This policy describes what LightPaint collects, why, where it goes, and how to get rid of it. It is written to be specific rather than reassuring — if a section sounds narrow, that is because it is meant to be.
ShutterSpeed Apps is the data controller. Reach us at privacy@shutterspeedapps.com.
The short version
- Your photos and videos stay on your device. We do not upload your camera roll.
- One frame leaves your device only when you personally tap Analyze Scene.
- We do not sell your data, and we do not use it to train AI models.
- We run no advertising and no third-party analytics or tracking SDKs.
- You can delete your account and everything attached to it.
What we collect
Account information. If you sign in, we store a user record: an email address, a display name if you give one, and the identifier Apple or Google gives us for you. If you use Apple's Hide My Email, we only hold the relay address. Signing in with Apple or Google means we never receive a password.
Session tokens. We store hashed refresh tokens so you stay signed in. They are scoped per app, so a LightPaint session cannot be used against our other apps. They are hashes — we cannot read them back into a usable token.
Purchase records. When you buy something, Apple gives us a signed receipt. We store the Apple transaction identifier, the product identifier, the environment (sandbox or production), the purchase and expiry dates, and the amount and currency Apple reports. We never receive your card number, and Apple does not give us your billing address.
AI usage counters. To meter Analyze Scene we store how many analyses you have used in the current period, plus an audit row per request recording the feature, the model, token counts, latency, and whether it succeeded. We keep a history of closed monthly periods so we can answer "why did my credits reset" without guessing.
Purchased credit ledger. For consumable packs we store what was granted, what has been spent, and the Apple transaction that granted it.
AI Scene Analysis results. When you use Analyze Scene we store the analysis: the camera settings you had, the settings we suggested, the reasoning, confidence, tips, the device model and its capability limits, and any rating you give the result. See the AI Use document for the frame itself, which is handled differently.
Consent records. When you accept Terms, this policy, or the AI Use document, we store which version you accepted and when. These records are append-only — that is the point of them.
Diagnostics. Crash and performance diagnostics come to us through Apple, in aggregate, and only if you have enabled sharing in your iOS settings. We cannot tie them to you.
What we do NOT collect
- Your photo library. LightPaint reads and writes photos on your device with the permission you grant iOS; those images do not come to us.
- Your location. LightPaint does not request location permission.
- Your contacts, calendar, health data, or device identifiers for advertising.
- Any behavioural profile. We do not track you across apps or websites, and there is no advertising SDK or third-party analytics SDK in the app.
Your captures
This is the part most people are asking about, so it is spelled out.
Light painting works by blending many frames into one image. All of that happens on your device, on its GPU. The accumulated image lives in device memory and is written to the destination you choose — your photo library, or your own iCloud storage if you enable Cloud Sync. Your captures do not pass through our servers.
The single exception is AI Scene Analysis, and it is opt-in per use: nothing is sent unless you tap the button. Details are in the AI Use document.
Cloud Sync
If you enable Cloud Sync, your profiles and app settings are stored in your iCloud account using Apple's CloudKit, in a private database only you can read. We cannot see the contents of your private CloudKit database. Deleting the app or signing out of iCloud removes our access entirely.
We also publish two things into a public CloudKit database, which contain no personal data at all: these legal documents, and the subscription product catalogue. That is so the app can display them without depending on our API being reachable.
Who else sees your data
We share data with a small number of processors, each for exactly one purpose:
- Apple — purchase and subscription events, and your own CloudKit data. For in-app purchases, Sign in with Apple, and iCloud sync.
- Google — the identity token you present, and only if you choose to sign in with Google.
- Our AI provider — one frame plus camera metadata, per analysis you personally request. See the AI Use document.
- Amazon Web Services — everything we store, at rest. Hosting and database, in a US region.
We do not sell your personal information. We do not share it for cross-context behavioural advertising. There is no fourth column here labelled "advertising partners".
We will disclose data if we are legally compelled to, and we will tell you unless we are prohibited from doing so.
Where your data lives
Our servers and database run in the United States on Amazon Web Services. If you use LightPaint from outside the US, your data is transferred there. For transfers out of the UK, EU or Switzerland we rely on the European Commission's Standard Contractual Clauses.
How long we keep things
- Account record — until you delete your account.
- Session tokens — until they expire or you sign out.
- Purchase records — seven years. We are required to keep financial records.
- AI usage counters and audit rows — 24 months.
- Quota period history — 24 months.
- Purchased credit ledger — until spent, then seven years as a financial record.
- Scene analyses — until you delete your account.
- Analysed frames — not retained by default. See the AI Use document.
- Chat transcripts — until you delete them, or delete your account.
- Consent records — seven years, as the audit trail of what you agreed to.
Your rights
Wherever you live, you can ask us to:
- Tell you what we hold about you, and give you a copy.
- Correct anything wrong.
- Delete your account and its data.
- Stop processing, or restrict it, where the law gives you that right.
- Object to processing based on our legitimate interests.
Email privacy@shutterspeedapps.com. We will respond within 30 days. We will not charge you, and we will not treat you differently for asking.
Deleting your account removes your account record, sessions, scene analyses, chat transcripts and usage counters. It does not remove purchase records or consent records, which we are required to keep — those are retained with your account identifier reduced to a number that no longer resolves to a person.
If you are in the EU or UK you may also complain to your national data protection authority. If you are in California, the rights above are your CCPA rights; we do not sell or share personal information as those terms are defined there.
Legal bases (EU/UK)
- Contract — running your account, delivering what you paid for, metering it.
- Legitimate interests — keeping the service secure and preventing abuse.
- Consent — sending a frame for AI analysis. You give it per use, and you can simply not use the feature.
- Legal obligation — financial records and consent records.
Children
LightPaint is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, email us and we will delete it.
Changes
We will publish a new version of this document when it changes and the app will ask you to accept it. We keep a record of which version you accepted.
