no direct access; the app reaches data only through functions that each do one thing and check who is asking. Prints are in a private bucket behind expiring signed links. Invite tokens and contact matches are stored as hashes. Traffic is encrypted in transit. No system is perfect; if we learn of a breach that affects you we will tell you and the authorities as the law requires.

9. Changes

If this policy changes in a way that matters we will update the date at the top and tell you in the app. Older versions are available on request.

10. Contact

[Company legal name]
[Registered address]
Data protection: [privacy@example.com]
Everything else: info.probablylate@gmail.com