Privacy

The short version

Stills is a film camera and personal memory app made by Neurovia. Your photographs live on your device and are never uploaded — not to us, not to anyone. A short list of things leaves your phone. The Email address on your account, which signs you in and is used for nothing else. Your Profile: name, handle, bio, birthday, profile picture, the cover frames you choose, and six counts about your shooting — so the friends you meet in person can see who you are. Any Message you send a friend, which passes through our server on its way to their phone and is deleted the moment it gets there. A Notification token, if you allow notifications, which is the address Apple uses to reach this phone. And anything you Deliberately send us — a support note, a search that came back wrong, a report about somebody. Photographs are never part of any of it: a frame is still handed over in person. There are no analytics SDKs, no ads, and no tracking. We cannot see your photos, and we don’t want to.

Signing in

Setting up Stills creates an account, and Sign in with Apple is the only way to make one. Apple gives us an account identifier and an email address, and you can choose to hide the real one and have Apple supply a relay address instead. There is no password to invent, forget, store or leak, because there isn’t one.

The address identifies the account and reaches you about the account itself: the sign-in code, and the confirmation link if you ever move the account to a new address. Nothing else is ever sent to it. It is never shown to anyone, including your friends. Sending those messages means an email provider handles the address, the way a letter passes through a postal service — we use Resend, and they process it for that delivery and nothing else. Codes expire ten minutes after they are sent.

You can change the address at any time, from Settings here or at stills.cam/account. A confirmation goes to the new address and nothing changes until it is clicked; the old address is told as well, because an email change is how accounts get stolen and both halves knowing about it is what stops it.

What syncs, exactly

Alongside the account we store one row about you: display name, handle, bio, birthday if you set one, and six counts — frames, rolls, places, current streak, best streak, and days shot. Two kinds of image travel with it: your profile picture, and up to five cover frames you pick yourself. Those covers are the only photographs that ever leave your device, and only because you chose them for a profile other people are meant to see. Everything else — every other frame, your rolls, your search index, Dailies, your locations — stays on the phone. Your friend list is stored as a list of account IDs so both sides can see each other; who you are friends with is visible only to you and to them.

Messages

You can write to a friend at any time, from anywhere. A message goes to our server, sits there until their phone collects it, and is Deleted as soon as it does — the conversation itself lives on the two phones having it, and we do not keep a copy, an index or a backup of it. A message nobody ever collects is deleted after thirty days.

Be clear-eyed about what that does and does not mean: while a message is in transit it is stored on the server as ordinary text, which means it is readable by someone who could reach the database. It is not end-to-end encrypted, and we would rather say so than imply otherwise. Nothing else about a conversation is stored — no read receipts, no history, no metadata beyond who it is for and when it was sent.

You can only message someone you have already met in person and added, and that rule is enforced by the database. Photographs are not messages. Frames still change hands only in person, over a Tap, directly between the two phones — that is the whole idea of the app and it is not being traded for convenience.

One thing does copy a conversation off your phone, and only you can trigger it: Reporting somebody. A report sends us up to a dozen of that person’s most recent messages to you, because a report with nothing in it cannot be acted on and those messages exist nowhere else. It sends only Their side — what you wrote stays yours.

Notifications

If you allow notifications, Apple gives this phone an address — a device token — and we store it against your account so a friend’s message can reach you while the app is closed. It identifies the phone, not you, and it is useless to anyone who cannot also sign the request with our key. The notification carries the sender’s name and the first part of what they wrote, which is what makes it worth having; if you would rather it did not, iOS Settings can hide previews on the lock screen.

Say no and nothing changes except that messages wait for you to open the app. The token is deleted when you sign out or delete your account, and Apple tells us to forget it if you turn notifications off or uninstall.

Blocking and reporting

You can block anyone you have added. A block is enforced by the database, not just hidden in the app: they cannot message you, they cannot see your profile, and the conversation is deleted from our server along with the friendship in both directions. To do that we store one row — that you blocked them — which is readable by you and by nobody else, including them. They are not told. You can undo it in Settings, though undoing it does not make you friends again; that still takes meeting in person.

Reporting is separate and optional, and it goes to the same place our support mail does. See Messages for exactly what a report carries.

Who can see your profile

Only people you have met in person and added by touching phones. Both sides must have added the other before either can read the other’s profile — that rule is enforced by the database, not just the app, so a one-sided claim reveals nothing. Stills has no browsing, no discovery, no search by name, and no public profiles. Your profile picture and covers are stored privately and served through short-lived signed links rather than public URLs, so nobody who is not your friend can reach them.

Capturing and developing

Photos you take are written to the app’s private storage on this device. The film “develop” — tone, grain, color — is computed by the app on your phone’s own processor. Rolls (the film in the camera and finished rolls waiting in the darkroom) are records kept in the same private storage. Developing a roll keeps every frame on it; frames you delete afterwards are removed from that storage.

What the intelligence reads

To make search and memories work, Stills analyzes each developed frame on-device: it recognizes text visible in the photo (signs, labels), classifies the scene (beach, food, night), counts faces (it does not identify who they are), writes a one-line caption, and computes numeric embeddings used to match your search words to images. All of this — the models and the index they build — runs and stays on your phone. Nothing about your photos is transmitted anywhere.

Search

When you search, your query is processed on-device against that local index: the words you type do not leave the phone. Time phrases (“sunset”, “last weekend”) are resolved against each photo’s capture time; place words against the photo’s own location tag; everything else against the local text, caption, scene, and image indexes.

There is One exception and it is yours to make. If a search comes back wrong you can tap Report on the results, and that sends us the words you typed, how many frames came back, and the identifiers and dates of the first few — so we can work out what went wrong. It sends no photographs. It happens only when you tap it.

Location, trips, and spots

If you grant location access, each capture is tagged with where it was taken, and the app groups located frames into trips and named spots — all computed locally from your own photos. If you never grant location, none of this exists. “Include location” under Capture controls whether coordinates are written into files you export; turn it off to keep exported files clean.

Presence and friends

The Tap connects two phones directly over Bluetooth and local radio — phone to phone, in person. When you connect you exchange a display name, avatar, and a cryptographic public key so your phones recognize each other later, all stored locally on each device. Each phone also records the friendship on the server, which is what lets you see each other’s live profile afterwards. Frames shared between phones travel over the direct link and are stored only on the two devices involved; they are never uploaded. Removing a friend deletes your side, and they stop being able to read your profile. Blocking goes further — see Blocking and reporting.

Saving, sharing, and the date stamp

Saving writes the developed photo into your iOS Photos library (and, if enabled, a “Stills” album). Sharing hands the photo to the iOS share sheet — where it goes from there is up to you and the app you pick. The optional date-time stamp is burned into the exported image only when you turn it on in the save sheet. Exported files can include Exif metadata and location if those toggles are on.

Inviting people

The invite sheet hands a link — stills.cam — to whatever you choose: the iOS share sheet, Messages, an email you write yourself, the clipboard, or a Qr code. The Qr is drawn on your phone by the app; it is not fetched from a service, it carries no identifier, and scanning it tells nobody anything. We do not see who you invited, we never ask for your contacts, and an invite is not tracked back to you — there is no referral code in the link because there is no referral system.

Recaps and covers

Monthly memories, recap films and featured picks are assembled on-device from your own frames using the local index. Nothing is curated by a server. Profile covers are also chosen on-device — but unlike the rest, the covers you pick are uploaded, because their whole purpose is to be seen by your friends. Choosing none means uploading none.

Permissions, in context

Camera — taking photos; the one permission Stills can’t work without. Photos — saving developed frames to your library, and importing if you choose. Location — tagging frames with a place. Local network / Bluetooth — the Tap. Microphone — only if you use voice dictation in chat, and speech is transcribed on-device. Each is requested when first needed and can be changed anytime in iOS Settings; the related feature simply switches off without it.

Backups

Stills data lives in the app’s storage, so it rides along in the device backups You control — iCloud Backup or a computer backup — under Apple’s terms. Stills never uploads your library. The app can also export a single backup file you keep yourself. That file is Encrypted with a key held for your account, so it can only be opened by signing in as you — a backup that ends up in the wrong hands cannot be read. That key is stored on our server and is readable by nobody but you, including your friends.

What we don’t do

We don’t sell your data. We don’t show ads. We don’t fingerprint or track you across apps or websites. We don’t collect analytics about how you use the app. We don’t train models on your photos — we do not have your photos. We don’t read your profile for any purpose beyond showing it to the friends you chose.

Children

Stills is not directed to children under 13. Using Stills requires an account, created with Sign in with Apple, which is governed by Apple’s own age rules. If you believe a child under 13 has created an account, contact us and we will delete it.

Your control

An account is required to use Stills, and you can close it whenever you like. Settings gives you the full set of levers: see exactly what’s stored under Storage, clear the image cache, export every frame, back up everything, reset your local profile — which permanently erases your photos, profile, friends and index from the device — and Delete your account, which removes your profile, profile picture, covers, backup key and every friendship from the server for good. The two are separate on purpose: deleting your account does not touch your photographs, and resetting the device does not close your account. Deleting the app erases the device half. There is no other copy of your photos anywhere to chase.

Changes to this policy

If the app ever changes how it handles your information, this policy and the date above change with it, and material changes will be surfaced in the app — not buried.

Contact

Questions about privacy? Email Neurovia at [email protected]. We read every note.