Privacy Policy
Frame 37 is a camera app. Cameras see a lot, so this page says plainly what we store, why, where it lives, who else gets to see it, and how to make it go away. No dark patterns, no data brokers.
The short version. We store your photos so we can develop them, and an account so they come back to the right person. We do not sell your data, we do not use your photos to train anything, and we do not show third-party ads in the app. We do use a few outside services to count how the app is used, to catch crashes, and to measure whether our own ads on Instagram, Facebook and Google bring people in — section 04 names every one of them. None of them ever receive your photos. Deleting your account really deletes your photos.
01Who we are
Frame 37 (“Frame 37”, “we”, “us”) is the Frame 37 mobile app and this website, operated by Evgenii Isupov, an individual developer based in Portugal, who is the data controller for the data described here.
Contact: [email protected] — email is the fastest way to reach us, and the right address for any privacy request. If you need a postal address for a formal notice, ask and we will provide one.
02What we collect
| Data | Why we have it | Legal basis (GDPR) |
|---|---|---|
| Your photos — the frames you shoot, plus the developed versions we render | To develop a roll and give it back to you. This is the product. | Performance of a contract (Art. 6(1)(b)) |
| Account identifier — an Apple or Google sign-in identifier and the email address that sign-in shares with us (for Apple this may be a private relay address), or an anonymous guest ID | To tie rolls to an account and let you sign back in on a new device. | Performance of a contract |
| Roll and frame metadata — film type, frame numbers, timestamps, processing status | To run the counter, the develop timer and the darkroom queue. | Performance of a contract |
| Push token and device details — your Expo push token, platform (iOS / Android), device model identifier, time-zone offset and the app's language; plus a record of which notifications we sent and whether you opened them | To tell you a roll is ready, and to remind you about a roll that has gone quiet — at a sensible hour, in your language. Only if you allow notifications. | Consent (Art. 6(1)(a)) — you can revoke it in system settings; reminders can also be switched off in the app |
| Subscription and usage records — which plan you have, its status and renewal dates, store product and transaction identifiers, promo codes you redeemed, how many rolls you developed | To apply your plan's limits and handle billing questions. | Performance of a contract; legal obligation for tax records |
| App usage events — things like opening the app, loading or finishing a roll, opening a developed roll, viewing the subscription screen, starting or completing a purchase (product, price, currency), using a widget or an onboarding tip; plus the device, OS and app information these tools collect automatically, and an app-instance identifier | To understand which parts of the app work and where people get stuck, and to measure whether our marketing campaigns bring people to the app. Event details never include your photos, your email or anything you typed. | Legitimate interests (Art. 6(1)(f)) — improving the app and measuring our own marketing |
| Advertising identifier — Apple's IDFA on iPhone, Google's advertising ID on Android | To attribute an app install or purchase to one of our ad campaigns. On iPhone it is read only if you tap “Allow” on Apple's tracking prompt. On Android it is available to these tools unless you delete or reset it in your device's settings. | iPhone: consent (Art. 6(1)(a)) via Apple's prompt. Android: legitimate interests |
| Crash and error reports — the stack trace, app version, device model and OS, and the internal ID of your account (never your email) | To find and fix crashes and bugs. | Legitimate interests — keeping the app working |
| Technical logs — IP address, request time, error traces | Security, abuse and rate limiting, debugging. | Legitimate interests — keeping the service up and unabused |
ADS, ANALYTICS, CRASHES AND ATTRIBUTION — FOUR DIFFERENT THINGS
- Advertising in the app: none. Frame 37 does not show third-party ads, and contains no ad network.
- Analytics: we count app usage events (listed above) with Google Firebase Analytics and Meta App Events.
- Crash and error reporting: Sentry receives a report when the app crashes or hits an error.
- Marketing attribution: we advertise Frame 37 on Instagram, Facebook and Google. Meta App Events and Firebase report installs, the usage events above and purchases back to Meta and Google, together with the advertising identifier where it is available, so that we can see which campaigns work and so those platforms can deliver our ads more effectively.
WHAT WE DO NOT COLLECT
- No contacts, no calendar, no location tracking.
- We do not read your device photo library. Frame 37 only handles frames shot inside the app; the gallery permission it asks for is write-only, used when you choose to save developed photos.
- Your photos, your email address and your account ID are never sent to Meta or Google Firebase. (Firebase receives only our internal, random account ID.)
- No sale of personal data, and no selling or renting of lists to anyone.
03How your photos are handled
When you shoot a frame, the app uploads the original directly to our private storage over an encrypted link. The original is not written to your device's photo gallery, and it is not visible to you before the roll is developed — that is the point of the app.
When the roll is finished, our darkroom worker renders the developed frames and stores them next to the originals. Access is private: images are served only to your account, only over short-lived signed links. The originals are deleted from our storage about a week after the roll is developed; the developed frames stay until you collect them.
Photos are processed automatically by our own software. We do not look at your photos, we do not sell them, and we do not use them to train machine-learning models. We may access an individual image only if it is strictly necessary to fix a fault you reported to us, or if we are legally compelled to.
COLLECTING A ROLL
When you collect a developed roll, it is downloaded to your device and then deleted from our servers. After that, your device holds the only copy — so keep your own backups. We cannot restore a collected roll for you.
ROLLS YOU STOP SHOOTING
If no new frame is shot on a roll for 30 days, we develop it as it is (free of charge). An empty roll is simply deleted.
04Who else touches the data
These services run parts of Frame 37 for us and receive only what their job needs:
- Fly.io — application hosting; our servers run in Amsterdam, EU. Sees your IP address and every request the app makes.
- Neon — our database (hosted on AWS in London, UK): account, roll, subscription and device records.
- Cloudflare — object storage (R2) for your photos, plus DNS and protection for this site.
- Expo — delivery of push notifications: your push token and the notification text, passed on to Apple's (APNs) or Google's (FCM) push service.
- RevenueCat — manages subscriptions across the App Store and Google Play: our internal account ID, your purchase and subscription history, store receipts, and basic device and app information.
- Sentry — crash and error reporting (EU region): crash and error reports as described above. Reports are scrubbed of upload links before they leave the device, and are sent without your email or device name.
- Google Firebase Analytics — usage and purchase events, an app-instance identifier, our internal account ID, device and app information, approximate location derived from IP (country / region), and the advertising identifier where available. Also used to measure our Google Ads campaigns.
- GitHub — hosts this website.
Some parties receive data for their own purposes as well as ours, and decide how to handle it under their own privacy policies:
- Meta (Facebook / Instagram) — the Meta SDK in the app sends installs, app opens, the usage events and purchases listed above, device and app information, your IP address and, where available, the advertising identifier. Meta uses it to measure and optimise our ad campaigns and, under its own terms, may combine it with what it already knows about you if you use its services. We never give Meta your email or account ID. On iPhone you can stop the advertising identifier from being shared by choosing “Ask App Not to Track”.
- Apple — App Store distribution, in-app purchases on iPhone, push delivery on iPhone, and Sign in with Apple if you use it. We never see your card details.
- Google — Google Play distribution, in-app purchases on Android, push delivery on Android (via Firebase Cloud Messaging), and Google Sign-In if you use it. We never see your card details.
Beyond those, we disclose data only when the law requires it, or to establish or defend legal claims. If Frame 37 is ever acquired, your data may transfer with the service; you will be told before that happens.
05Where the data lives
Our application servers are in the European Union (Amsterdam) and our database is in London, UK, which the European Commission recognises as providing adequate protection. Several of the services above — Cloudflare, Expo, RevenueCat, Google, Meta and Apple — are based in the United States and may process data there or elsewhere. For those transfers we rely on the safeguards each provider offers in its data protection terms.
06How long we keep it
- Original photos — deleted about a week after the roll is developed.
- Developed rolls you collected — deleted from our servers on collection.
- Developed rolls you have not collected — kept while your account is active, so you can still open them.
- Account data — kept until you delete your account.
- Technical logs — up to 30 days.
- Analytics, attribution and crash data — kept by Firebase, Meta and Sentry under their own retention settings; it is not linked to your email.
- Billing and tax records — as long as tax law requires (typically up to 7 years), regardless of account deletion.
07Deleting your account
You can delete your account from inside the app (Account → Delete account & data). This starts a real erasure: we delete your stored images and then purge or anonymise your database rows, leaving only an anonymous tombstone and any records we are legally required to keep. Erasure runs as a background job and normally completes within minutes; it can take up to 30 days if something needs retrying. It cannot be undone — uncollected rolls are gone.
Deleting your account does not cancel a subscription — that is billed by the App Store or Google Play, so cancel it there. It also does not reach data already held by Firebase, Meta, Sentry or RevenueCat; if you want that removed too, email us and we will ask them to delete what is linked to your account.
If you cannot reach the in-app option, email [email protected] from your account address and we will do it for you.
08Your rights
If you are in the EEA or the UK you have the right to access, correct, delete, export (portability), restrict, and object to our processing — including the analytics and attribution described above — and to withdraw consent at any time (withdrawal does not affect processing already carried out).
If you are in California, you have the rights to know, delete, correct, and to opt out of sale or sharing. We do not sell personal data. Sending app events and the advertising identifier to Meta and Google to measure our ads may count as “sharing” for cross-context behavioural advertising under California law; you can opt out by emailing us.
You can also limit it yourself at any time: on iPhone, turn off “Allow Apps to Request to Track” or deny Frame 37 in Settings → Privacy & Security → Tracking; on Android, delete or reset your advertising ID in your device's Google / privacy settings.
To exercise any of these, email [email protected]. We answer within 30 days and will not charge you or degrade your service for asking. You can also complain to your local data protection authority.
09Children
Frame 37 is not directed at children under 13 (or under 16 where local law sets that age), and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.
10Security
Data is encrypted in transit (TLS) and at rest. Storage buckets are private, object names are generated by our servers, and access happens only via short-lived signed links. No system is perfect: if a breach ever affects your data, we will notify you and the relevant authority as the law requires.
11This website
This site sets no cookies and runs no analytics or tracking. It is hosted on GitHub Pages behind Cloudflare, and it loads fonts from Google Fonts — which means your IP address reaches GitHub, Cloudflare and Google when the page opens. Cloudflare also hides the email addresses on this page from spam bots with a small script. These providers may keep standard server logs for security.
12Changes
If we change this policy we will update the date above, and for material changes we will tell you in the app or by email before the change takes effect.
Questions? [email protected] — a person reads that inbox.