Your pictures are edited entirely on your device and are never uploaded. There is nowhere for them to go: this app has no account, no server of its own, and no feature that sends an image anywhere. Two things can leave the device, and only if you choose: usage measurement, if you allow it (see “Usage measurement” below), and a problem report, if you send one (see “Problem reports” below).
This policy describes the current version of the app. If it changes, the date at the top changes with it.
What is not collected
None of the following is collected, in any form, anonymised or otherwise:
- Your photos, and the information stored inside them such as when and where they were taken.
- Your name, email address or any account information. The app has no accounts and no sign-in.
- Location, contacts, the microphone, or the advertising identifier (IDFA).
- Your pictures, and anything you type into the app — the names you give saved styles, the name used for the signature. None of these is included in usage measurement either.
- Crash reports sent automatically. Nothing is sent unless you send a problem report, and a report can include crash diagnostics the system recorded on the device (see “Problem reports” below).
What is stored, on your device only
The app keeps the following on this device, so that it opens the way you left it:
- Your preferences: appearance, whether tab descriptions are shown, and the name used for the signature if you have set one.
- Styles you save yourself, held as the numeric settings that produce them. No picture is stored with them.
- Whether PRO has been purchased. That is read from Apple, and only read.
- The picture you last had open, together with the adjustments made to it, so the app can offer to carry on where you left off. Opening another picture replaces it, and declining the offer removes it.
- With PRO, the pictures behind Recent edits — up to 30, each with the adjustments it was left with — so that they can be opened again. Settings shows how much space they take and clears them at any time.
- An operations log: when the app opened a picture or exported one, how long that took, its pixel size, and error codes when something failed. It holds no pictures, file names or text you typed. It is capped in size and is not sent anywhere unless you send a problem report.
All of it stays on the device and is removed when the app is deleted. The purchase itself is held by Apple against your Apple Account, which is what makes it restorable after a reinstall.
Photos
- Pictures come in through the system’s own photo picker. Only the picture you choose is handed to the app, and the app is not given access to your photo library.
- Saving a finished picture asks for permission to add to Photos. The app only adds; it does not read what is already there.
- A picture sent to the app from another app’s share sheet is placed in the app’s own private storage on the device, and is replaced the next time one arrives.
What leaves the device
- With usage measurement off and no problem report sent, the app makes no network connection of its own at all. With measurement on, the events listed below are sent to Google. A problem report goes to the developer’s own server, and only when you send it. Never an image in either case.
- Purchases and restores are handled by Apple through the App Store, and Apple’s privacy policy applies to that exchange.
- If you hand an exported picture to another app or service through the share sheet, what happens to it after that is governed by that app or service and not by this policy.
Children
The app does not ask anyone for personal information and asks no age. The only personal information it can ever send is what a person writes into a problem report themselves, such as an optional contact e-mail address.
Usage measurement
The app can report how it is used, so that it can be improved where it is actually used. This is off unless you turn it on. You are asked once, and you can change the answer at any time in Settings › Privacy › Help improve the app. Turning it off stops the reporting immediately; nothing is held back and sent later.
The measurement uses Google Analytics for Firebase. What is sent goes to Google and is handled under Google’s privacy policy as well as this one.
- What is sent: which tab you opened, which look or pattern you applied, which control you changed, whether a locked control was met, and how an image left the app (saved to Photos or shared, and at what size).
- An app instance ID that Firebase generates for this installation. It is not the advertising identifier (IDFA) — this app does not contain the advertising framework at all.
- Your device model, its iOS version, and an approximate region derived from the network address.
- What is never sent: your images, anything about your images, and any text you have typed into the app.
Every value sent is chosen from a fixed list built into the app, so free text cannot end up in it. The data is used only to understand which features are used; it is not used for advertising and not used to track you across other apps or websites. It is kept for 14 months and then deleted automatically.
Problem reports
The app keeps an operations log on your device. Nothing in it leaves the device unless you open Settings › Report a Problem and press Send. The screen says what will be sent before you do.
What is sent:
- The message you typed, and the contact address if you chose to give one.
- Your device model, iOS version and app version, and the app’s settings.
- The operations log: what the app did, how long each step took, picture sizes in pixels, and error kinds. Never your pictures, anything in them, file names, or text you typed into the app (such as style names).
- Crash and hang diagnostics that iOS recorded for this app on the device, if any.
The report is encrypted on the device with a key whose private half only the developer holds, so it cannot be read in transit or by the hosting provider. To limit abuse, the server also sees the network address the report came from and checks, using Apple’s App Attest, that the report comes from a genuine copy of this app; the address is used for rate limiting only. A report that cannot be delivered is kept encrypted on the device and retried later. It is used only to investigate the problem you described, and is not used for advertising or tracking.
Changes to this policy
Changes are posted on this page, with the date at the top moved to match.
Contact
Questions about this policy go to the support address shown on the app’s App Store page.