Your photos, your call.

Who we are

trycheese is a film camera app for iPhone and Android. It’s run by [To fill in: legal name of the company or person running trycheese (the data controller), registered address and country]. In this policy, “we” and “us” means them.

Questions about your data go to hello@trycheese.app. [To fill in: how quickly we answer requests to access, export or correct data]

[To fill in: Data Protection Officer, Grievance Officer (India DPDP Act) or EU or UK representative, if any]

What works without an account

You can take 5 photos without an account. After that, the camera asks you to sign in before it takes more. Signing in is free and removes the limit.

Signed out, you can still use the looks and your recipes, save to Photos or your gallery, and share through your phone’s share sheet. Community needs an account: the feed, sharing a post, likes, reports and blocks.

The 5-photo limit is counted on your phone. The usage events described below also tell us each time a photo is taken, signed in or not.

Even signed out, the app sends a little usage data to our server. See app usage and device info.

What stays on your phone

• Every photo you take is saved as a private copy inside the app. If you let trycheese add to Photos on iPhone or your gallery on Android, it goes there too (on Android, in an album called trycheese). Turn on Also save the original and the unedited shot is saved there as well.
• On iPhone, trycheese asks only to add photos. It can’t see the rest of your library.
• Your settings and recipes are stored on the phone.
• The Share button opens your phone’s share sheet with the app’s own copy. It doesn’t go through our servers.
• If you use your phone’s own backups (iCloud, or Google on Android), they can include trycheese’s app data: the photos inside the app, your settings and recipes, and the app’s install ID. Apple or Google keep those backups under your account, not us.

A photo reaches our servers only when you share it to Community or pick it as your profile photo.

Location

Add location is off by default. Turn it on and the app asks for your location only while you’re using it. The position goes into the copy saved to Photos or your gallery, and nowhere else. If you share that copy from your Photos app yourself, the location goes with it.

The app’s own copy, the one Share and Community use, never gets your location. The app never sends us your current location, in any request or in usage data.

A profile photo is different: you pick it from your library, and the app uploads it with whatever details the photo already holds, which can include where it was taken. Our server strips all metadata, location included, when it makes your profile photo, and then deletes the upload. It strips shared Community photos the same way.

What we collect and why

Some data reaches our server when you sign in, share, or just open the app. Here’s all of it.

Signing in

There are three ways to sign in. There’s no password.

• Email code. We store your email address. Each time you ask for a code, we store the address, a one-way hash of the code (never the code itself), how many tries were used, when it expires and was used, your IP address and the time. Codes are 6 digits and work for 10 minutes.
• Sign in with Apple (iPhone). Apple tells us an account ID, your email address and whether it’s verified. The address may be an Apple private relay address. On your first sign-in Apple can share your name: we keep only your first name, as your display name. Apple doesn’t share a photo. Your phone also gives us a one-time code from Apple. Our server swaps it with Apple for a refresh token and keeps that token encrypted. We use it only to end trycheese’s Sign in with Apple access when your account is deleted for good. A newer Apple sign-in replaces it.
• Google (iPhone and Android). Google tells us an account ID, your email address and whether it’s verified, your name and your profile picture’s web address. We ask for nothing beyond that basic profile. A new account takes your name as its display name and your Google picture as its profile photo. The app signs out of Google on your phone straight after.

We check each sign-in’s identity token against Apple’s or Google’s public keys and don’t store that token. We use the email address from Apple or Google for your account only if they say it’s verified. For each linked sign-in we keep the provider, its account ID and the email address it sent us, verified or not, plus, for Apple, the encrypted refresh token.

The first time you use Apple or Google, it’s linked to any trycheese account with the same verified email. Otherwise you get a new account.

Why: to know it’s you, to slow down anyone spamming codes, and to disconnect Sign in with Apple when you leave.

Staying signed in

Each sign-in gives the app a key that lasts 15 minutes and a refresh key that renews it. Each time the app renews its key (about every 15 minutes while you use it), we store a new record: a one-way hash of the new refresh key, when it was made, when it expires or was ended, your IP address and the user agent the app sends (today that names only the network library the app uses, and its version). Older records are marked as ended, not deleted, so they build up a history of the IP addresses you used trycheese from. They stay until your account is deleted for good. We also note when your account was last active.

If the app has an install ID (see below), signing in links that install to your account. It stays linked after you sign out, until your account is deleted for good or another account signs in on that phone.

Why: to keep you signed in, and to let you sign out on every device at once.

Your profile

• Username: 3 to 24 characters, unique. You can change it twice every 14 days. To enforce that, we keep a record of each username you give up and when, linked to your account.
• Display name (up to 40 characters) and bio (up to 160).
• A profile photo, if you set one.

Other people see your username, display name and profile photo next to your posts. Your email address and bio are seen only by you and the trycheese team. Anyone can check whether a username is taken.

Your profile photo comes from your phone’s photo picker, which needs no Photos permission. The app shrinks it to at most 1600 pixels a side. Our server crops it to a 512 by 512 square, strips all metadata and deletes the upload. Setting a new photo or removing it deletes the old file.

If your photo came from Google, other people’s phones load it straight from Google, and Remove photo in the app doesn’t remove it yet. Email us and we’ll remove it.

Community posts

When you share a photo to Community, we receive:

• the photo: the app’s own developed copy, as a JPEG or PNG up to 15 MB
• a caption, if you add one (up to 300 characters)
• the name of the look
• your recipe, if the photo used one and you leave Include recipe on. A recipe carries its settings plus the name and notes you gave it.

Our server re-encodes every photo, removes all metadata (location included) and keeps two JPEGs: one up to 2048 pixels on the long side and a 640-pixel thumbnail. Once that’s done, the original upload is deleted. An upload that never becomes a post or profile photo (it couldn’t be processed, or you didn’t finish) isn’t deleted automatically yet: see how long we keep things. For each upload we also keep a short record: its storage name, file type, size and status.

We also store each post’s review status, its like and report counts, and when it was reviewed (and by which team member), approved or pinned.

Approved posts show in Community to people signed in to trycheese. They see your username, display name and profile photo, and the post’s caption, look name and time. If you include the recipe, their app receives all of it, including the name and notes you gave it. Their app also receives your account’s ID, a random code with nothing about you in it.

You can delete your own posts at any time, and that deletes their image files too.

Why: to run Community, and to review posts before they show.

Shared photos have public web addresses

Post photos and profile photos are served from our CDN. Their web addresses are long and random, but anyone who has one can open the image without signing in.

Our images are marked to be cached for up to a year, and deleting one doesn’t clear the CDN. So after you delete a photo, its web address can keep working from CDN caches, and copies can stay in browser and phone caches, for up to a year.

Likes, reports and blocks

• A like stores who liked which post, and when. Other people see only the count, never who liked.
• A report stores who reported which post, the reason (spam, nudity, harassment or something else) and an optional note of up to 500 characters. A report about someone’s name, username or profile photo is stored as a report on the post you saw it on. Reporting the same post again keeps one report, with your first reason, and adds anything new to its note.
• A block stores who blocked whom.

App usage and device info

On first launch the app makes a random install ID and keeps it on the phone. Each launch, it sends us that ID with the platform (iOS or Android), the app version, the OS version (on Android, the system’s kernel version) and your language and region setting (for example en_IN). We note when we first and last saw the install, and when you finished onboarding.

The app also sends a short list of events, in batches:

• the app opened
• onboarding started and finished, with whether camera and Photos access were allowed
• a photo taken, with the shooting mode and the look’s name (which can be a name you gave a recipe)
• a recipe created
• the sign-in prompt shown after your free photos
• Community opened
• a post shared, with whether it had a recipe and a caption

Our server records a few events of its own: signing up and signing in (with the method), a post created, an account deletion asked for (in the app or on this website) or cancelled, and an account deleted for good (with no account or install attached).

This runs even when you’re signed out. Once you sign in on a phone, that install stays linked to your account, even after you sign out, until your account is deleted for good or another account signs in on it. Events sent while you’re signed in are linked to your account too; events sent while you’re signed out are linked to the install. We don’t store your IP address with them.

Why: to count active installs, see where onboarding loses people and learn which features get used.

There’s no switch to turn this off yet. Uninstalling the app stops it. When your account is deleted for good, the events linked to it are deleted with it; the install record and events sent while you were signed out stay (see deleting your account).

Emails we send

We only email you about your account and your posts. We don’t send marketing emails.

• your sign-in code
• a welcome when you make an account
• your post was approved, restored, pinned, not approved or removed, with the reason if there is one
• your account was put on hold (with the reason), or is back
• a code to confirm deleting your account, when you ask for one on trycheese.app/delete-account
• your account is scheduled for deletion, with the date and how to cancel
• your account’s deletion was cancelled because you signed in again
• your account is no longer on hold but is still scheduled for deletion
• a request to pick a new username, if the team reset yours
• your account was deleted for good, sent to the address it had (with Apple’s steps, if we couldn’t disconnect Sign in with Apple or Apple hasn’t confirmed it yet)

Post emails show the post’s thumbnail, look name and caption. Images in our emails load from our CDN. Accounts without an email address get no emails.

What we don’t do

• No ads.
• No tracking you across other companies’ apps or websites.
• We don’t sell your data.
• No ad, analytics or crash-reporting SDKs of our own. On Android, Google ML Kit, which runs portrait mode, sends Google some diagnostics about itself (see who handles data for us).
• No location tracking. The camera’s location goes only into the copy saved on your phone, and we strip all metadata, location included, from every photo we process.
• No reading your photo library on iPhone. trycheese can only add to it.

Who handles data for us

• Amazon Web Services (AWS). Our API and its database run on an AWS Lightsail server in [To fill in: the Lightsail region]. Shared photos are stored in Amazon S3 in the Mumbai region (ap-south-1) and served worldwide through Amazon CloudFront.
• Resend sends our emails, over an encrypted connection. [To fill in: the region of the Resend account and sending domain, and how long Resend keeps sent-email logs]
• Apple and Google run Sign in with Apple and Google sign-in, under their own privacy policies. Our server fetches their public keys to check sign-ins. For Apple, it also swaps the one-time code from your sign-in for a refresh token, and asks Apple to revoke that token when your account is deleted for good.
• Google ML Kit (Android only) finds the person in the frame for portrait mode. It runs on the phone, and your photos aren’t sent to Google. ML Kit does send Google diagnostics and usage data about itself: your phone’s maker, model and OS version, the app’s name and version, a per-install identifier that isn’t meant to identify you or your phone, performance and error information, and the size and format of what it processed. Google uses it to measure and improve ML Kit, under Google’s terms. On iPhone, portrait mode uses Apple’s Vision, which is part of iOS and also runs on the phone.
• Vercel hosts this website, trycheese.app, so it receives your IP address and the pages you ask for when you visit. When you use delete your account, the email address and code you enter, and your IP address, pass through Vercel to our server. [To fill in: the Vercel region the site runs in, and how long Vercel keeps request logs]

AWS, Resend and Vercel handle data only to provide their service to us, under data processing terms that require them to protect it at least as well as this policy does.

[To fill in: how data is protected when it leaves your country (CloudFront edge locations worldwide, Resend, Vercel, Apple and Google)]

How moderation works

Every new post waits for review. The trycheese team approves it, or turns it down with a reason. Community shows only approved posts, and never posts by people you’ve blocked, by accounts on hold or by accounts waiting to be deleted.

The team can also remove or restore a post, and pin up to 3. To do this they see reports, with the reporter’s username, and each author’s email address. Reports are private: other people can’t see who reported what.

Blocking someone hides their posts from your feed. They aren’t told.

The team can put an account on hold, with a reason. That signs it out everywhere, stops it signing in and hides its posts, and we email the reason. The team can also reset a username, remove a profile photo, sign an account out on all devices, or delete it. A deletion by the team happens straight away, without the 30 days.

A photo that’s turned down or removed stays in storage, at its web address, until you delete the post or your account is deleted for good.

When you share a post you give us a licence to show it in the community; the Terms of Use explain it. We don’t use your photos in ads or marketing without asking you first.

How long we keep things

Apart from code records, we don’t run automatic clean-up yet, so some records stay longer than they need to:

• Session records (IP address, user agent and times, one for each key renewal, including expired, renewed and signed-out ones) stay until your account is deleted for good.
• An upload that never became a post or profile photo stays in storage as it was uploaded, metadata included, until your account is deleted for good.
• Records of usernames you’ve given up, and when, stay until someone takes that name. While you have an account they’re linked to it; once it’s deleted for good, they aren’t.
• Usage events linked to your account stay until your account is deleted for good. Install records, events sent while signed out and the short deletion records described below have no time limit yet.
• Our server logs don’t record email addresses or codes. Our email provider keeps its own sending logs (see who handles data for us).

[To fill in: intended retention periods for installs, events, session records, unused uploads, old username records and deletion records, and whether we keep backups and server logs, and for how long (a deleted account can survive in a backup until it expires)]

Deleting your account

In the app, open Settings, tap your name under Account, then tap Delete account, and confirm. Without the app, use delete your account: enter the email address on your account and confirm with the code we send you. Your account is switched off straight away: every session ends, so all your phones are signed out, and your profile, posts and likes no longer show in trycheese. 30 days later it’s deleted for good. Signing in again before then, the same way you signed in before (email, Apple or Google), cancels the deletion and brings everything back. If your account is on hold, signing in won’t work: write to hello@trycheese.app instead. We email you when the deletion is scheduled and if it’s cancelled. Can’t use either and your account has no email address? Email hello@trycheese.app and tell us your username. [To fill in: how we check an emailed deletion request comes from the account’s owner]

At once: every session ends, so all your phones are signed out. The session records go with everything else after 30 days.

What’s deleted after 30 days:

• your account, profile, profile photo and your Apple or Google sign-in links (your username is held, see below)
• your posts and their image files, with their likes and reports
• uploads that never became a post or profile photo
• the likes you gave, the reports you filed and blocks in both directions
• records of sign-in and deletion codes sent to your email address
• usage events linked to your account: the ones the app sent while you were signed in, and the ones our server recorded for your account
• your Apple refresh token, once Apple confirms it’s revoked (see below)

What’s kept:

• a short record that an account was deleted: how it signed up, when it was made and when it was deleted. No email, name or username.
• your install record, which is no longer linked to your account, and usage events the app sent while you were signed out, which never were. Both are still linked to your phone’s install ID, which the app keeps using, so they’re unlinked, not anonymous.
• your username, held for 365 days so nobody can take it straight away, and records of usernames you gave up earlier. None of them are linked to you.
• an “account deleted” event with no account or install attached
• until Apple confirms the revoke: your Apple account ID and the encrypted refresh token, and nothing else about you

Copies of shared photos can also linger in caches for up to a year, as described above, and in any backups. Photos, recipes and settings on your phone aren’t touched. When the account is deleted for good, we send a confirmation to the email address it had.

Apple and Google sign-in

If you signed in with Apple, when your account is deleted for good, we also ask Apple to revoke trycheese’s Sign in with Apple access, using the refresh token described above. If Apple doesn’t confirm straight away, our server keeps trying for about 10 days, and the email confirming the deletion includes Apple’s steps in case it never does. If we have no token to do it with, the app shows Apple’s steps when you ask to delete your account, and the emails about the deletion include them. If we never got a token from Apple for your sign-in, or Apple never confirms, you can stop using Sign in with Apple with trycheese yourself, in your Apple Account settings.

Deleting your account doesn’t disconnect trycheese from your Google Account. Remove it yourself under Your connections to third-party apps & services in your Google Account.

Children

trycheese doesn’t ask for your age or date of birth, and has no age check. Signing in asks only for an email address, or Apple or Google.

[To fill in: the minimum age for using the app or having an account, and how children’s data is handled] (see the Terms of Use)

Keeping it safe

• The app talks to our API over HTTPS, and our emails go out over encrypted connections.
• The API and database accept connections only from the server itself. The outside world reaches the API through an HTTPS proxy.
• Sign-in codes and refresh keys are stored only as one-way hashes. If an old refresh key is ever reused, we end that session.
• Apple refresh tokens are stored encrypted, never in plain text.
• On your phone, the refresh key is kept in the iPhone Keychain (this device only) or Android’s encrypted storage. The short-lived key stays in memory.
• Sign-in, uploads, posts and reports are rate-limited.
• An account that’s on hold or waiting to be deleted loses access on its next request.

Think someone else got into your account? Open Settings, tap your name under Account, then tap Sign out on all devices, and email us.

Your choices and rights

In the app you can:

• keep Add location off (it’s off by default)
• edit your username, display name, bio and profile photo, or remove a photo you uploaded (to remove a photo from Google, email us)
• delete any of your posts
• block people
• sign out, or sign out on all devices
• delete your account, in the app or on our website

Usage data has no switch yet. Uninstalling the app stops it, and deleting your account deletes the events linked to it, as described above. Asked for a code but never made an account? Its record is deleted 30 days after it’s sent, or sooner if you email us from that address.

Depending on where you live, you may have rights to access, correct or delete your data, or to withdraw your consent. To ask, email hello@trycheese.app. [To fill in: governing law and jurisdiction, which privacy laws apply (for example India’s DPDP Act, GDPR or UK GDPR, CCPA), and the legal basis for each purpose above]

This website

trycheese.app has no analytics or tracking scripts and no sign-up. Its one form is delete your account: the email address and code you enter, and your IP address, pass through our website host (Vercel) to our server to check the request and limit abuse. We store the email address and IP address with the code record, and delete that record 30 days after the code is sent. Codes are stored only as a hash and work for 10 minutes.

For help, see support.

[To fill in: cookies on trycheese.app: the site has no analytics packages, but whether Vercel, our host, sets any cookies is unknown]

Changes to this policy

When this policy changes, we’ll update this page and the date at the top. [To fill in: effective date and version of this policy, the app version it covers, and how people will be told about changes]