Privacy policy

Your photo library stays on your device. A photograph leaves your device only when you ask Retold to make a new version of it with a template: it is sent over an encrypted connection to our server, passed to Google's Gemini API to generate the image you requested, and the result is returned to your device. Our server does not keep the photograph you sent. The pages you keep are stored on your device, and only in the places below if you are signed in.

Generation is performed by Google's Gemini API, so the photograph you submit is processed by Google for that request, subject to Google's API terms. Retold uses the paid tier, and under those terms Google does not use paid prompts or responses to improve its products. Google does log them for a limited period to detect abuse and to meet legal obligations, which is outside our control and worth your knowing.

So we can fix a picture that went wrong. Google also keeps a copy of each request on our behalf — the photograph you sent, the instructions Retold gave the model, and the picture that came back — for 28 days, after which Google deletes it automatically. Only the Retold team can open it, only to investigate a problem with a picture or with the app, and it is never used to identify you or to train anyone's model. It is stored by Google, not on our servers, and is linked only to the anonymous identifier described below, never to your name or account. If you would like a request deleted sooner, write to us and we will remove it.

The Colour Splash tool runs entirely on your device. Photographs you edit with it never leave your phone.

For each installation we keep usage records (how many generations were made and when, which template was used, and the state of your take balance), because that is how the included take and purchases work. These are numbers and timestamps, not images.

With each generation we also keep two short fingerprints of the photograph you sent: a cryptographic hash, and a 64-bit "difference hash" that stays the same if the photo is slightly cropped or re-saved. Neither is an image and neither can be turned back into one. They let us tell that the same photograph and template were tried again, so an included retry is not charged twice and a picture that keeps failing is not sent to the model over and over. They are deleted with the rest of your install's records when you use "Forget this install".

To stop the take a new install includes being claimed again and again, Retold uses two Apple services. DeviceCheck lets us store two yes-or-no bits about this phone on Apple's servers (for example, that it has had its included take); Apple does not give us any device identifier. App Attest lets our server confirm a request came from the genuine Retold app. Neither tells us who you are.

We also record anonymous usage events: which screens were viewed and which features were used, so we can see where the app confuses people and which templates are worth keeping. An event is a short name from a fixed list, a timestamp, and occasionally a detail such as which template or which product, never anything you wrote. We never record your photographs, never the words you type into search (we store only how many characters it was), and never your location. Everything here is tied to your installation identifier: no device identifier, no advertising identifier, no name. If you sign in, your installation is linked to your account so your takes and pages follow you. "Forget this install" deletes all of it.

When you choose a photograph, Retold looks at it on your phone to decide which templates to offer first. That examination never leaves the device, and neither does anything detailed it finds: not how many people are in the picture, not what anyone looks like. One word is sent, chosen from four: person, pet, landscape or night. It is used to put suitable templates nearer the front, it is not stored against you, and it says nothing about your photograph beyond which of those four it was.

Two optional things you can choose to tell us, and neither is on unless you turn it on:

Retold never asks for location permission and never receives your location from your phone. Both of the above are things you type or tap, and neither happens on its own.

We keep one more thing, and it is worth being exact about: the country setting of your device, two letters, such as GB or TR. That is the country you told your phone you are in. It is not your location: Retold never asks for location permission, never receives one, and nothing more precise than a country is ever recorded. We use it to show work made for where you are, and to understand where the app is and is not working.

Payments are processed entirely by Apple through the App Store. We never see your payment details. To add your purchases to your balance, Apple sends us a signed receipt which we verify; it contains transaction identifiers, not your identity.

Retold contains no advertising, no analytics SDKs, and no third-party trackers. Nothing follows you between apps or websites, and there is no advertising identifier involved at any point. The usage events described above are our own, they stay on our own servers, and they are not linked to any identity beyond the installation itself. We do not sell, share, or monetise any data.

These companies process limited data on the studio's behalf.

Supabase

Hosts our database and stores the pages described above for people who are signed in.

Apple

Handles Sign in with Apple and every payment.

PostHog (EU)

Receives anonymous product events (which screens were used, never your photographs, never your notes), keyed by the same anonymous install identifier the studio already holds.

Sentry

Receives crash reports from the app and the server: technical diagnostics, not linked to you, never containing a photograph.

None of them receives your name from us, because the studio never asks for it.

In Settings, "Forget this install" removes the pages kept on your phone, deletes our record of your installation from our servers (its identifier, its usage records, its usage events and its take history), and then destroys the identifier on your device, so nothing can be re-created afterwards. Any takes you had bought go with it.

If you are signed in, the same screen offers "Forget this and delete my account". It also deletes your account, the pages stored on it, the albums you made, and the gifts you sent. If you forget the install but keep the account, your pages stay on the account so you can sign in again on another phone.

Everything the studio holds about an install is deleted the moment you ask (Settings, then Forget this install), and everything held for an account goes when you delete the account. Your pages live on your phone: sharing or saving them from the Shelf is your export. If an install is blocked for abuse, the block record (an anonymous identifier and a reason) is retained as a legitimate interest.

Retold is not directed at children under 13, and we knowingly collect no data from them, nor from anyone else, beyond what is described above.