Service operator and data controller: Osura Perera. Contact: contact@abiogenesisapps.com.
01. Data we handle
Your device profile contains a display name, an optional profile photo you choose, cloud-upload preference, and a random account credential stored in iOS Keychain. Our server stores a hash of that credential, rather than the credential itself. When configured, optional Sign in with Apple connects this profile to an Apple identifier for recovery on another device. We store the Apple identifier and server-side authorization token needed for revocation, plus application sessions. When Apple supplies a verified email address, we may store it for account contact, including a private relay address. Matching email text does not automatically merge Apple and email accounts. On web, you can set a password after verifying your email. Passwords are stored as salted Scrypt hashes; plaintext passwords are not stored in our authentication database. Passwords travel over HTTPS for sign-in, while password setup and recovery codes are delivered by Resend. Setting or resetting a web password signs out older sessions. Native session credentials are stored in iOS Keychain. The browser app stores a random profile credential in a Secure, HttpOnly, same-site cookie. It is not available to page JavaScript. Without a connected login, clearing this cookie loses browser-profile access. When email delivery is configured, you can connect an email address using a one-time code and recover the same account in the browser or iOS app. Resend receives the destination address and sign-in code to deliver that email. Codes expire after 10 minutes, are single-use and are stored as hashes by Convex Auth. Expired challenges and abandoned unverified email identities are cleaned up by a scheduled task. Signed-in browser sessions use separate Secure, HttpOnly, same-site access and refresh cookies. Session credentials are never stored in browser localStorage. Web Apple sign-in is not enabled yet. We do not request your Apple name.
We store events, guest display names, albums, invite codes, and photos you submit, with capture time, image dimensions, camera mode, and filter information. Your optional profile photo is resized and re-encoded by the app, stored privately for your account and displayed in your own home and Settings screens. It is separate from the shared gallery and event photo allowance. You can change or remove it in Settings; account deletion removes the stored profile photo. Sign in with Apple does not provide an Apple Account profile photo. Photos may contain personal information in their visible content or embedded metadata. Only upload photos you have permission to share. Photos you send follow the session’s sharing and reveal settings. When immediate sharing is enabled, new guest uploads need no routine host approval and a report removes shared access pending operator review. Older pending guest photos remain visible only to the uploader and host until approval. Keep invite codes within the group you intend to invite.
Network providers process technical information such as IP addresses and operational logs to deliver and protect the service. Camera access is requested to take pictures. Photo-library add access is used only when you choose to save a picture. No contacts or microphone permission is requested. Optional foreground location access in the iOS app loads nearby Apple Weather conditions; approximate location is sufficient. Coordinates are used for the WeatherKit request to Apple, kept out of picture.us event records and never shared with album members. We do not track location in the background. You can deny or revoke location permission in iOS Settings. A host can instead save an event city for weather, visible to event members; this is separate from the location text on the cover. The browser camera is requested only when you choose Open camera; choosing a device photo uses the browser file picker.
Feedback and service monitoring
Feedback submitted in Settings is visible only to the service owner. Your verified email is included for replies if connected. Incoming support email, when connected through Resend, is listed using its sender, subject and delivery reference. Original email bodies stay in Resend; attachments are not imported. Operational monitoring stores route names, response durations and aggregate error/access-denial counts for seven days. It excludes photo content, request bodies, credentials, IP addresses and location. Owner access requires the configured verified account email.
02. Purpose and legal grounds
We use profile, event, and photo data to provide the service you request, including storing your submitted memories, responding to exports, and deleting your account. Where GDPR applies, this is necessary to perform our agreement with you. Security and service-operation data are processed for our legitimate interests in maintaining a reliable, secure service, subject to your rights. Optional device permissions are controlled through iOS and can be withdrawn there.
03. Choices that work
In Settings → Privacy & data you can disable future cloud uploads, export your profile and records as JSON with links to your uploaded photos, or permanently delete your device account. Turning uploads off does not delete earlier uploads. Download photos from your export before deleting your account. Locally saved copies in Photos remain under your control.
The app does not include advertising, cross-app tracking, or optional analytics SDKs. Public pages use no analytics scripts or third-party fonts. Creating a browser profile sets an essential cookie for access, not tracking. When you choose to send a photo, a temporary copy is kept in this browser’s IndexedDB upload queue until the server confirms it, or until you remove it. The queue is bounded to 30 photos and 100 MB per profile. It is not a permanent backup. Queued copies are removed after a successful deletion request; other browser data can be cleared using browser controls. Essential host security logs may still be processed.
04. Access and service providers
When you choose to order a physical album and approve sending the reviewed PDF, picture.us gives Peecho temporary access to that PDF to prepare and fulfil your print order. The gallery itself remains private. Unpaid production links expire within seven days, or the event download deadline if earlier, and files are removed in scheduled batches. Paid production files may remain for active fulfillment. A content safety hold can stop future delivery while the operator reviews the order; this does not itself cancel or refund a payment. Your personal order record contains book title, page count, status and printer references. Checkout links are private capabilities: do not share them. Peecho collects your delivery address, email and payment details directly in its checkout and processes order data under its own privacy policy. Copies already sent to the printer, transaction records and legally required retention are controlled by the printer and are not erased by deleting picture.us.
Convex hosts the app database, uploaded photo files, and these policy pages as a service provider. Data is transmitted over HTTPS. The app uses a device credential or an Apple-linked session when Apple sign-in is configured. Invitation links and event codes let picture.us iOS users and browser guests join shared sessions. Gallery access requires session membership. Browser guests can contribute from iPhone, Android, or desktop. Anyone with a valid invitation can join, so share codes only within your intended group. Anyone with a copy you choose to share or a photo download link may keep a copy outside the service.
Hosting may involve processing outside your country, including the United States. Before public release, the operator must confirm the deployment region, provider agreements, and any required international-transfer safeguards. These draft policies do not assert that those steps have been completed.
05. Retention and deletion
Active profile data remains until you delete the account. For events with a displayed download deadline, photo access ends 30 days after closure and cleanup removes their files and albums in batches. Legacy events without a displayed deadline are not silently enrolled. Deletion immediately disables account access and future uploads, then removes the profile, owned events, albums, guests, invites, photo metadata and stored photo files in background batches. Necessary payment provenance and active print-fulfillment records remain separately, with direct profile/authentication links removed; original opaque financial identifiers can remain as described below. The app confirms completion only after the account is removed.
Copies you or others saved outside picture.us are not removed. Provider backups and security logs may persist according to provider retention and applicable law; their retention must be confirmed before public release. Existing legacy shared-demo data is separate from newly created device profiles and cannot be claimed or erased by a new profile.
06. Your rights
Depending on applicable law, you may request access, correction, erasure, portability, restriction, or object to processing. Change your display name, export your records, or delete your account directly in Settings. Other requests can be sent to the operator using the contact above once confirmed. You may complain to your local data protection authority, including IMY in Sweden. Where GDPR applies, requests are generally answered within one month, subject to permitted extensions.
07. Children and policy changes
The current test app is intended for adults and is not directed to children. Do not create profiles for children or upload children's personal information without appropriate permission. Material changes will be described in an updated policy and, when required, brought to your attention in the app.
Photo safety and host review
Do not upload unlawful, exploitative, abusive or infringing material. In Gallery, open another person's photo to report and hide it for yourself or block that person. Blocking hides their photos for you across events; it does not remove their account. Manage your blocks from Gallery. Reporting immediately hides the photo from the group pending operator review, including existing album and download access. The operator can dismiss a report or remove the photo; your personal report hide remains in place. The host can reject event photos or remove a contributor from that event. These actions do not restore photo credits.
New guest uploads share immediately after joining, subject to the event’s reveal settings. Routine host approval is not required. Older photos already awaiting host review keep that status until reviewed. Each submitted photo uses one credit, including pending or rejected submissions. Approved photos still follow the event's reveal settings. Look for the Waiting for host approval badge and refresh the gallery after review. Existing events are not silently switched to this policy. Reports trigger a shared-access hold and human operator review, not automated image classification; images are not automatically pre-screened before sharing.
The operator can hide a reported photo and restrict an abusive account's future uploads. Reports and blocks are private account records; report details are visible to the operator, not other guests. No separate copy of the image is retained as report evidence. Associated report records are removed when the image or related account is erased. Removal or blocking cannot erase photographs, PDFs, printer copies or storage links already saved outside the service. Physical checkout stays closed for events using host approval until print-file content can be verified.
Event download deadlines
When your event displays a download deadline, photo access ends 30 days after the event closes. Save your photographs and album PDFs before that deadline. Cleanup then removes event photo files and albums in batches. Events without this prospective policy are not automatically enrolled or deleted under it. Reminder emails 7 days and 1 day before expiry are sent only when reminders are configured and the host has a verified contact email; the app states when reminders are unavailable. Keep the displayed deadline yourself. Necessary paid-order records and active printer fulfillment may remain separately; downloaded copies outside the service remain outside our control.
Prepared trial and paid-session policy
New-session enrollment and public sales remain disabled pending production policy, operator and payment review. When enabled, a host can explicitly choose an eligible one-time 20-photo group trial, 120 / 500 / 1,500 paid photos, or existing paid balance. Unlimited friends share the pool. Choose +10 / +20 / +50 / +120 / +500 / +1,500 at any time before the session closes; every pack works with the trial. Draft pack prices are USD1.49 / 2.49 / 4.99 / 9.99 / 39.99 / 109.99; native localized storefront prices and the server web quote govern the reviewed purchase. Trial conversion adds paid capacity: 20 trial + 120 paid = 140 total, less accepted uploads. Legacy 36-photo preview events and historical purchased balances keep their existing rules.
Trial participation requires a verified identity and explicit acceptance, including guests. Once anyone shares the first photo, consenting participants use their one-time trial eligibility. An invitation, a name or typed email alone never accepts the trial. Browser trial guests use verified email; Sign in with Apple is available in the iPhone app and does not require sharing an email address. Paid QR guests can use paid capacity without accepting a trial.
The host starts the session; its first successful shared photo starts 48 hours for uploads. Invitations, cover images, planned dates and opening without a shared photo start no clock. Accepted uploads count even after deletion or host rejection. Photo and album downloads end 30 days after actual close, followed by cleanup in batches. Unspent paid value does not expire; it is separate from hosted-photo retention. Postponing an empty session keeps its invitation and allocation. Empty cancellation releases unused trial reservations and paid value. After use, close and carry unused paid photos into another session. A used session cannot restart and date edits cannot extend its window.
Postpone, cancel and request refund are different actions. A request is not a confirmed refund. Stripe requests remain pending merchant review; no automatic payout is made. Apple purchases use Apple's original purchase refund route in the iPhone app or Apple purchase support, and Apple decides. Confirmed original-provider refunds remove remaining value wherever allocated, while already accepted photos keep their normal download deadline. Do not repurchase while a payment is awaiting confirmation.
Trial eligibility and financial records after deletion
To enforce one-time trial eligibility, the service derives server-keyed HMAC markers from verified email and/or native Apple identifiers. These markers do not contain plaintext contact or provider identifiers, but remain personal data, not anonymous data. A minimal used-trial marker survives account and event deletion and currently has no automatic expiry. An unused reservation can remain tied to a live group until use or cancellation resolves it. Deletion removes account consent links and does not reset eligibility for an already-used trial.
Purchase provenance, original opaque account and event identifiers, financial ledgers, accepted-upload debits and refund/retry records can remain after profile, authentication and media erasure. These records prevent duplicate delivery and reconcile late payments, carry-forward and original-provider refunds. They remain personal data. Paid value belonging to an erased account is not automatically assigned to a new account; original-purchaser recovery requires support verification. The production retention periods, legal basis, access controls, erasure exceptions and operator review procedure require approval before public rollout. This description does not assert that legal compliance review is complete.
Private feedback and support
Settings → Send feedback saves your message, topic and any connected verified email in the private owner service desk. Only the verified service owner can read or prioritise these reports. When enabled, Resend sends the owner a notice containing an opaque report ID, without copying the message, your email, photos or attachments. A notice accepted by the mail provider is not proof it reached the inbox. Support email originals remain with Microsoft 365. When the owner connects mailbox monitoring, new Inbox messages can be copied to the private service desk: sender, subject and up to 3,000 characters of plain text. Attachments and old mailbox history are not automatically imported. Suggested priorities use fixed rules; support messages are not sent to an external AI service. The owner can save reply drafts here and review and send them in Outlook. The connection uses read-only mailbox permission and encrypted server-held tokens; it cannot send email. Feedback is separate from App Store ratings and never determines who may leave a public review.