Privacy Policy

The short version

- Your photos and videos stay on your device. We do not upload your camera roll. - One frame leaves your device only when you personally tap Analyze Scene. - We do not sell your data, and we do not use it to train AI models. - We run no advertising. We use Google Analytics for Firebase to count how the app is used, never tied to your name or email, and on Android Firebase Crashlytics to fix crashes. - You can delete your account and everything attached to it, in the app or at shutterspeedapps.com/account-deletion.

What we collect

Account information. If you sign in, we store a user record: an email address, a display name if you give one, and the identifier Apple or Google gives us for you. If you use Apple's Hide My Email, we only hold the relay address. Signing in with Apple or Google means we never receive a password.

Session tokens. We store hashed refresh tokens so you stay signed in. They are scoped per app, so a LightPaint session cannot be used against our other apps. They are hashes: we cannot read them back into a usable token.

Purchase records. On iPhone and iPad, Apple gives us a signed receipt when you buy something. We store the Apple transaction identifier, the product identifier, the environment (sandbox or production), the purchase and expiry dates, and the amount and currency Apple reports. On Android, Google Play gives us a purchase token. We store a one-way hash of it (never the token itself), the Google Play order number, the product identifier and the subscription dates, and we confirm the purchase with Google Play before granting anything. We never receive your card number, and neither Apple nor Google gives us your billing address.

AI usage counters. To meter Analyze Scene we store how many analyses you have used in the current period, plus an audit row per request recording the feature, the model, token counts, latency, and whether it succeeded. We keep a history of closed monthly periods so we can answer "why did my credits reset" without guessing.

Purchased credit ledger. For credit packs we store what was granted, what has been spent, and the purchase that granted it.

AI Scene Analysis results. When you use Analyze Scene we store the analysis: the camera settings you had, the settings we suggested, the reasoning, confidence, tips, the device model and its capability limits, and any rating you give the result. See the AI Use document for the frame itself, which is handled differently.

Community. If you share to the Community (a look, a scene, a photo or video, a comment, or your public profile), what you share is public, along with your display name and avatar. We keep reports you file and reports filed about what you shared, so moderation can work.

Consent records. When you accept Terms, this policy, or the AI Use document, we store which version you accepted and when.

Push notifications. If you allow notifications, we store your device's push token so we can tell you about replies and moderation decisions. On Android this token comes from Firebase Cloud Messaging.

Usage analytics. Both apps send usage events (screens opened, features used, how long a capture took) to Google Analytics for Firebase, along with the device model, operating system and app version, language, and an approximate region that Google derives from your IP address. We never send your name, email, account identifier or photos to it. On Android, Google's SDK can also read your device's advertising ID unless you have deleted it in Android settings; we do not use it for advertising or share it with advertisers.

Crash reports (Android). Android release builds send crash reports to Firebase Crashlytics: the device model, Android version, app version, an installation identifier and the code location of the crash. We scrub emails and tokens from the log lines we attach. On iPhone and iPad, crash and performance diagnostics come to us through Apple, in aggregate, and only if you have enabled sharing in iOS settings.

App integrity (Android). The Android app asks Google Play Integrity to vouch that a request comes from a genuine copy of LightPaint installed from Google Play. This protects our Firebase data and the Community from scripted abuse. It carries no personal data of yours.

Server logs. Our servers log each request: the time, the address it came from, the app version, and the path requested. We keep these logs for 14 days.

What we do NOT collect

- Your photo library. LightPaint reads and writes photos on your device with the permission you grant; those images do not come to us. - A location history. On iPhone and iPad, LightPaint does not request location. On Android, if you allow location, LightPaint tags each capture with where it was taken, on your device, as a camera app does; Android's geocoder (a Google service) turns the coordinates into a place name. That location is not sent to us unless you share a capture that carries it. - Your contacts, calendar, or health data. - A profile of you for advertising. We do not track you across other companies' apps or websites, and there is no advertising SDK in the app.

Your captures

This is the part most people are asking about, so it is spelled out.

Light painting works by blending many frames into one image. All of that happens on your device, on its GPU. The accumulated image lives in device memory and is written to the destination you choose: your photo library or gallery, or your own cloud storage if you enable Cloud Sync. Your captures do not pass through our servers.

The two exceptions are your choice each time: AI Scene Analysis, which sends one frame only when you tap the button (details in the AI Use document), and anything you share to the Community.

Cloud Sync

On iPhone and iPad, your profiles and app settings are stored in your iCloud account using Apple's CloudKit, in a private database only you can read. We cannot see the contents of your private CloudKit database. Deleting the app or signing out of iCloud removes our access entirely.

On Android, Cloud Sync stores your profiles and app settings in our Google Firebase project (Cloud Firestore and Cloud Storage), in a space that only your signed-in account can read or write. Unlike iCloud, this storage belongs to us, so we could technically access it; we do not, except to delete it when you delete your account or when the law requires it.

We also publish things into a *public* database that the apps read: these legal documents, the help pages, the subscription product catalog, and what people share to the Community. On Android that public data is copied into Firebase so the app can read it.

Who else sees your data

We share data with a small number of processors, each for a stated purpose:

- Apple: purchase and subscription events, and your own CloudKit data. For in-app purchases on iPhone and iPad, Sign in with Apple, and iCloud sync. - Google: on both platforms, Google Analytics for Firebase (usage analytics) and the identity token you present if you sign in with Google. On Android also: Google Play Billing (purchases), Firebase Authentication, Cloud Firestore and Cloud Storage (Cloud Sync and the Community), Firebase Cloud Messaging (notifications), Firebase Crashlytics (crash reports) and Play Integrity (app integrity). - Our AI provider: one frame plus camera metadata, per analysis you personally request. See the AI Use document. - Amazon Web Services: everything we store on our servers, at rest. Hosting and database, in a US region.

We do not sell your personal information. We do not share it for cross-context behavioral advertising. There is no column here labeled "advertising partners".

We will disclose data if we are legally compelled to, and we will tell you unless we are prohibited from doing so.

Where your data lives

Our servers and database run in the United States on Amazon Web Services, and our Firebase data is stored by Google in the United States. If you use LightPaint from outside the US, your data is transferred there. For transfers out of the UK, EU or Switzerland we rely on the European Commission's Standard Contractual Clauses.

How long we keep things

- Account record: until you delete your account. - Session tokens: until they expire or you sign out. - Purchase records: seven years. We are required to keep financial records. - AI usage counters and audit rows: 24 months, or until you delete your account. - Quota period history: 24 months, or until you delete your account. - Purchased credit ledger: until you delete your account. - Scene analyses: until you delete your account. - Analyzed frames: not retained by default. See the AI Use document. - Chat transcripts: until you delete them, or delete your account. - Community posts, comments and profile: until you delete them, or delete your account. - Consent records: until you delete your account. - Android Cloud Sync data: until you delete it, or delete your account. - Server logs: 14 days. - Usage analytics and crash reports: kept by Google, at most 14 months for Analytics and 90 days for Crashlytics, and never linked to your account.

Your rights

Wherever you live, you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything wrong.
• Delete your account and its data.
• Stop processing, or restrict it, where the law gives you that right.
• Object to processing based on our legitimate interests.

Email privacy@shutterspeedapps.com. We will respond within 30 days. We will not charge you, and we will not treat you differently for asking.

Deleting your account. In the app, choose Delete Account in your account settings. If you no longer have the app, follow shutterspeedapps.com/account-deletion or email privacy@shutterspeedapps.com from the address on your account. Deleting your account removes your account record, sessions, push tokens, scene analyses, chat transcripts, usage counters and credits, consent records, everything you shared to the Community, and on Android your Cloud Sync data in Firebase. Your purchase records are kept for seven years because we are required to keep financial records; they stay attached to a number that no longer resolves to a person. Reports other people filed about something you shared are kept, without your content, so a moderation decision can still be explained. Deleting your account does not cancel a subscription: cancel it in your App Store or Google Play account.

If you are in the EU or UK you may also complain to your national data protection authority. If you are in California, the rights above are your CCPA rights; we do not sell or share personal information as those terms are defined there.

Legal bases (EU/UK)

- Contract: running your account, delivering what you paid for, metering it. - Legitimate interests: keeping the service secure and preventing abuse, usage analytics and crash reports to fix and improve the app. - Consent: sending a frame for AI analysis, and tagging captures with your location on Android. You give each per use, and you can simply not use the feature. - Legal obligation: financial records.

Children

LightPaint is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, email us and we will delete it.

Changes

We will publish a new version of this document when it changes and the app will ask you to accept it. We keep a record of which version you accepted.