Privacy Policy

PlusOne is operated by Alessandro Licata, Kernerstr. 64, 74076 Heilbronn, Germany. You can contact us at support@plusone.cam or +49 1563 0133877. The same provider details are published in our Impressum.

A host creates a “film”, chooses its settings and reveal time, and shares a QR code. Guests join through the App Clip or browser and contribute photos. The shared album remains hidden until the film develops.

Hosts

• Apple account identifier and, if Apple supplies it, your email address and name.
• Your display name and optional profile image.
• Film names, cover images, settings, capture and reveal times, and uploaded photos.
• When you take photos in your own film: a random identifier for your camera, stored only as a hash, so that your photos appear under your name.
• Purchase and entitlement information, including product, price, transaction and receipt information, and a random correlation identifier. We do not receive full payment-card details.

Guests

• A display name shown beside contributed photos.
• A random identifier generated for that film to count shots and restore the guest session. It is stored on your device (in the app in the iOS Keychain) and on our servers only as a hash. It is not a hardware identifier and is not used for cross-service tracking. If you use the app signed in, your guest memberships are also linked to your account (see Joined films and your account).
• Photos contributed to the film.
• Display names are unique within a film: when you join, we compare the name you enter with the names already in that film.
• If you leave a film, we record when. Your photos stay in the film and with the host (and with the other guests if the host shares the album); notifications for that film stop. Joining again on the same device, or signed in to the app on any device, restores your place.
• On the website, your browser remembers the last display name you used, to suggest it when you join another film. It stays in your browser.

Joined films and your account

If you use the PlusOne app signed in with Apple, the films you join as a guest belong to your account, so you get them back after deleting the app or on a new iPhone:

• We store which guest memberships belong to your account (your account identifier and when the link was made). A membership is only linked if the app holds its random guest identifier; a membership that is already linked to another account is never moved.
• When you sign in, all films joined on this iPhone without an account (before signing in or through the App Clip) are added to the account that signs in, also if someone else joined them on this iPhone.
• On a device that is missing one of your films, we create a new random identifier for that membership (stored on our servers only as a hash, at most 10 per membership), so you continue as the same guest with your name, photos and remaining shots. Earlier identifiers keep working.
• Signing out removes your linked films from that iPhone; signing in again brings them back. Films joined without an account stay on the device as before.
• Deleting your account removes these links and deactivates the identifiers created to restore them (see Account deletion).

Usage, technical and support data

• Limited first-party events such as opening the App Clip, joining a film, taking a photo, opening a developed album, creating a film and completing a purchase. These can include a film identifier, the random guest identifier, image dimensions, product identifier and the app or App Clip version; for joins also whether you joined through the app, the App Clip or the website and whether the invitation was a QR code or a shared link.
• Timestamps, IP addresses (for rate limits only as a hash), random guest identifiers and, for restoring joined films, your account identifier, used for security and rate limiting (for example uploads, joins and loading albums), plus normal request and security logs produced by our hosting providers.
• Email address, message, attachments and replies when you contact support.

Push notifications

Only if you allow notifications in iOS (the App Clip receives them for about 8 hours after you open it, without asking), we store for your device:

• the push token Apple issues to PlusOne for this device (app or App Clip);
• the app language (English or German) and the device time zone, so texts are in your language and nothing arrives at night;
• whether notifications are switched on, which types of notifications you switched off for this device, and which films the device belongs to: your host account, or the films you joined as a guest.

We use this only to send notifications about your films. Hosts: the first guest joined, photo milestones, one hour before the end, the film has developed, a reminder at 10:00 the day after the reveal if the album was not opened, when a free film is full and when a guest reported a photo. Guests: 30 minutes before the end and when the film has developed, unless they left the film. At most four per film and person (the reveal and reported photos do not count) and none between 23:00 and 08:00 local time, unless the host chose that reveal time. Notification texts contain the film name and, for hosts, a guest’s display name. We record that a notification was sent or opened as a usage event (its type only).

You can switch notifications, or single types of them, off at any time under Settings → Notifications in the app, or all of them in the iOS Settings. Notifications about reported photos can only be switched off together with all notifications.

Reporting photos

Guests who can see the other guests’ photos, and hosts, can report a photo. We then store which photo and film, when, whether a guest (their random guest identifier) or the host (their account identifier) reported it, and whether the host kept or removed the photo. Nobody is told who reported a photo: the host only sees that a photo was reported and when, and the person who took it is not informed. When a guest reports a photo, the host receives a notification (at most one per film per hour). Our team can see reports in our backend to check the photo.

Live Activity

While a film runs, the app or App Clip can show a Live Activity on the Lock Screen (film name, end time, shots left). It is created and updated on your device only; we do not receive or send anything for it. You can turn Live Activities off in the iOS Settings.

App Store ratings

After a host’s first reveal of a film with photos from several guests, the app may ask once per installation for an App Store rating, using Apple’s own dialog. Apple shows and handles it; we do not learn whether or how you rate. Only your iPhone notes that the request was made.

Uploaded photos may depict identifiable people. The person uploading a photo is responsible for having an appropriate basis to capture and share it.

• Providing PlusOne and processing purchases: performance of a contract or steps requested before entering one (Art. 6(1)(b) GDPR).
• Restoring joined films for signed-in users: providing the service you use (Art. 6(1)(b) GDPR).
• Providing the guest experience requested by a host: our legitimate interest in operating the shared event service (Art. 6(1)(f) GDPR).
• Security, abuse prevention and reliability: our legitimate interests (Art. 6(1)(f) GDPR).
• Push notifications: providing the service you use (Art. 6(1)(b) GDPR) for hosts and our legitimate interest in informing guests about the film they joined (Art. 6(1)(f) GDPR); only after you allowed notifications in iOS.
• Reports of photos: our legitimate interest in a safe service and in handling reports of unlawful or inappropriate content (Art. 6(1)(f) GDPR) and, where applicable, legal obligations (Art. 6(1)(c) GDPR).
• Limited product analytics: our legitimate interest in understanding and improving PlusOne (Art. 6(1)(f) GDPR). You may object to this processing.
• Support and legal obligations: your request, our legitimate interests, or compliance with law (Art. 6(1)(b), (c) and (f) GDPR).

We do not sell personal data, show advertising or track people across other companies’ services.

• Supabase: authentication, database, backend functions and private photo storage. The production database and origin storage are located in Frankfurt, Germany.
• Vercel: website, QR-link and guest-web hosting, delivery, request and security logs.
• RevenueCat: purchase and entitlement infrastructure. RevenueCat may receive the host account UUID, product, receipt and transaction history, the film correlation identifier, and limited device, operating-system, locale, currency and usage information.
• Apple: Sign in with Apple, App Store distribution and ratings, in-app payment processing and delivery of push notifications (Apple Push Notification service receives the push token and the notification text). Apple processes Apple Account and payment information under its own privacy terms.
• Email providers: delivery and processing of support correspondence.

Providers may use subprocessors. We do not permit them to use customer content for advertising.

Some providers and subprocessors may process limited data outside the EU/EEA, including in the United States. Where an adequacy decision does not apply, transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses and the contractual protections in our providers’ data-processing terms.

• Films and photos remain available while the film exists. Hosts can remove photos or delete films.
• Guest data is tied to the film and removed from the active service when that film is deleted.
• Account and purchase information is retained while needed to provide the account and related films. Transaction records may be retained longer for tax, accounting, fraud prevention or legal claims.
• First-party analytics events are kept for no more than 12 months, then deleted or aggregated.
• Rate-limit records are kept for no more than 24 hours.
• The example film (TRY234, on the website and in the App Clip): its photos, and guest entries without photos, are deleted after 24 hours.
• Links between guest memberships and your account are kept while the account and the film exist; identifiers created to restore a membership are deleted with the film.
• Push data: a guest’s film link is deleted when the film is deleted and one day after the film has developed (leaving a film only stops its notifications, so that joining again works); the device entry follows once nothing is linked to it any more. Signing out removes the link to your account; deleting the account deletes the device entries. Devices not seen for 180 days and tokens Apple reports as invalid are deleted. The record of sent notifications is deleted after 90 days.
• Photo reports are kept as long as the film exists and are deleted with it.
• Support messages are normally deleted within 24 months after resolution.

Restricted backups, caches and provider logs can retain residual copies for a limited period before they are overwritten or deleted.

You can initiate permanent deletion directly in the app: Settings → Account → Delete account. This deletes the PlusOne account, your own films with their photos, and your profile image from the active service, except records we must retain by law. Photos you took as a guest in other people’s films stay in those films with their host; the links between those memberships and your account are removed and the identifiers created to restore them are deactivated. You may also contact us for help with a deletion request.

Subject to the GDPR’s conditions, you may request access, correction, deletion, restriction and data portability; object to processing based on legitimate interests; withdraw consent; and complain to a competent supervisory authority. Email support@plusone.cam. We may need to verify your identity.

We use private storage, access controls, server-enforced reveal rules, encryption in transit and restricted administrative access. No internet service can guarantee absolute security.

PlusOne is not directed at children under 16. Contact us if you believe a child has provided personal data. We may update this policy as the service changes and will publish a new effective date here.