Your photos stay on your phone.

The short version

Stills is a film camera and personal memory app made by Neurovia. Your photographs live on your device and are never uploaded — not to us, not to anyone. The one thing that leaves your phone is your profile: your name, handle, bio, birthday, profile picture, the cover frames you choose, and how many frames, rolls and places you have. That exists so the friends you meet in person can see who you are. There are no analytics SDKs, no ads, and no tracking. We cannot see your photos, and we do not want to.

What syncs, exactly

Setting up Stills creates an account, using Sign in with Apple. It is required, and it is the only sign-in there is: no password to invent, no email to confirm. Apple gives us an account identifier and an email address — you can choose to hide the real one and Apple will supply a relay address instead. We use the email only to identify the account; we never send you anything with it, and it is never shown to anyone.

Alongside it we store one row about you: display name, handle, bio, birthday if you set one, and three counts (frames, rolls, places). Two kinds of image travel with it — your profile picture, and up to five cover frames you pick yourself. Those covers are the only photographs that ever leave your device, and only because you chose them for a profile other people are meant to see.

Everything else — every other frame, your rolls, your search index, Dailies, your locations — stays on the phone. Your friend list is stored as a list of account identifiers so both sides can see each other; who you are friends with is visible only to you and to them.

Who can see your profile

Only people you have met in person and added by touching phones. Both sides must have added the other before either can read the other's profile — that rule is enforced by the database, not just the app, so a one-sided claim reveals nothing.

Stills has no browsing, no discovery, no search by name, and no public profiles. Your profile picture and covers are stored privately and served through short-lived signed links rather than public URLs, so nobody who is not your friend can reach them.

Capturing and developing

Photos you take are written to the app's private storage on your device. The film develop — tone, grain, colour — is computed by the app on your phone's own processor. Rolls, both the film in the camera and finished rolls waiting in the darkroom, are records kept in the same private storage. Frames you toss on the develop contact sheet are deleted from that storage.

What the intelligence reads

To make search and memories work, Stills analyses each developed frame on the device: it recognises text visible in the photo (signs, labels), classifies the scene (beach, food, night), counts faces without identifying who they are, writes a one-line caption, and computes numeric embeddings used to match your search words to images. All of this — the models and the index they build — runs and stays on your phone. Nothing about your photos is transmitted anywhere.

Search

When you search, your query is processed on the device against that local index: the words you type never leave the phone. Time phrases such as "sunset" or "last weekend" are resolved against each photo's capture time; place words against the photo's own location tag; everything else against the local text, caption, scene and image indexes.

Location, trips and spots

If you grant location access, each capture is tagged with where it was taken, and the app groups located frames into trips and named spots — all computed locally from your own photos. If you never grant location, none of this exists. "Include location" under Capture controls whether coordinates are written into files you export; turn it off to keep exported files clean.

Presence and friends

The Tap connects two phones directly over Bluetooth and local radio, phone to phone, in person. When you connect you exchange a display name, avatar and a cryptographic public key so your phones recognise each other later, all stored locally on each device. Each phone also records the friendship on the server, which is what lets you see each other's live profile afterwards.

Frames shared between phones travel over the direct link and are stored only on the two devices involved; they are never uploaded. Removing a friend deletes your side, and they stop being able to read your profile.

Saving, sharing and the date stamp

Saving writes the developed photo into your iOS Photos library, and into a "Stills" album if you enable it. Sharing hands the photo to the iOS share sheet — where it goes from there is up to you and the app you pick. The optional date and time stamp is burned into the exported image only when you turn it on in the save sheet. Exported files can include EXIF metadata and location if those toggles are on.

Recaps and covers

Monthly memories, recap films and featured picks are assembled on the device from your own frames using the local index. Nothing is curated by a server. Profile covers are also chosen on the device, but unlike the rest, the covers you pick are uploaded, because their whole purpose is to be seen by your friends. Choosing none means uploading none.

Permissions, in context

• Camera — taking photos. The one permission Stills cannot work without.
• Photos — saving developed frames to your library, and importing if you choose.
• Location — tagging frames with a place.
• Local network and Bluetooth — the Tap.
• Microphone — only if you use voice dictation, and speech is transcribed on the device.
• Notifications — one optional daily nudge.

Each is requested when first needed and can be changed at any time in iOS Settings. The related feature simply switches off without it.

Backups

Stills data lives in the app's storage, so it rides along in the device backups you control — iCloud Backup or a computer backup — under Apple's terms. Stills never uploads your library.

The app can also export a single backup file you keep yourself. That file is encrypted with a key held for your account, so it can only be opened by signing in as you. A backup that ends up in the wrong hands cannot be read. That key is stored on our server and is readable by nobody but you, including your friends.

What we do not do

We do not sell your data. We do not show ads. We do not fingerprint or track you across apps or websites. We do not collect analytics about how you use the app. We do not train models on your photos — we do not have your photos. We do not read your profile for any purpose beyond showing it to the friends you chose.

Children

Stills is not directed to children under 13. Creating an account requires Sign in with Apple, which is governed by Apple's own age rules. If you believe a child under 13 has created an account, contact us and we will delete it.

Your control

An account is required to use Stills, and you can close it whenever you like. Settings gives you the full set of levers: see exactly what is stored under Storage, clear the image cache, export every frame, back up everything, reset your local profile — which permanently erases your photos, profile, friends and index from the device — and delete your account, which removes your profile, profile picture, covers, backup key and every friendship from the server for good.

The two are separate on purpose: deleting your account does not touch your photographs, and resetting the device does not close your account. Deleting the app erases the device half. There is no other copy of your photos anywhere to chase.

Changes to this policy

If the app ever changes how it handles your information, this policy and the date above change with it, and material changes will be surfaced in the app, not buried.

Contact

Questions about privacy? Reach Neurovia at [email protected]. We read every note.