Privacy Policy
Last updated: 23 September 2026
PhotoSendr helps you send photos to the people who always want them — and it does almost all of it on your device. It has no accounts and no analytics. Your photos leave your phone only when you send them, or when you create an iCloud share link.
In short No accounts. No tracking. No analytics. No advertising. We don't collect your photos, your recipients, or any personal information. Things leave your device only when you send them — or, on a share page, when someone you gave the link to orders prints of the photos you shared.
What PhotoSendr works with
PhotoSendr works with photos and videos you choose — taken with the camera inside the app or picked with Apple's out-of-process photo picker (which shows the app only the items you pick, never your whole library). All editing (crop, rotate, black & white), video compression, and PDF creation happens on your device using Apple's frameworks.
What is stored on your device
- Your sets — the photos and videos you add to your sets are kept in the app's private storage on your device so they're still there when you come back. Deleting an item or a set in the app removes it.
- Your defaults — the recipient list, email subject, and message you save in Settings live on your device only.
- Saved edits — when you tap Save, the edited photo is written back to your own photo library.
- Your cards — a card you make from a gallery is kept on your device so you can send it again or edit it later: the design and words you chose, copies of the photos on its front (or the artwork, if you made one), a small picture of the finished front, and the gallery address its code points to. Deleting a card in the app deletes all of it. Nothing about a card is uploaded — printing, emailing and sharing a card all happen from your device, through your own apps.
- Your share links — the list of links you've created is stored on your device so you can keep track of them and expire them: the address, the title, the expiry date, how many items went in it, which set it came from, and a few small thumbnails so the list can show you what you sent.
The developer has no access to any of this.
How sending works
When you share by email or the share sheet, PhotoSendr hands your photos (or the PDF it builds from them) to your own Mail compose window or the iOS share sheet. The email goes out through your email account; AirDrop and other shares go through Apple's system features. PhotoSendr never sends anything on its own, and never sees or stores what you send. (Ordering prints from a share page is the one exception, and only when someone taps Print and confirms — see Ordering prints.)
iCloud share links (Pro)
When you create a share link, what you're sharing is uploaded to the app's public iCloud (CloudKit) database — container iCloud.com.fbmore.PhotoSendrV2 — under a random, unguessable address: the photos, videos and files in the current set, or the PDF when you're sending one, plus a small cover image the app makes from the first item so the link shows a picture when you paste it somewhere. There is no directory or search: only someone you give the link to can open it, in any web browser, with no account or app.
- You stay in control. Links expire automatically after 7 days, and you can stop sharing any link earlier from Settings → Shared Links; that deletes the uploaded copies.
- What's uploaded is exactly what you chose to share: the media and files, or the PDF, the cover image for the link preview, a title, and the expiry date. No names, emails, or identifiers travel with it.
- View counts. To show you how many times a link was opened, the viewer page pings a small counter service that stores only a random link ID and a number — no IP addresses, no location, no cookies, nothing about the viewer or about you.
- Downloads. The viewer's download buttons fetch files directly from Apple's iCloud. When a browser blocks that direct fetch, the bytes pass through a small relay we run on Cloudflare; it streams the file and stores nothing — no copies, no content logs.
- Reporting. Every shared page carries a "Report this share" link that opens an email to us containing the link's address, so we can delete a reported share from iCloud. We receive only what the reporter chooses to send.
Card artwork with Image Playground (optional)
On iOS 27, on devices that support Apple Intelligence, you can make a card's front picture with Image Playground, Apple's own image feature. This is entirely optional and easy to avoid: the card designs work from your photos exactly as before, the AI option appears as a separate choice you have to pick, and nothing is generated unless you ask for it. Where Image Playground isn't available, the option isn't shown at all and nothing about the app changes.
- Apple runs it, not us. When you choose it, PhotoSendr opens Apple's own Image Playground screen and hands it the photo you picked as a starting point, plus the occasion of the card design (for example "Winter holiday card") as a suggestion you can remove. What you type there goes to Apple, not to us. Apple describes how it handles that in its own privacy policy; generation runs on your device or through Apple's Private Cloud Compute.
- We never see it. PhotoSendr receives only the finished picture you accept, and saves it on your device with the card. There is no PhotoSendr AI service, no API key, and no server of ours involved at any point.
- It stays on your device. Generated artwork is stored alongside your cards, deleted when you delete the card, and leaves your phone only inside a card you choose to send, print or share.
- Your photos are not used to train anything by us. We do not collect, receive, or have any access to the photos you start from or the pictures Apple makes.
Ordering prints
A share page can offer prints of the photos in it. Anyone holding the link can order — that is the point, so a grandparent can get prints without installing anything — which also means anyone you give a link to can order prints of what you shared. Nothing is sent until they choose photos and confirm on a screen that says where the photos are going.
- Prints posted to you. The photos you pick go to our printing partner, who makes them and posts them; for US orders they are printed in the US. Your name and delivery address are collected by Stripe at checkout and passed to the printer so they can address the parcel. We never see your card details, and we don't keep the address — only the country, so we know where orders go.
- Prints collected from a shop. Where prints are offered for collection, copies of the chosen photos are sent to that shop, who handle store choice, price and payment on their own checkout, under their own privacy policy. We pass the photos through and keep no copy.
- What we keep. For each order: which link it came from, how many photos, the print size, the delivery country, whether it succeeded, and the email address given at checkout — kept for 90 days so we can send order updates and answer questions. No names, no postal addresses, no photos.
- Cancelling. A posted order can be cancelled and refunded from your order page for about two hours, until the printer starts. The link is in your confirmation email.
- Emails about your order. We email you when the order is placed, when it is dispatched (with tracking where the postal service provides it), and if anything goes wrong and we refund you. Those emails include a link back to the gallery you ordered from — the same link you already had. Nothing else is sent to that address, ever.
- Counts. We count, per day, how many people opened the print screen and how many orders started. Totals only: nothing about who, and nothing joined to a person or a link.
- Payment. Print orders are paid on the partner's own checkout. We never see card details.
Device permissions and why
- Camera — to take photos, record videos, and scan documents inside the app, only when you choose the camera or the scanner. Scanning uses Apple's on-device document camera; the resulting PDF stays on your device like everything else.
- Microphone — only while you're recording a video with the in-app camera, to capture its sound. Nothing is recorded in the background.
- Photo library picking — uses Apple's system picker, which runs outside the app and needs no permission: the app receives only the photos and videos you pick.
- Photo library (read, optional) — the new-set welcome screen can show your three latest shots on its quick-pick button. That preview is the only thing read access is used for; it never leaves your device, and declining just shows an icon instead. Picking photos itself still needs no access.
- Photo library (add) — only to save edited photos back when you tap Save.
- iCloud — used only when you create a share link, to upload that share to the app's public database.
What we do not collect
- No account, sign-in, name, email, or phone number is required or collected.
- No analytics, usage tracking, or advertising SDKs of any kind. The only numbers we keep are per-link view counts and per-day print totals, described above.
- No location data.
- Your photos, recipient addresses, and messages are never sent to the developer. The one time photos reach a company other than Apple is a print order somebody places from a share page, and then they go to the print partner, not to us.
- No AI service of ours, and no prompts, photos or generated pictures sent to one. The optional Image Playground feature is Apple's, runs only when you choose it, and can be ignored entirely.
Purchases
PhotoSendr is free for 3 sets of up to 10 items each, with one short video per set and one live share link at a time. PhotoSendr Pro (unlimited sets, larger sets, full-length videos, unlimited share links) is an optional purchase — a monthly or yearly auto-renewing subscription or a one-time lifetime unlock — processed entirely by Apple through your App Store account. The app never sees your payment details.
To manage subscriptions and restore purchases, the app uses RevenueCat, which receives purchase receipts tied to a random anonymous identifier — never your name, email, or Apple ID. If you bought PhotoSendr before version 5, the app detects that on-device through Apple's receipt and unlocks Pro for free; nothing is sent anywhere for this.
Third-party code
PhotoSendr includes two libraries: Lottie, used solely to render the app's animations (collects nothing, makes no network requests), and the RevenueCat SDK described above, which is contacted only for purchase management.
Children
PhotoSendr is not directed at children and collects no personal information from anyone.
Changes
If this policy changes, the updated version will be posted on this page with a new date above.
Contact
Questions? Email [email protected].