Privacy

• Your photos and videos are private to the hangout or group you add them to. There is no public feed, no search and no public profile.
• Location and every other piece of hidden data is removed from a photo or a video before it leaves your phone.
• Everything is encrypted on its way to us and where it's stored, and a photo has no public address.
• We never ask for your contacts, and we don't sell or share your information for advertising.
• You can delete what you've added, ask for a photo or video you're in to come down, download everything, and delete your account.

• The name you type. It's shown to the people in that hangout or group, next to the photos you add, and it can appear on a recap. First name is fine, and you can change it, everywhere at once or for one group.
• A photo of you, if you add one. It's cropped and redrawn on your phone like any other photo, and only people you share a hangout or group with can see it. If you sign in with Google you can choose to use your Google photo; we only copy it when you ask. You can remove it at any time, and it's deleted with your account.
• The photos you add. Each is resized on your phone and redrawn before upload, which strips its location and other metadata. We keep the time it was taken, so photos sort in order, and nothing else from inside the file. When you add one from the app, a few numbers your phone worked out about it come with it, for recaps; they're listed below.
• The videos you add. Each is made again on your phone as a new file before upload, so where it was recorded and what it was recorded on aren't in it. A video keeps its sound. We keep one frame of it as a photo, to stand for it in a grid or a recap, and the time it was taken. A Live Photo is kept as its photo and its few seconds of movement, without the sound.
• Hearts, requests to take a photo down, reports and blocks you make.
• If you add an account: your email address and, when you sign in with Google or Apple, the name they give us. Without an account you're a guest: a cookie on your phone is what recognises you, and clearing it means we no longer can.
• If you turn on notifications in the app: the address Apple gives your phone for them, so we know where to send one, which kinds you've switched off, and which groups you've muted. Signing out or deleting your account removes it.

People who have a hangout's link and have typed a name can see that hangout. Members of a group can see every hangout in it. Nobody else can. Links are long, unguessable and kept out of search engines, and a group's owner can replace one at any time, which switches the old one off. Treat a link like a key: whoever you send it to can get in.

Link previews in a chat show a few of a hangout's photos out of focus, never sharp. If you block someone, everything they have added is hidden from you.

• On the way. Everything between your phone and us travels over an encrypted connection, on the website and in the app.
• Where they're kept. Photo and video files are encrypted in storage, and so is the database that holds names, email addresses and everything else on this page.
• No public address. A photo or video can't be opened by guessing where it lives. Each time one is shown, we check that you're allowed to see it and hand your phone a private link that stops working within two hours. The one a notification carries lasts a day, as described below.

This is not end-to-end encryption. Our servers have to be able to open a file to show it to your group, so we are technically able to as well. We don't look at your photos or videos, except one that has been reported to us.

A recap is made on your own phone, from photos you can already see. We don't store it. When you share one, it goes wherever you send it, and from then on it's out of our hands. A photo someone has asked to have taken down is never used in a recap.

If you let the app see your camera roll, it suggests the photos that belong to a hangout or a trip. It also suggests a name for a hangout that doesn't have one yet, such as “Birthday dinner”. To do that it looks at when and where your photos were taken, at what they show, and at the photos already in the hangout. And when you add a photo, it looks at it once more, so a recap can show the best ones. All of it happens on your phone, with what Apple builds into it.

• Nothing is sent to us until you add it. A photo you don't add never leaves your phone, and nothing the phone saw in it is kept or sent anywhere.
• A few numbers go up with a photo you add. How well it came out, whether it's a screenshot or a receipt, how many people are in it and where in the picture they are, and a short fingerprint that tells two nearly identical shots apart. A recap uses them to choose its photos and to crop them without cutting anyone out. They say nothing of who is in the photo, they can't be turned back into it, and they're deleted with it.
• Where a photo was taken is never sent to us. To name a city, the app asks Apple's maps about a point rounded to about a kilometre. A city is only suggested in a name when you were away from home.
• Of what goes into a name, the name is the only thing saved. A hangout you started without naming is given a name by the app, worked out from the photos already in it; you're told, and can take it back. Anything worked out from photos you haven't added, or from where a photo was taken, is only ever suggested, and is saved only if you choose it.
• It tells things and places apart, like a cake or a beach. It doesn't work out who is in a photo.

• Delete any photo or video you added, at any time. It's removed from our storage, not just hidden, and so is everything kept with it: a video's frame, a Live Photo's movement.
• On a photo or video you're in, tap “I'm in this, please remove it”. The person who added it and the group's owner are asked to take it down, and until they answer it's kept out of recaps.
• Report a photo or video from its ••• menu and it comes to us. We look at every report.
• Download a group's photos as a zip, from the group's page. A video goes into the zip as a photo of its first frame; open the video itself to save it. Delete your account from your account page: your photos stay in your friends' groups, no longer linked to you, unless you choose to delete them too.

These companies store or process data for us, and only to provide the service:

• Vercel hosts the website.
• Supabase holds the database and handles sign-in.
• Cloudflare stores the photo and video files.
• Google or Apple, only if you choose to sign in with them.
• Apple delivers notifications to the app, only if you turn them on. A notification says who did what in which hangout. One about photos also carries a private link to a small copy of one of them, so your phone can show it; the link stops working after a day.

Pictured is for people aged 13 and over, or older where your country sets a higher age for using online services without a parent's consent. If you believe a child younger than that has used it, tell us and we'll remove what they added.

Write to email@pictured.pics. If this page changes in a way that matters, we'll say so here and update the date at the top.