Privacy Policy

Last updated: 20 October 2026

Photolio ("Photolio", "we", "us"), operated by Jun Wang, includes Photolio: Contact Manager, Photolio: Group Photo, and the associated Photolio website. This policy explains what information these services collect, how we use it, and the choices you have. Product-specific features are described in the relevant sections below. By using Photolio you agree to this policy.

The short version

• We collect only what our apps and website need to provide the features described below.
• We do not sell your data.
• We do not show ads, use third-party advertising SDKs, or track you across other apps.
• You can use the app as a guest, with your data kept only on your device.
• Optional Auto regions detects face locations on your device, not people's identities. Saved regions follow the normal photo storage and sharing rules.
• An account owner may separately opt an approved Public identity into an anonymous Web Profile that anyone can view without signing in.
• A Public Profile owner may separately choose which contact Handles to show; enabled phone numbers and email addresses are shown in full and can be opened by anyone with the page URL.
• Contact Manager's optional Pro subscriptions increase identity and photo limits; they are billed by Apple and managed through RevenueCat, and we never receive your payment-card details.
• You can permanently delete your shared account from within either app. This deletes account data in both Contact Manager and Group Photo.

Information we collect

The information we process depends on whether you create an account.

• Account information (only if you sign up): your email address, an encrypted password, and a display name. If you sign in with Apple or Google, we receive a basic identifier and the name/email you authorize that provider to share.
• Content you create: profile photos and group photos you add, names, descriptions, photo tags/regions, nicknames, and the contact details you enter (such as phone numbers, email addresses, and social handles), and the groups you create.
• Group Photo sharing: a Group Photo can include a photo, title, description, calendar date, names, optional links, contextual subtitles, and manually drawn or automatically suggested person regions. A stable high-entropy link can make the photo and basic text visible without login. In passcode mode, names, links, and interactive regions are withheld until the viewer enters the correct passcode. Passcodes are never stored in plaintext.
• Identifiers: a user account ID and profile IDs used to store and sync your data. If you claim a Public Profile Username, we also process that Username and a versioned, keyed one-way fingerprint used to enforce permanent non-reuse.
• Social interactions: Follow requests, relationship status, and related in-app notifications, including the profile identifiers, display names, and timestamps needed to provide these features.
• Public-directory searches: when you search the public directory, we process the search text to return matching public profiles and apply an account-scoped short-window rate limit. Photolio does not keep a product-level history of the searches you submit.
• Subscription information (only if you buy Pro): your subscription status, the plan you chose, and its renewal or expiry date. Purchases are made through Apple's App Store and recorded by our billing provider, RevenueCat — we never receive or store your payment-card details.
• Device permissions: with your permission, the app uses your camera (to take photos and scan QR codes you choose to scan) and your photo library (to pick photos you choose to add). The app does not read your device's system contacts.
• On-device logs: the app keeps diagnostic logs in local storage on your device (retained about 7 days) to help troubleshoot problems. In this version these logs are not transmitted off your device.
• Aggregate safety diagnostics (signed-in use only): the app sends a fixed success/failure category and bounded duration for safety-critical operations such as access revocation, local cache sanitation, and runtime safety-configuration refresh. The server also counts fixed outcomes for Block/Unblock and share-link resolution. These records are stored only as hourly aggregates and do not contain or retain an account/profile/report identifier, name, report text, operator note, photo path, snapshot, or raw error message. A separate account-scoped counter limits diagnostic submission abuse; it does not contain content and is deleted with the account.
• Anonymous Public Profile diagnostics: the public profile and approved-avatar endpoints count only fixed outcomes such as success, not found, rate limited, disabled, or error, plus bounded duration. These are stored as hourly aggregates without a Username, IP address, account or Profile ID, Storage path, content, or raw error message. Short-window abuse controls use keyed buckets rather than retaining the raw IP address or Username in safety telemetry.
• Safety reports: if you report a profile, we collect the reporting and reported profile identifiers, the reason you select, any optional details you provide, the submission time, and a snapshot of the reported profile as it appeared when submitted. The reported account does not receive your report or its details.
• Group Photo reports and removal requests: anyone with an active Group Photo link can report the photo. An unlocked viewer can also request removal of one tagged appearance. We store the selected reason, optional details and optional contact information, the opaque photo/appearance identifiers, and the publication/access versions used to verify the request. We do not automatically copy the share token, passcode, person name, Username, external link, region geometry, or Storage path into the case record. Optional details, contact information, and operator notes may contain information deliberately provided for the review; they are not sent to product analytics. Authorized operators may remove one appearance, disable sharing, unpublish the photo, or, after explicit identity verification, escalate to deletion of the owner-scoped Person.
• Website visit counts: we count successful browser page navigations using our own server-side, daily aggregates. On marketing and legal pages these may include bounded campaign tags, the referring website's hostname, and the website content version. Public Profile, Group Photo sharing, share fallback, and password recovery pages are counted only under anonymous page categories, without campaign tags or referrer details. We do not add cookies, browser storage, browser identifiers, or third-party analytics scripts for these counts. We do not store full page URLs, URL fragments, usernames, share tokens, recovery credentials, raw IP addresses, user agents, or account identifiers in these aggregates. Short-window abuse controls use keyed counters instead of raw IP addresses.
• Group Photo product analytics: the creator and viewer send only fixed event names and bounded categories such as privacy mode, identity kind, and tag-count bucket. The public viewer creates a random site-scoped browser identifier; the server immediately transforms it into keyed event and share/day digests. We do not store the raw browser identifier, IP address, user agent, share token, passcode, names, person metadata, draft content, import key, or Storage path in these records. A creator CTA click is treated only as a product-interest proxy, not as an attributed app install.
• Publication review records: when an identity may be shared outside your account, we process an immutable snapshot of that identity, review status, decision reason, and decision time. This lets us prevent unreviewed or rejected changes from being shown to others.
• Content-safety analysis records: when you submit an identity for publication review, we may analyze the candidate public name, subtitle, public tags, custom handle labels, and candidate photo for hate, sexual, self-harm, and violence risk. Photolio stores the resulting category severities, recommendation, policy version, request status, and timing, but not another copy of the submitted text or photo in the analysis record.

How we use information

• To create and secure your account and sign you in.
• To store your contacts, photos, and identities and sync them across the devices you sign in to.
• To process optional Pro subscriptions and apply the higher identity and photo limits included with Pro.
• To deliver the information you choose to share when you generate a QR code or share link.
• To process Follow requests and relationships and deliver related in-app notifications.
• To let signed-in users find reviewed public profiles by approved name, subtitle, public tags, or eligible social and website handles.
• To provide an anonymous Public Profile when its owner has claimed a Username, made the identity Public, received publication approval, and independently enabled anonymous access, including only the individual Handles the owner separately enables for that page.
• To operate, maintain, and troubleshoot the app.
• To investigate reports, review externally shared identities, enforce our Terms, prevent abuse, and protect users and the service.
• To analyze identity revisions submitted for publication review for potential harmful content and help authorized operators prioritize and complete that review. Content is not automatically rejected based only on this analysis.

Optional on-device Auto regions

On supported iOS devices, Contact Manager and Group Photo offer an optional Auto regions tool. When you choose Auto for a photo, the app uses Apple's Vision framework on your device to detect face locations and suggest editable rectangular regions. It processes the selected photo, not your entire photo library. The detector returns face rectangles and confidence scores; the app does not identify people, automatically match names, compare identities across photos, or create face-recognition templates or embeddings.

Photos are not sent to Photolio, Apple, or another external service for Auto regions detection. If a photo is already stored in your account, the app may download it to your device before detecting faces. Detection results are used in memory to generate regions; we do not keep a separate database of raw detections or confidence scores. The app attempts to remove temporary downloads created for detection when processing finishes. Ordinary photo caches and local drafts are separate from these temporary downloads.

Regions you retain, including regions without a name or person link, become photo annotations. Guest drafts remain on the device. When you save to your account in Group Photo, or save and sync account content in Contact Manager, the photo and saved annotations may be uploaded to Supabase under the normal storage rules. Saved annotations follow the photo's access, sharing, and deletion rules, just like manually drawn regions. Auto does not publish a photo or enable sharing. You can edit or remove suggested regions, save your changes, or continue to draw regions manually without using Auto.

The first-use explanation is shown before detection starts. Reading this policy or choosing Later does not start detection. The app stores a local flag to remember that you have acknowledged the explanation; that flag contains no photo or face information. This local detection feature is separate from cloud saving, sharing, and publication safety review described elsewhere in this policy.

Safety review and operator access

Safety reports and externally shared identity revisions may be reviewed manually by authorized Photolio operators. Operators may access the report details, captured profile snapshot, relevant photo previews, and account identifiers needed to investigate and act on the case. Operator decisions and access-related actions are recorded in restricted audit records. This information is not exposed to other app users or sent to general analytics.

Photolio does not send report text or captured report snapshots to an external moderation provider. When an identity owner submits a candidate public identity for publication review, Photolio may send only the candidate public-facing text fields listed above and one candidate photo to Microsoft Azure AI Content Safety for harmful-content classification. We do not send the account email, User ID, Profile ID, internal photo path, signed URL, operator note, or report details with that request. Authorized Photolio operators remain responsible for manual review and enforcement, and the service does not automatically reject content.

How we store and process information

When you create an account, your data is stored and processed using Supabase (authentication, database, and file storage), our cloud infrastructure provider, on our behalf. Data is transmitted over encrypted connections (HTTPS/TLS) and protected by row-level access controls so that, in general, only you can access your own data.

Publication-review analysis is processed by Microsoft Azure AI Content Safety in Photolio's selected East US Azure region. Microsoft states that input text and images are not stored during detection, are not used to train, retrain, or improve its Content Safety models, are not made available for Microsoft human review, and remain within the selected Azure region. The transfer to East US may be a cross-border transfer depending on where you live. Photolio retains only the restricted analysis and audit records described above in Supabase for as long as the associated publication-review subject exists; they are deleted with that Profile, photo, or account.

If you choose Sign in with Apple or Google Sign-In, that provider processes the sign-in request under its own privacy terms. Photolio receives the account identifier and the name or email you authorize it to share. Google Sign-In may also process device, coarse-location, and usage information to provide, secure, and measure its sign-in service; Photolio does not receive those additional fields. See Apple's Privacy Policy and Google's Privacy Policy.

Anonymous Public Profile pages are delivered through Cloudflare. Cloudflare processes the web request as our hosting and security provider, while the approved profile projection and approved thumbnail are fetched through controlled Photolio endpoints. Photolio does not make the underlying photo Storage bucket public or expose private Storage paths or signed URLs on these pages.

If you use the app as a guest (without signing in), your data stays on your device and is not uploaded to our servers.

If you buy a subscription, your purchase is handled by Apple (the App Store) and recorded through RevenueCat, our subscription-management provider, which verifies your entitlement and keeps your subscription status in sync. We share an account identifier and subscription events (such as purchases, renewals, and expirations) with RevenueCat for this purpose; we do not receive your payment-card details. See RevenueCat's privacy policy at revenuecat.com/privacy.

Sharing your information

We do not sell your personal information. We share information only:

• At your direction — when you share your identity card via a QR code or link, the recipient receives the information you chose to include on that card. When you send a Follow request, the target receives the profile identity needed to review it.
• Through the public directory — if you set an identity to Public, its last approved profile card may appear to signed-in users in Global Search. Matching can use its approved name, subtitle and public tags, plus normalized social or website handles from our searchable allowlist. Phone numbers and email addresses are never used for Global Search matching.
• Through an anonymous Public Profile — if you separately enable anonymous access for an eligible Public identity, anyone with its stable /p/username URL may view the claimed Username, last approved display name and subtitle, whether it is a person or group, group member count, and approved profile thumbnail or fallback. The page may also show social, website, phone, email, messaging, shopping, support, or custom Handles that the owner individually enables. Enabled phone numbers and email addresses are displayed in full and are clickable. The page also displays a QR code and links for opening or installing Photolio. Handles that are not individually enabled, plus tags, lists, follower counts, galleries, original photos, photo regions, and internal IDs, are not included.
• With service providers — such as Supabase, which hosts and processes data on our behalf; Microsoft Azure AI Content Safety, which analyzes publication-review candidate text and photos in East US; Cloudflare, which delivers the Web Profile and protects web requests; Apple or Google when you choose their sign-in service; and, for subscriptions, Apple (payment processing) and RevenueCat (subscription management), each under their own terms and security obligations.
• For legal reasons — if required by law or to protect rights, safety, and security.

Public Profile choices and limits

Anonymous access is a separate owner choice and is off by default. You can turn it off at any time in that identity's Public Profile settings; changing the identity to Followers only or Private, a safety takedown, Profile deletion, or account deletion also prevents new anonymous page and avatar responses. Turning anonymous access off does not release or change the Username.

Each Handle has a separate public setting. Changing a Handle's type or value invalidates its earlier public permission until you review and enable the new value. You are shown the exact value before publishing a sensitive Handle. Disabling one Handle removes it from new Public Profile responses without disabling the rest of the page.

A claimed Username is permanent: it cannot be edited, transferred, released, or reused by another account, including after the Profile or account is deleted. A signed-in Block applies to interactions and signed-in access checks, but it cannot identify or prevent an anonymous person from opening a page that you chose to make available without login. Disable anonymous access or change Visibility when you need to stop new anonymous access.

Photolio applies no-store and noindex controls and stops serving a page after it becomes ineligible, but recipients, browsers, link-preview services, search tools, or other third parties may take screenshots or retain copies outside Photolio. We cannot recall those external copies.

Data retention and deletion

We keep your account data for as long as your account exists. You can permanently delete your shared account from either Contact Manager or Group Photo at Settings → Account → Delete Account. Deletion applies to both apps, not just the app where you start it. It removes the account identity and associated account content, including Photolio profiles, photos and contact details, and saved Group Photos, People and regions. Group Photo share links are disabled as deletion begins; its media cleanup is queued for retry if storage removal cannot finish immediately. The clear Username-to-Profile mapping is deleted, but the versioned, keyed one-way Username fingerprint remains without an account or Profile link solely to prevent the permanently reserved Username from being claimed again. This action is irreversible. Independent Group Photo guest drafts on the device are not part of the shared account and are kept after account deletion; you can discard them separately. Guest-created app data can also be removed by deleting the app from your device.

Safety reports, their private operator cases, and related captured evidence are deleted when either the reporting account or the reported account is deleted. Publication-review and content-safety analysis records are deleted with the associated Profile, photo, or account. After account deletion, only non-linkable aggregate counters may remain; they contain no account/profile/report identifier, content, path, snapshot, operator note, or raw error and cannot be used to reconstruct the deleted account's activity.

Website visit counts contain only the aggregate categories described above and may be retained to compare website and campaign performance. They do not contain individual browsing histories or identifiers that can be used to link a visit to an account.

Group Photo event-level records and share/day pseudonymous viewer records are retained for no more than 90 days. Older records are deleted after contributing to daily aggregate counts. Those long-term aggregates contain counts only, not viewer identifiers or Group Photo content. Group Photo report cases are retained only as needed for safety, legal, and operational review and contain the limited evidence described above.

If you subscribe and later let your subscription lapse, your account returns to the free identity and photo limits. We keep your cloud-stored photos for 90 days so you can resubscribe or retrieve them, after which they are deleted from our cloud storage. Your contact details and other text information remain available and continue to sync within the free tier. At any time you can save your photos onto your device or export a complete copy of your data (see “Your rights”).

Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to or restrict certain processing. You can exercise the core of these rights directly in the app (editing your content and deleting your account), or by contacting us at the address below. You can also export a complete copy of your data at any time from Settings → Your Data → Export my data, and download your cloud photos onto your device.

Children's privacy

Photolio is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us and we will delete it.

Security

We use encryption in transit and access controls to protect your information. No method of transmission or storage is completely secure, but we work to protect your data and to limit access to it.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice.

Governing law

This policy is governed by the laws of Singapore, without regard to conflict-of-law principles.

Contact us

Questions about this policy or your data? Email us at [email protected].