what we collect

your photographs

When you finish a roll, the 24 frames are uploaded and stored in Cloudflare R2, our object storage, so that they can be developed and printed. This is the core of the service — we cannot mail you prints without receiving your images. Both your originals and the developed versions are kept.

The app deliberately does not write your frames to your device's camera roll, and there is no in-app gallery. Once your prints are delivered, the digital copies unlock in the app for you to keep.

your rolls and orders

We keep the record of your account's activity: roll names, remaining credits, gift codes, order status and the carrier's tracking number. This is what lets the app tell you where a roll has got to, and lets us answer you when something goes wrong.

where to send the prints

To fulfil an order we need a recipient name and a full mailing address. For gift rolls, that is the recipient's address rather than yours. We currently mail within Canada only.

purchase information

Rolls, doubles and gift codes are paid for by card. Your card details go directly to Stripe and never reach our servers. What we hold is a Stripe customer identifier and the reference ids for your payments and subscriptions — enough to support, reprint or refund an order, and nothing that could be used to charge a card.

your account

You sign in with Apple. Apple gives us an identifier unique to FrameWorthy and, depending on the choice you make when signing in, either your email address or one of Apple's private relay addresses. We never see your Apple password. If you used a relay address, we can reach you about your order without ever knowing your real email. We also store the session tokens that keep you signed in.

Gift rolls work differently: the code is the credential, so whoever redeems one does not need an account of their own to shoot a roll and receive prints.

Our servers record ordinary technical information when the app or website talks to them, such as IP address, timestamps and error details. This is how we keep the service working and diagnose faults.

notifications

If you allow notifications, Apple issues a device token which we store so we can tell you when your roll has developed and when your prints are on their way. That token and each message are passed to Apple's Push Notification service for delivery. Turn notifications off in iOS Settings and we stop sending them.

analytics and crash reporting

The iOS app uses Sentry to report errors and crashes so that we can fix them. Sentry receives device and diagnostic details — your device model, operating system version, app version, and the technical trace of whatever failed. It does not receive your photographs.

This website itself runs no analytics, sets no cookies of its own, and loads no tracking scripts.

why we use it

• To develop your roll and produce your prints.
• To package and mail your order to the address you gave us.
• To take payment, and to honour gift codes and unused rolls held on your account.
• To tell you when your roll has developed and when your prints have shipped.
• To answer you when you contact us about an order.
• To keep the service running, secure and free of abuse.
• To meet our legal and tax obligations.

Your photographs are used for one thing: producing and delivering your prints. We do not use them for marketing, we do not use them to train machine-learning models, and we do not permit anyone we work with to do either.

who else touches your data

We share what is necessary with the companies that help us run the service, and nothing more. We do not sell your personal information, and we do not trade your photographs.

• Printing and mailing. Prodigi, our print partner, produces your prints and passes them to the postal carrier. They receive the images to be printed and the delivery address, and delete the files a short time afterwards.
• Hosting. Your account, shipping address and order records live in a Postgres database on Railway. Your photographs are held separately, in Cloudflare R2. Our website is served by Cloudflare, which processes request data such as IP addresses in order to deliver and protect the site.
• Payments. Stripe processes your card payment, and holds the card details we never see.
• Sign-in and notifications. Apple, when you sign in with your Apple account, and Apple's Push Notification service, which receives your device token and the messages we send you.
• Error monitoring. Sentry, which receives the device and diagnostic details described above.
• Fonts. This website loads its typefaces from Google Fonts, so Google receives your IP address and browser details when a page loads.

We may also disclose information if the law requires it, or to protect our rights and the safety of our users.

where your data is held

We are based in Canada and we mail your prints within Canada, but your data itself is not stored in Canada. We would rather say that plainly than bury it.

• Your account, shipping address and order records are in a Postgres database hosted on Railway in the western United States.
• Your photographs are in Cloudflare R2, set to the eastern North America region. That setting is regional rather than national: it keeps your images in that region, which spans both Canada and the United States, without guaranteeing either country.
• Stripe processes your payment from the United States.
• Sentry stores crash and error diagnostics in the United States.
• Prodigi, our print partner, is headquartered in the United Kingdom and routes each order to a lab near the delivery address — for Canadian addresses, currently its North American facility. Its data processing terms state that data may be stored and processed in the United Kingdom, the EEA, the United States, Australia and other countries in which Prodigi, its group companies, and its fulfilment, logistics and technology providers operate. Prodigi does not publish which individual labs it routes work to, and states that routing changes over time. It acts as our processor, which means it may only use your data to carry out your order.

This means your information may be stored or processed outside Canada, where it can be subject to the laws of that country, including lawful access requests by its authorities. We choose providers that commit by contract to protecting your information, but we cannot exempt them from the law where they operate.

how long we keep it

Because your digital copies unlock after delivery, your photographs necessarily outlive the print run.

• Photographs: kept for as long as your account exists, so that your unlocked digital copies stay available to you. Delete a roll, or your whole account, and we remove them.
• Shipping addresses and order records: kept for seven years, because tax and accounting law requires us to be able to produce transaction records for that long.
• Server logs: kept for seven days, after which our hosting provider discards them automatically.
• Files held by our print partner: Prodigi keeps your image files for as long as it needs them for production, quality control, reprints and support, and then deletes them or renders them inaccessible. It does not commit to a fixed period. It also keeps its own order and production records for its legal, accounting and dispute-handling purposes.
• Database snapshots: we do not keep snapshots on a rolling schedule. Where a snapshot has been taken, content you deleted can remain inside it until that snapshot is removed.

your choices

Under Canadian privacy law (PIPEDA) and comparable rules elsewhere, you can ask us to:

• Tell you what personal information we hold about you.
• Correct anything that is wrong.
• Delete your photographs or your account.
• Give you a copy of your data.
• Withdraw consent, though we may then be unable to complete an order in progress.

Write to privacy@frameworthy.ca and we will respond within 30 days. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada.

Deleting your account removes your photographs and your profile. The record of past transactions — what was bought, when, and where it shipped — has to survive longer, because tax and accounting law requires us to keep it. Those records are not used for anything else, and they do not include your card details, which we never held.

One practical limit worth stating plainly: once a print is in the post we cannot recall it, and once an order has gone to our printer we may not be able to pull the images back before they are produced.

keeping it safe

Your images and personal details travel over encrypted connections and are stored on access-controlled infrastructure. No system is perfect, but we treat your photographs as private by default — which is why the app has no public feed, no sharing surface and no gallery.

children

FrameWorthy is not intended for children under 13, and we do not knowingly collect their personal information. Where local law sets a higher minimum age for consenting to this kind of processing — 16 in some countries — that higher age applies instead. If you believe a child has sent us photographs, write to us and we will delete them.

changes to this policy

If we change how we handle your information we will update this page and move the date at the top. If a change is significant, we will tell you in the app rather than rely on you noticing.

contact

Questions, requests or complaints about privacy go to privacy@frameworthy.ca, or by post to:

FrameWorthy
PO Box 209
288 Main Street
Bloomfield, Ontario  K0K 1G0
Canada