Privacy policy

Who's responsible

oohroll is built and run by a single independent developer (the "operator"), who is the data controller for host accounts and for how the service itself works. For the names and photos of guests inside an event, the host is the controller — they decide who's invited and what gets published — and oohroll processes that data for them. Either way, the contact is [email protected] and it goes straight to the person who builds oohroll.

What oohroll collects

• Hosts: your email address (that's the account), an optional display name, and — if you sign in with Apple or Google — the identifier and email they pass us. Plus the events you create and their settings.
• Guests: the name you type when joining, the photos you shoot in the event and when you shot them, the moment you accepted the consent note, and a random device identifier plus a hashed device fingerprint so rejoining from the same phone keeps your shot count and one phone can't join twice. No account, no email, no phone number.
• If you allow notifications: a push token, used only to tell you when an event's photos are ready. Turn notifications off in iOS Settings and it stops.
• Usage statistics: what happens in oohroll rather than who you are — on the website, which pages are opened and for how long, where the visit came from, and taps on buttons such as "copy link" or "get the app"; in the app, launches, the join screen, shutter presses, gallery views and saves, sharing an event's link, your answer to the notifications prompt and opening a notification; and on our server, sign-ins and sign-ups, events created, closed, published and deleted, guests joining (or why a join didn't work), photos uploaded (and how long that took), notifications sent, galleries downloaded, and account deletions. Each comes with the app version, whether it was the app or the App Clip, and an approximate location (country and city) looked up from your IP address, which isn't kept afterwards. To connect the steps one person takes, we use a code derived from your device identifier in the app, your account number if you're a signed-in host, and on the website a code made from your IP address and browser that changes every day — no cookie. Usage statistics never include names, email addresses, photos, or anything you type.
• Technical data: your IP address and request details in server logs, used to rate-limit abuse and keep the service up, and crash reports from the app and server (what went wrong, device model, OS version) so bugs get fixed. Crash reports contain no photos.

oohroll never reads your contacts, your phone's location, or your photo library — the app only saves the photos it developed into your library, with add-only permission. There are no advertising or analytics SDKs in the app — usage statistics go through our own server — and no cookies on the website beyond the session cookie that keeps hosts signed in.

Why, and on what legal basis

• To run the service you asked for (performance of a contract): storing and developing photos, publishing galleries, keeping your shot count, signing you in.
• Because you agreed (consent): sharing your photos with the event when you join, and push notifications. You can withdraw either — remove your photos, or turn notifications off.
• To keep oohroll safe and working (legitimate interests): rate limiting, blocking abuse, crash reports, backups, and answering support email.
• To understand what works (legitimate interests): usage statistics, so we can see where guests and hosts get stuck and fix it. You can object at any time by emailing us.
• Because the law requires it: responding to valid legal requests, and keeping records we're obliged to keep.

Who sees your photos

Photos taken in an event stay hidden from everyone — including you — until the host publishes. After publishing, they're visible to the host and the event's guests, and, if the host enables the shareable gallery, to anyone with that gallery link. Treat a public link as public: people can view and download the gallery until the host disables or rotates it, and copies someone already downloaded can't be recalled. Personal rolls shot outside an event never leave your phone.

We never sell your data, never share it with advertisers, and never use your photos for anything but running the service — no model training, no marketing, no "featured galleries" without asking you.

Companies that help us run it

A few providers process data on our behalf, under contracts that limit them to that job:

• Cloudflare — stores photos (object storage) and fronts the website and API, so it sees IP addresses in transit.
• Our hosting provider — runs the server and database on a single virtual machine in the European Union.
• Resend — sends host emails (sign-in links, confirmations).
• Better Stack — receives crash and error reports from the app and server, in an EU data centre.
• PostHog — stores and analyses the usage statistics, in its EU cloud.
• Apple — App Store, push notifications, Sign in with Apple. Google — sign-in for hosts who choose it.

Some of these companies operate globally. Where data leaves the EU/EEA, it's covered by the EU's standard contractual clauses or an adequacy decision. We may also disclose data if the law genuinely requires it, or to protect someone's safety; we'll tell you unless we're not allowed to.

How long we keep it

• Photos and events: until you delete them. We don't auto-expire an event's photos — the host and guests decide. Deleted photos leave the live service immediately and disappear from backups within about 30 days.
• Host accounts: until you delete the account, which also deletes every event and photo in it.
• Guest records: live as long as the event does; deleting the event deletes them.
• Logs and crash reports: a few weeks, then gone.
• Usage statistics: kept so we can compare how oohroll is used over time. We delete the ones tied to your account or device when you ask.
• Support email: as long as needed to help you, then deleted.

Your rights and how to use them

Wherever you live, you can ask us what we hold about you, correct it, get a copy, object to or restrict how we use it, and have it deleted. People in the EU/EEA, UK, and Switzerland have these rights under the GDPR and may also complain to their data protection authority; we'd rather you write to us first so we can fix it.

• Guests can remove any of their own photos from an event in the app, even mid-event. To have your name and device record removed as well, ask the host to delete the event, or email us with the event name and the name you joined with.
• Hosts can download every photo in an event, delete an event, or delete their whole account — from the app or from web settings. Both are permanent.
• Anyone can email [email protected]. We answer within a month, usually within days, and may ask you to prove it's your data before we act.

Children

Hosts must be 16 or older. Children may appear in event photos and may join as guests with a parent or guardian's permission — the host who invites them is responsible for getting it. If you believe a child's data ended up in oohroll without permission, email us and we'll remove it.

Security

Everything travels over HTTPS. Photos are uploaded and served through short-lived signed links, the database isn't reachable from the internet, and secrets live in an encrypted store. No system is perfectly secure; if there's ever a breach that affects you, we'll tell you and the relevant authority as the law requires.

Changes to this policy

We may update this policy as the service evolves. The current version always lives at this address and the effective date at the top changes when we do; check back from time to time. If a change means we collect something new or share photos with someone new, we'll show a notice in the app or on the site before it applies to you. Using oohroll after the effective date means the updated policy applies.

Questions

Email [email protected].