Privacy policy
Effective 25 August 2026
The short version
- We do not run ads, and there are no advertising or tracking SDKs in the app.
- We do not sell or share your personal information, and we never will.
- Your photos belong to the roll you shot them on. They are not published anywhere.
- We never train any model on your photos, and no AI touches them.
- Location is used only while a roll is live, only to work out who is together, and is never stored after that roll ends.
- You can delete your account from inside the app. Frames you shot on a roll that has already developed stay with that group — section 9 says exactly what goes and what does not.
- Who we are
- What we collect
- Your photos
- Location
- What we never do
- Who we share data with
- Where data lives, and how long
- Your choices and rights
- Deleting your account
- Children
- Security
- Changes to this policy
- Contact
1. Who we are
Us Roll is an iPhone app made by Flywheel Studio. Flywheel Studio is the data controller for the personal data described here. This policy covers the Us Roll app and this website. It does not cover any other site we link to.
2. What we collect
Everything in this table is listed in the app's privacy manifest and in its App Store privacy labels. Nothing here is used for advertising or cross-app tracking.
| What | Why |
|---|---|
| Your name and email, from Sign in with Apple | To create your account and let your friends recognise you on a roll. If you use Apple's Hide My Email, we only ever see the relay address Apple gives us. |
| Your emoji and first name, which you pick | This is your identity inside the app. It is what credits your frames in an album. |
| Photos you take in the app | The product. See section 3. |
| Roll membership — which rolls you are on, who else is on them, how many frames you shot, and when | To run the shared roll, credit each frame, and open the album to the right people at the right time. |
| Coarse location, only while a roll is live | To work out who is together. See section 4. |
| A device identifier — a random ID we generate and keep in your iPhone's Keychain | To tell your devices apart, so an iPhone and an iPad do not overwrite each other's settings. It is not Apple's advertising identifier, and it is not used for advertising. |
| Device and app details — model, iOS version, app version and build, language, time zone, and which permissions you have granted | To support the app, to know which iPhones and iOS versions to test against, and to show the right thing when a permission is off. |
| Usage events — when you open the app, and which steps of a flow you reached (for example: paywall viewed, roll created, album opened) | To see where the app confuses people and fix it. Collected only in App Store builds. |
| Performance data — launch time, request latency, memory and CPU use | To find and fix what is slow or crashing. Collected only in App Store builds. |
| Purchase status — whether you have an active subscription or pass | To unlock hosting for people who have paid, and to restore purchases on a new phone. We never see your card. Apple handles the payment. |
What our analytics does not capture
Our product analytics records a screen's shape — how deep it is, what kind of view it is, roughly how big, and whether it contains any text at all — as a way of telling one screen from another. It records a yes-or-no for text; it never records the text. It does not take screenshots or thumbnails, and no on-screen wording, message, name, or photo is sent through it. Analytics is switched off entirely outside App Store builds — in a debug, simulator, or TestFlight build the SDK is never started.
3. Your photos
- They stay on their roll. A photo you take is visible to the people on that roll, and to nobody else. There is no public feed and no way for a stranger to find a roll.
- Nobody sees them early — including us. Before a roll develops, our server rules refuse every read of its photos. The lock is enforced on the server, not just hidden in the app.
- They are not edited. No filter, no enhancement, no generation, no restoration. The file you get is what the camera produced.
- They do not train anything. We do not use your photos to train, fine-tune, or evaluate any machine-learning model, and we do not give them to anyone who does.
- Sharing inside a roll. By shooting on a roll you let the other people on that roll view, save, and share the frames you took, for their own personal use. That is what a shared roll is. Do not shoot something you are not willing for the group to keep.
- Getting one taken down. Write to privacy@usroll.app with the roll and the frame, and we will remove it. If a frame is abusive we remove it and suspend the account that shot it. Both the photographer and the host will be able to remove a frame from inside the album; that control is not in the app yet, so email is the route today.
4. Location
Location is the app's most sensitive surface, so here is exactly how it is handled.
- Us Roll asks for "While Using the App" location. It never asks for Always, and it never runs location in the background outside a live roll.
- Location is read only while a roll is live, to answer one question: are these people together. Between rolls, the app requests nothing from your phone's location services.
- We use it to decide whether someone may join the roll they were invited to, and to tell when the group has broken up.
- Your position is never shown to other people. Nobody on a roll sees where you are, only whether you are in or out of the circle.
- We do not keep a location history. Coordinates are held for the life of the roll and discarded when it ends. We do not store precise coordinates in your profile — what we keep there is whether the permission is on or off, not where you were.
- Location is never sold, never shared with a data broker, and never used for advertising.
- If you say no, you can still use the app. You will not be able to join a roll that needs a proximity check.
5. What we never do
- No advertising. There are no ads in Us Roll and no ad SDKs in the binary.
- No cross-app tracking. Nothing we collect is joined with data from other companies' apps or sites for advertising or measurement. That is why Us Roll never shows you Apple's tracking prompt — there is nothing to ask permission for.
- No selling or sharing. We do not sell personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act. We have never done so.
- No reading your camera roll. The app does not request access to your photo library to shoot. Every frame is captured live, inside the app.
- No training on your content. Stated again because it matters.
6. Who we share data with
We use a small number of service providers to run the app. They process data on our instructions and for no purpose of their own. This is the whole list.
| Provider | What it does for us |
|---|---|
| Google (Firebase) | Sign-in, the database of rolls and accounts, photo storage, server-side logic, abuse protection, remote configuration, and performance monitoring. This is where your account and your photos live. |
| Apple | Sign in with Apple, and all payment processing for subscriptions and passes. We never receive your payment details. |
| RevenueCat | Keeps track of whether your subscription or pass is active, so hosting unlocks on every device you sign in on. |
| ULink | Turns an invite into a link that opens the right roll, including after you install the app for the first time. |
| AnalyticsDrop, operated by Flywheel Studio | Product analytics — the usage events in section 2. Our own service, not a third-party ad platform. |
We will also disclose data if the law requires it — a valid legal request, a court order — or to protect someone's safety. If Flywheel Studio is ever acquired, your data may transfer to the buyer, who would be bound by this policy until they give you notice of a new one.
7. Where data lives, and how long
- Data is stored on Google Cloud infrastructure. If you are outside the United States, your data is transferred to and processed in the United States. We are putting the data processing agreements that cover transfers out of the UK and the EEA in place with each provider named in section 6, and this policy will name the mechanism once they are signed.
- Photos and rolls stay until you delete them or delete your account.
- Your account record stays while your account is open.
- Location is discarded when the roll it belonged to ends.
- Usage and performance data is kept in aggregate for up to 14 months, then deleted.
- Purchase records are kept as long as tax and accounting law requires.
8. Your choices and rights
Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it. Write to privacy@usroll.app and we will answer within 30 days.
- In the app: turn location off in iOS Settings, change your emoji and name, delete a frame you shot, hide a frame from your own view, or delete your account.
- UK and EEA (GDPR): you have the right to access, rectify, erase, restrict, object, and port. Our lawful bases are performing our contract with you (running the app), your consent (location), and our legitimate interests (keeping the service working and secure). You may complain to your local supervisory authority.
- California (CCPA/CPRA): you have the right to know, delete, correct, and opt out of sale or sharing. There is nothing to opt out of — we do not sell or share personal information. We will not discriminate against you for exercising any right.
9. Deleting your account
You can delete your account from inside the app, and you do not have to email anyone to do it. Deleting your account removes:
- your account record — your name, your email, and your emoji;
- every device record we hold for you, including the device identifier;
- you, from any roll that is still live at the time.
It also ends your sign-in: we delete the account with our sign-in provider and revoke the grant on Apple's side, which is what stops us from being able to identify you again.
What deleting your account does not remove
Be clear about this before you delete, because we cannot undo it afterwards.
- Frames you shot on a roll that has already developed stay on that roll, credited to you. A developed album belongs to the group who shot it, and pulling one person's frames out of it would take photos away from everyone else who was there. If you want your frames removed too, email privacy@usroll.app before you delete the account — once the account is gone we can no longer prove the frames were yours.
- Photos other people took on a roll you were on are their frames, not yours, and stay.
- Anything a participant already saved to their own phone is a copy we cannot reach.
- Usage and performance records that are no longer tied to your account are kept in aggregate for the periods in section 7.
Deletion completes within 30 days, and within 90 days in encrypted backups.
10. Children
Us Roll is rated 17+ and is not for children. We do not knowingly collect personal data from anyone under 13, or under 16 in the UK and EEA. If you believe a child has given us data, write to privacy@usroll.app and we will delete the account.
11. Security
Data is encrypted in transit and at rest. Access to a roll's photos is enforced by server-side rules rather than by the app, so a modified client cannot read a roll it is not on, or read any roll before it develops. The app verifies that requests come from a genuine, unmodified copy of Us Roll before the server accepts them. No system is perfect; if you find a security problem, write to security@usroll.app and we will respond.
12. Changes to this policy
If we change this policy in a way that matters, we will change the effective date at the top and tell you in the app before the change takes effect. We will not start selling your data, running ads, or training models on your photos through a quiet policy update.
13. Contact
Privacy questions and data requests: privacy@usroll.app
Anything else: hello@usroll.app
Flywheel Studio · flywheel.so