PHOLDLast updated 18 October 2026
Privacy policy
The short version: your photos stay on your phone. The only pictures that leave it are the print files of a roll you've paid for and handed in (or of a print you've ordered from your pictures), and they go to the lab that prints them. We need your name, address and email to post your prints and send your receipt. No ads, no tracking, no selling your data, no account.
This policy covers the Phold app for iPhone and this website, phold.photo. Phold is made by One Man Band Media DC LLC, a company in Washington, DC, United States ("we", "us"). We're responsible for your information. Write to eammon@phold.photo with any question or request.
What the app uses on your phone
The camera
Phold uses your iPhone's camera to "expose your film". The pictures you take are kept inside the app on your phone. Film pictures aren't shown to you until the prints arrive, but they're still only on your phone until you hand the roll in (see below).
To make focus look right, the app works out roughly where people are in a picture and how far away things are, using your phone's own image tools and, where the camera gives it, its depth reading. This all happens on your phone. It isn't used to recognise anyone, and nothing about it is sent to us.
Your photo library: adding only
When you copy a digital camera's pictures to your phone on the in-app laptop, Phold saves them to your photo library. It asks for permission to add photos only. It can't see, read or change the photos already in your library.
Location: not used
Phold doesn't ask for or use your location. (We've thought about using the local temperature to change how instant film develops. That isn't in the app. If we ever add it, the app will ask you first and this policy will say so.)
Things kept on your phone
Your rolls, your settings, the film you've bought and your progress are stored in the app on your phone. Deleting the app deletes them. The app also makes a random number for this install (not linked to you, your Apple ID or your device's own identifiers), used only to limit wrong guesses at unlock codes (see below).
What leaves your phone, and why
When you buy film: Apple Pay and Stripe
You pay with Apple Pay. In the Apple Pay sheet you choose a delivery name, postal address and email address. These, the order and an encrypted payment token from Apple Pay go to our server, which takes the payment through Stripe, our payment processor. Stripe also works out any sales tax and sends your receipt to your email.
We never see or store your card number. Apple Pay gives us a one-time token that only Stripe can use. Stripe may keep details such as your card type and its last four digits, as any payment company does. Apple's and Stripe's own privacy policies cover what they do as payment providers.
Our server keeps a record of each order: what you bought, the price, your delivery address and email, and a "ticket" for each roll, so the right roll can be printed and posted to the right place.
When you hand in a roll: the print lab, Prodigi
When you hand in a paid roll, the app makes the print files (your pictures, laid out on the paper as the camera prints them, plus the card that goes in your envelope) and uploads them to our storage. We then send the order to our print lab, Prodigi, with your name, delivery address and email address, and links to the print files. Prodigi downloads the files, prints them and posts them to you, and tells us how the order is going and its tracking. Prodigi works with labs in several countries and usually prints near where it's posted to. The same goes for anything else you order printed from your pictures.
A roll you haven't paid for is never uploaded. Its pictures stay on your phone.
Where it's stored: Supabase, in the US
Our server, database and print-file storage run on Supabase, in its US West (Oregon) region (Amazon Web Services, us-west-2). The print files are kept private and are reached only through short-lived links.
The card in your envelope
Each roll's card has a code that opens your digital copies. The code only exists on the printed card: we keep a scrambled one-way version of it (a hash), not the code itself, so even we can't read it back from our records. When you scan or type it, the app sends the code to our server, which checks it and sends back links to that roll's print files. The card holds no personal information.
To stop people guessing codes, the server notes each attempt with your IP address and the app's random install number, and allows only a few wrong codes an hour. The card also gives a 10% next-roll coupon, which our server keeps with the roll it came from.
When you share
Sharing your prints from the app uses your iPhone's share sheet. Whatever you share goes straight to the app you pick; it doesn't pass through us.
When you email us
If you write to eammon@phold.photo, we'll have your email and whatever you send us. Our email is hosted by Google Workspace.
Who gets your information
| Who | What for | What they get |
|---|---|---|
| Apple | Apple Pay; the App Store; TestFlight during the beta | Your payment, as Apple Pay handles it. If you opt in, Apple shares crash reports and beta feedback with us. |
| Stripe | Taking payments, refunds, working out tax, sending receipts | The payment token, the amount, your delivery address and email |
| Prodigi | Printing and posting your prints | Your print files, name, delivery address and email |
| Supabase (on Amazon Web Services) | Running our server, database and file storage | Everything our server keeps, on our behalf |
| Google Workspace | Our email | Emails you send us |
| Postal carriers | Delivering your envelope | Your name and address, as printed on it by the lab |
They act for us and may use your information only to do that job (and as the law requires). We don't sell your information, rent it, or share it for advertising. We'd only hand it to anyone else if the law made us.
During the private beta: if you use a beta invite code, a second copy of your prints is posted to Eammon, who makes Phold, and he can see your digital copies, so he can check how they turned out. The app asks you to agree to this before your beta roll is ordered, and records that you did. Only your first name and town go with the copy, never your full address.
What Phold doesn't do
- No ads.
- No analytics or tracking in the app or on this website, and no tracking across other apps and websites.
- No selling or "sharing" of personal information, as California law uses those words.
- No account, no sign-in, no profile.
- No access to your location, contacts, microphone or the photos already in your library.
How long we keep it
- Print files (your pictures as printed, and the card): kept for 90 days after the order, then deleted. That's long enough for the lab, for a reprint if something goes wrong, and for you to get your digital copies again on a new phone. Keep the copies you want once they've opened.
- Order records (what you bought, the price, your delivery address and email, the order's status and tracking): kept for as long as tax and accounting law requires us to keep sales records, then deleted.
- Unlock-code attempts (IP address and install number): kept only as long as needed to limit guessing.
- Emails you send us: as long as we need them to help you.
Stripe and Prodigi keep their own records for as long as the law requires them to.
The legal part (UK and EU)
If you're in the UK or the EU, data protection law (the UK GDPR and the GDPR) says we need a reason to use your information. Ours are: to carry out the order you placed (your name, address, email and print files); to meet our legal duties (keeping sales and tax records); and our legitimate interest in keeping the service safe (limiting code guessing).
Our server is in the US and Prodigi may print in another country from yours, so your information may be handled outside the UK or EU. Where that happens we rely on the safeguards the law provides, such as the standard contractual clauses in our providers' data processing terms.
Your rights
Wherever you live, you can ask us for a copy of the information we hold about you, to correct it, or to delete it (unless we must keep it, as with sales records). You can object to how we use it or ask us to limit it. Write to eammon@phold.photo and tell us which order it's about: the roll number on your envelope or card helps. We'll answer within a month. Because there are no accounts, we may ask you to confirm the delivery address or email from your order, so we know it's you.
If you're unhappy with how we've handled your information, you can complain to your data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country. We'd like the chance to sort it out first.
Californian and other US state residents have the right to know, delete and correct their information, and to not be discriminated against for asking. We don't sell or share personal information, so there's nothing to opt out of.
Children
Phold isn't made for children under 13, and we don't knowingly collect information from them. Buying film needs Apple Pay. If you think a child under 13 has given us their information, write to us and we'll delete it.
This website
phold.photo is a plain website with no cookies, no analytics, no tracking and nothing loaded from other sites. It's hosted by GitHub Pages, whose servers, like any web host's, see your IP address to send you the page and may log it for security.
Changes
If we change what Phold does with your information, we'll update this page and the date at the top. If it's a big change, the app will tell you too.
Contact
One Man Band Media DC LLC, Washington, DC, United States · eammon@phold.photo