Privacy

The short version

Stills is a film camera and personal memory app made by Neurovia. Your library lives on your device and is never uploaded — not to us, not to anyone. A short list of things leaves your phone. The Email address on your account, which signs you in and is used for nothing else. Your Profile: name, handle, bio, birthday, profile picture, the cover frames you choose, and six counts about your shooting — so the friends you meet in person can see who you are — plus two private counts nobody else sees. Any Message you send a friend, which passes through our server on its way to their phone and is deleted the moment it gets there. Any Flick you send a friend — and the first photo you take together — which is Encrypted on your phone so that only theirs can open it; our server carries bytes it cannot read and deletes them minutes after they are opened. A Notification token, if you allow notifications, which is the address Apple uses to reach this phone. And anything you Deliberately send us — a support note, a search that came back wrong, a report about somebody. There are no analytics SDKs, no ads, and no tracking. We cannot see your photos, and we don’t want to.

Signing in

Setting up Stills creates an account, and Sign in with Apple is the only way to make one. Apple gives us an account identifier and an email address, and you can choose to hide the real one and have Apple supply a relay address instead. There is no password to invent, forget, store or leak, because there isn’t one.

The address identifies the account and reaches you about the account itself: the sign-in code, and the confirmation link if you ever move the account to a new address. Nothing else is ever sent to it. It is never shown to anyone, including your friends. Sending those messages means an email provider handles the address, the way a letter passes through a postal service — we use Resend, and they process it for that delivery and nothing else. Codes expire ten minutes after they are sent.

You can change the address at any time, from Settings here or at stills.cam/account. A confirmation goes to the new address and nothing changes until it is clicked; the old address is told as well, because an email change is how accounts get stolen and both halves knowing about it is what stops it.

What syncs, exactly

Alongside the account we store one row about you: display name, handle, bio, birthday if you set one, and six counts — frames, rolls developed, places, current streak, best streak, and days shot. Two more counts are kept privately against your account: how many friends you have, and how many frames they have handed you. Those two are never shown to anyone, including your friends, and we only ever look at them added up across everyone — to tell whether people are meeting and swapping frames. We also keep a copy of the counts for each day the app talks to us, which is how we can tell whether Stills is being used and when an account was last active. Two kinds of image travel with it: your profile picture, and up to five cover frames you pick yourself. Those covers are the only photographs we can see, and only because you chose them for a profile other people are meant to see. Flicks you send a friend leave your phone too, but encrypted so that only their phone can open them — see Flicks. Everything else — every other frame, your rolls, your search index, Dailies, your locations — stays on the phone. Your friend list is stored as a list of account IDs so both sides can see each other; who you are friends with is visible only to you and to them. For a friend you swap flicks with, we also keep your streak: when each of you last sent one, and how many days in a row you both have.

Messages

You can write to a friend at any time, from anywhere. A message goes to our server, sits there until their phone collects it, and is Deleted as soon as it does — the conversation itself lives on the two phones having it, and we do not keep a copy, an index or a backup of it. A message nobody ever collects is deleted after thirty days.

Be clear-eyed about what that does and does not mean: while a message is in transit it is stored on the server as ordinary text, which means it is readable by someone who could reach the database. It is not end-to-end encrypted, and we would rather say so than imply otherwise. Nothing else about a conversation is stored — no history, no metadata beyond who it is for and when it was sent. A reaction to a message, a reply's reference to what it answers, and editing or unsending a line travel the same way, through the relay to their phone, and are deleted the moment it collects them. Unsending removes the line from both phones. Delivered and read receipts — word that their phone has your message, and that they have seen it — travel through the relay the same way and are deleted the moment they are collected; you can turn read receipts off in Settings, and then you do not see anyone else’s either.

You can only message someone you have already met in person and who has added you back, and that rule is enforced by the database. Photographs are not messages: a photo you send a friend goes as a flick, which is end-to-end encrypted and works differently — see Flicks.

One thing does copy a conversation off your phone, and only you can trigger it: Reporting somebody. A report sends us up to a dozen of that person’s most recent messages to you, because a report with nothing in it cannot be acted on and those messages exist nowhere else. It sends only Their side — what you wrote stays yours.

Flicks

A flick is a photo you take for a friend and send them to see once. It is Encrypted on your phone before it leaves, with a key that only their phone holds, which their phone published and signed with its own identity. Our server stores only those encrypted bytes, which we cannot open. Their phone collects it, and it is Deleted from our server within minutes of being opened, or after seven days if it never is. Once they have seen it, they may look once more within three minutes of opening it — the picture is held only in their phone's memory for that, never fetched again — and then it is gone from their phone as well.

Either of you can save a flick in your chat. A saved flick is kept on your two phones — never on our server — until either of you unsaves it, which removes it from both. To make that work, the phone that sent a flick keeps its own copy of it for two days, then deletes it unless it was saved. Either of you can also save a flick to Photos, as it looks, from the flick itself; if the friend it was sent to does, the sender is told. A reaction to a flick, saving or unsaving one, and saving one to Photos, travel between your phones through our message relay the way a message does, and are deleted the moment they are collected.

What we can see is the envelope, not the letter: who sent a flick to whom, when, and how big it was. We keep that only until it has been opened or has expired, plus a day so the sender can see it arrived. If they take a screenshot while it is open, you are told.

The First photos you take together when you become friends travel the same way: each phone takes its own, keeps it, and sends it encrypted to the other, so both of you keep both. Our copy is deleted as soon as it has been delivered.

If you Report a flick, your phone sends us the key to open that one flick, so we can see what was sent and act on it; the encrypted copy is then kept for up to 90 days (longer only where the law requires it). Nothing else anyone has sent can be opened by that key.

Notifications

If you allow notifications, Apple gives this phone an address — a device token — and we store it against your account so a friend’s message can reach you while the app is closed. It identifies the phone, not you, and it is useless to anyone who cannot also sign the request with our key. The notification carries the sender’s name and the first part of what they wrote, which is what makes it worth having; if you would rather it did not, iOS Settings can hide previews on the lock screen. A notification about a flick says only who sent it — never the photo, which is encrypted and which we cannot see.

Say no and nothing changes except that messages wait for you to open the app. The token is deleted when you sign out or delete your account, and Apple tells us to forget it if you turn notifications off or uninstall.

Blocking and reporting

You can block anyone you have added. A block is enforced by the database, not just hidden in the app: they cannot message you, they cannot see your profile, and the conversation is deleted from our server along with the friendship in both directions. To do that we store one row — that you blocked them — which is readable by you and by nobody else, including them. They are not told. You can undo it in Settings, though undoing it does not make you friends again; that still takes meeting in person.

Reporting is separate and optional, and it goes to the same place our support mail does. See Messages for exactly what a report carries.

Who can see your profile

Only people you have met in person and added — by touching phones, or by one of you scanning the other’s code. A friend code is a random number that works for three minutes; when someone scans it, we keep a note of who did for a week, so both phones hear about the friendship, and then delete it. Both sides must have added the other before either can read the other’s profile — that rule is enforced by the database, not just the app, so a one-sided claim reveals nothing. Stills has no browsing, no discovery, no search by name, and no public profiles. Your profile picture and covers are stored privately and served through short-lived signed links rather than public URLs, so nobody who is not your friend can reach them.

Capturing and developing

Photos you take are written to the app’s private storage on this device. The film “develop” — tone, grain, color — is computed by the app on your phone’s own processor. Rolls (the film in the camera and finished rolls waiting in the darkroom) are records kept in the same private storage. Developing a roll keeps every frame on it; frames you delete afterwards are removed from that storage.

What the intelligence reads

To make search and memories work, Stills analyzes each developed frame on-device: it recognizes text visible in the photo (signs, labels), classifies the scene (beach, food, night), counts faces (it does not identify who they are), writes a one-line caption, and computes numeric embeddings used to match your search words to images. All of this — the models and the index they build — runs and stays on your phone. Nothing about your photos is transmitted anywhere.

Search

When you search, your query is processed on-device against that local index: the words you type do not leave the phone. Time phrases (“sunset”, “last weekend”) are resolved against each photo’s capture time; place words against the photo’s own location tag; everything else against the local text, caption, scene, and image indexes.

There is One exception and it is yours to make. If a search comes back wrong you can tap Report on the results, and that sends us the words you typed, how many frames came back, and the identifiers and dates of the first few — so we can work out what went wrong. It sends no photographs. It happens only when you tap it.

Location, trips, and spots

If you grant location access, each capture is tagged with where it was taken, and the app groups located frames into trips and named spots — all computed locally from your own photos. If you never grant location, none of this exists. “Include location” under Capture controls whether coordinates are written into files you export; turn it off to keep exported files clean.

On a frame’s map you can open its place in Apple Maps, Google Maps or Waze. Only when you tap one, Stills hands that app the frame’s coordinates (and, for Apple Maps, its place name) through the app’s own public link. Nothing else goes with it, and we don’t see it. From there, that app’s own privacy policy applies.

Presence and friends

The Tap connects two phones directly over Bluetooth and local radio — phone to phone, in person. When you connect you exchange a display name, avatar, and a cryptographic public key so your phones recognize each other later, all stored locally on each device. Each phone also records the friendship on the server, which is what lets you see each other’s live profile afterwards. Scanning a friend’s code with the iPhone Camera instead of Stills opens a stills.cam link, which sends you to the App Store if Stills isn’t installed; that page keeps no record of the code. Removing a friend deletes your side on our server as well as your phone, and they stop being able to read your profile or message you; any flicks between you that were not yet opened are deleted. Blocking goes further — see Blocking and reporting.

Saving, sharing, and the date stamp

Saving writes the developed photo into your iOS Photos library (and, if enabled, a “Stills” album). Sharing hands the photo to the iOS share sheet — where it goes from there is up to you and the app you pick. The optional date-time stamp is burned into the exported image only when you turn it on in the save sheet. Exported files can include Exif metadata and location if those toggles are on.

Inviting people

The invite sheet hands a link — stills.cam — to whatever you choose: the iOS share sheet, Messages, an email you write yourself, the clipboard, or a Qr code. The Qr is drawn on your phone by the app; it is not fetched from a service, it carries no identifier, and scanning it tells nobody anything. We do not see who you invited, we never ask for your contacts, and an invite is not tracked back to you — there is no referral code in the link because there is no referral system.

Recaps and covers

Monthly memories, recap videos and featured picks are assembled on-device from your own frames using the local index. Nothing is curated by a server. A recap is edited on your phone too: Stills finds the subject of each frame you pick and cuts the video there. If you add a song, it comes from your music library or from a file you import; Stills reads it on your phone to find the beat and mixes it into the video there. Neither the song nor the video is uploaded. An imported song is kept in the app’s cache while you edit, and the video leaves your phone only when you save or share it. Profile covers are also chosen on-device — but unlike the rest, the covers you pick are uploaded, because their whole purpose is to be seen by your friends. Choosing none means uploading none.

Permissions, in context

Camera — taking photos and flicks, the first photo with a friend, and scanning a friend’s code; the one permission Stills can’t work without. Photos — saving developed frames and flicks to your library, and importing if you choose. Location — tagging frames with a place. Local network / Bluetooth — the Tap. Microphone — only if you use voice dictation in chat, and speech is transcribed on-device. Media and Apple Music — only if you add a song to a recap from your music library; Stills reads the one song you pick and nothing else in your library. Each is requested when first needed and can be changed anytime in iOS Settings; the related feature simply switches off without it.

Backups

Stills data lives in the app’s storage, so it rides along in the device backups You control — iCloud Backup or a computer backup — under Apple’s terms. Stills never uploads your library. The app can also export a single backup file you keep yourself, and it includes the first photos with your friends. That file is Encrypted with a key held for your account, so it can only be opened by signing in as you — a backup that ends up in the wrong hands cannot be read. That key is stored on our server and is readable by nobody but you, including your friends.

What we don’t do

We don’t sell your data. We don’t show ads. We don’t fingerprint or track you across apps or websites. We don’t collect analytics about how you use the app. We don’t train models on your photos — we do not have your photos. We don’t read your profile for any purpose beyond showing it to the friends you chose.

Children

Stills is not directed to children under 13. Using Stills requires an account, created with Sign in with Apple, which is governed by Apple’s own age rules. If you believe a child under 13 has created an account, contact us and we will delete it.

Your control

An account is required to use Stills, and you can close it whenever you like. Settings gives you the full set of levers: see exactly what’s stored under Storage, clear the image cache, export every frame, back up everything, reset your local profile — which permanently erases your photos, profile, friends and index from the device — and Delete your account, which removes your profile, profile picture, covers, backup key and every friendship from the server for good. The two are separate on purpose: deleting your account does not touch your photographs, and resetting the device does not close your account. Deleting the app erases the device half. There is no other copy of your photos anywhere to chase.

Changes to this policy

If the app ever changes how it handles your information, this policy and the date above change with it, and material changes will be surfaced in the app — not buried.

Contact

Questions about privacy? Email Neurovia at [email protected]. We read every note.