Photohawk app: Privacy Policy

Version: 1.6.4
Effective date: 9 November 2026 (the launch list's "If you came from a Meta ad": 6 November 2026; how you join the launch list: 7 November 2026; where an iPhone install came from, and the launch list's forms in Facebook and Instagram, Twilio for phone codes, and signing in with Apple or Google: 8 November 2026)
Applies to: the Photohawk app for iPhone and Android (in the app stores as "Photohawk"; "the app"), the app's launch list on photohawk.com, and the services that support it.
Controller: CLOUDCONCUR LTD (company no. 13399913), trading as Photohawk, 23 Caldey Gardens, Ingleby Barwick, Stockton-on-Tees, TS17 5HW, United Kingdom ("Photohawk", "we", "us").
Published at: photohawk.com/personal/privacy

Photohawk finds the people in the photos on your phone, groups them, and helps you share photos and chat with the people in them. It is built so that most of what it does happens on your phone, and we receive as little as possible.

1. The short version

Your photo library is scanned on your phone. We don't receive your photos, what's in them, or your searches.
Faces are found on your phone; to group them, small face cut-outs go to your own collection in our cloud, where they are kept, encrypted. With your explicit consent (asked for before the app scans, and needed to use it), face cut-outs (never your photos or videos) go to our cloud face-matching service, run for us by Amazon Web Services in Ireland (EU). It keeps the cut-outs and the face templates made from them in a collection that holds only your faces, so new photos can be matched, your faces can be matched again without your phone sending them again, and we can look into a problem when we support you. "Delete all face data" deletes it all, within 24 hours. See the separate Face Data Policy.
Shared photos and chats are end-to-end encrypted. We store and deliver them but can't read them.
Photos leave your phone only when you share them, encrypted so that only you and the people you share with can see them, or when you order prints of them: then the photos you chose, at full size, go to our print partner to make and deliver your order, and only after you agree to it for that order (see "Print orders" below).
We hold what we need to run your account, sharing and subscription: your email address, who you share with, and your subscription status.
Staff access is limited and recorded. Only Photohawk's owner and support staff the owner names can see your account's details, or your face cut-outs, and only to support you or keep the service working. Every support action they take on your account is recorded.
No ads in the app, no selling of data, and the app doesn't track you across other companies' apps or websites. (One thing on photohawk.com: if you join the app's launch list from a Meta ad, we tell Meta a sign-up happened; see "The launch list on photohawk.com". And on iPhone, if you installed the app from one of our App Store ads, Apple tells our subscription provider which ad it was; see "Where an iPhone install came from" in section 3.)

2. What stays on your phone (we never receive it)

Your photo library and the scaled-down copies the app makes to scan it.
What the app finds in each photo and video, the groups of people and the names you give them, your corrections, birthdays and relationships you add, each face's estimated age range, and which phone contact you matched to a person (if you choose to). (Face cut-outs, the face templates made from them and which faces the cloud groups together are the exception: see "Cloud face matching" below.)
Your searches, and the text of your chats in readable form (we only ever hold it encrypted).
Your address book: the app can read it on the phone if you allow it, and never uploads it.
Your settings, such as "only scan while charging".

3. What we collect, and why

What	When	Why	Legal basis (EU/UK)
Account: email address, an account ID, and a password (handled by our sign-in provider in a form we can't read; we never see it). If you sign in with Apple or Google, they confirm who you are and pass us your email address (with Apple, possibly a private relay address that forwards to you), whether it is verified and the name on that account; we never see your Apple or Google password. The same Photohawk account works across Photohawk apps.	When you create an account (needed to share, receive, subscribe or order prints).	To sign you in and secure your account; to send account and service emails.	Contract
Sharing and chats: the name you give each person you invite, their email address or phone number, the invites you send and receive, who is in each chat, whether a chat is one to one or a group, and each share's settings (one time or automatic, "check before sending", stopped or active). An invite sent to an email address or phone number can only be accepted by an account that has shown it has that address, so with the invite we also keep a keyed, one-way code made from the address and a masked form of it; if the address isn't the one you signed in with, the app can send a 6-digit code to the invite's own address (by text message through Twilio, or by email through Postmark), and once you enter it we keep that address as a keyed, one-way code and a masked form, with when you confirmed it (at most 10 addresses). Confirming an address for an invite never makes you findable.	When you share, start a chat, accept an invite or confirm an invite's address.	To deliver invites, photos and messages, and to let you and the people you share with see and stop shares.	Contract; for recipients, our legitimate interest in delivering an invite they can accept or ignore
Shared photos and videos, messages, captions and album names: encrypted end to end on your phone. We store and forward them but can't read them. We can see technical details needed to deliver them (size, time sent, sender and recipient accounts, which message a reply answers), reactions (an emoji), when each photo or video reached each member's phone and, unless either of you turned read receipts off, when they saw it, when you last read a chat and whether you muted it. A web link to shared photos carries its key only in the link itself, never sent to us.	When you send them.	To deliver them to the recipients' devices and show the chat.	Contract
Reports and blocks: if you report a message, photo or person, the reason, your note, who is reported and, unless you turn it off, the reported message or photo as your phone shows it; and who you block.	When you report or block someone.	To keep chats safe: review reports and act on them, and stop blocked people reaching you.	Legitimate interests (safety); legal obligation where the law requires us to act on illegal content
Being found (optional): if you turn on "Find me by my email" or "Find me by my phone number" (off unless you turn them on), a keyed, one-way code made from that email address or phone number, a masked form of it to show you, and when you confirmed the number. To confirm a number, Twilio, our text message provider, texts it a 6-digit code (Twilio makes and checks the code; we send Twilio the number and your app's language, and while a code is waiting we keep only Twilio's reference for it with the keyed code and masked form of the number, never the code or the number itself). When someone taps one of their contacts to start a chat, the app sends us that one email address or number to check against these codes; we answer only whether that person is on Photohawk and chose to be found, and we don't keep or log the address checked. We never upload your address book.	When you turn it on, confirm a number, or tap a contact to check it.	To let people who already have your email or number see that you're on Photohawk, so photos and chats reach you straight away.	Consent (you can turn it off at any time in Settings)
Subscription: whether you have the Photohawk subscription, free trial and renewal dates, and store transaction IDs. We never receive card details: payment is handled by Apple or Google.	When you subscribe or restore.	To unlock your plan's features and handle free trials, renewals and refunds.	Contract
Where an iPhone install came from (Apple Ads): if you installed the app on an iPhone after tapping one of our ads in the App Store, which campaign, ad group and search keyword it was, its country and date, and whether it was a first download or a re-download. The app asks Apple for a one-time code that says this (Apple's AdServices; no tracking permission is needed and your advertising identifier is never used) and passes it to RevenueCat, which receives the details from Apple and keeps them with your subscription record, linked to your account. If you didn't come from one of our Apple ads, Apple only tells us that. Nothing about it goes to Meta, Google or any other advertising platform, and nothing is collected on Android.	When you sign in on an iPhone.	To see which of our App Store ads bring people who try or subscribe to Photohawk, and stop paying for ads that don't. Not to show you ads or build a profile of you.	Legitimate interests (measuring our own advertising)
Cloud face matching (biometric data; only with your explicit consent, which the app asks for before it scans and needs in order to work): small face cut-outs (160 pixels across) from your photos and videos, which we keep, encrypted (section 8); for each one, the app's own reference for the face, a code for its photo that means nothing outside your phone (so two faces of one photo are never matched to each other) and the face's size; the face templates the service makes from the cut-outs, which faces it groups together and how alike they are (similarity scores, each face's closest matches, possible matches the app asks you about); your consent record (version and time) and the country, and US state, you told the app you live in. Never your photos or videos, which photo a face comes from, names, birthdays, ages, relationships or corrections.	When you agree, and then as new photos and videos are scanned.	To group the people in your photos and videos and match new ones; to match your faces again from the kept cut-outs without your phone sending them again (for example when grouping improves, after a fault, or to fix two people mixed up or one person split in two); and to look into problems with your face grouping when we support you.	Explicit consent (GDPR Art. 9(2)(a))
Library counts (with cloud face matching): how many photos and videos the app has scanned on your phone and how many faces it found, and a random ID the app makes when it is installed (a new one if you reinstall it; not your device's identifier). Numbers only: never your photos, videos, faces, names, dates or places.	With cloud face matching, as the app scans.	To measure and control what cloud face matching costs to run (for example, to notice an app that sends the same faces again after it is reinstalled) and to set fair usage limits.	Legitimate interests (running the service at a sustainable cost)
Notifications: a push token for your device. A notification about a message or photo carries only an encrypted reference, opened on your phone. We pass notifications to Apple or Google, which deliver them, through Amazon SNS.	If you allow notifications.	To tell you about invites, messages, new shared photos and orders.	Consent (system permission)
Technical data: app version, operating system, and IP address in server logs.	When the app talks to our servers.	To run, secure and fix the service. Logs are kept for 30 days.	Legitimate interests
Support: what you send us.	If you contact us.	To help you.	Legitimate interests
Staff access for support: Photohawk's owner and support staff the owner names, each with their own sign-in and given access for this, can see in our internal support tool your account's email address, plan, free trial and subscription dates and history (from the App Store or Google Play, never card details), devices (type, app version, when last seen), how many chats you're in, and numbers about your cloud face matching and scans (faces matched, grouped or waiting, errors, costs, and the scan reports described below where your app sends them). Only the owner can take actions on an account (for example matching your faces again); every action is recorded with who took it, when and why. The tool shows no photos, videos, messages or names of people. Seeing face cut-outs is covered by "Cloud face matching" above and the Face Data Policy.	When we look into how the app is working for you, or fix a problem with your account.	To support you and keep the service working.	Legitimate interests; for face cut-outs, your explicit consent

Print orders and photo products

When you order prints, a framed print, a canvas or a photo book, the app asks you each time, before you pay: "To print, the full-size photos you chose are uploaded to our print partner. Nothing else leaves your phone." Nothing is sent until you agree and your payment has gone through.

What	When	Why	Legal basis (EU/UK)
Print files: the photos you chose for the order, as the app prepares them for printing (cropped as you chose; a photo book's pages laid out on your phone). Not encrypted end to end: the printer has to see them to print them.	After you agree for that order and your payment succeeds.	To make your order.	Contract
Order details: what you ordered, prices, the delivery method, order status and tracking, and your consent for the order (version and time).	When you order.	To fulfil, deliver and support your order; to keep sales records.	Contract; legal obligation (tax and accounting records)
Delivery details: the name, address, email address and (optional) phone number you enter at checkout.	When you order.	To deliver your order and send delivery updates; the courier may need your email or phone.	Contract
Payment: handled by Stripe. We receive the payment's status, amount and a reference, never your full card number.	When you pay.	To take payment and handle refunds.	Contract; legal obligation

Who gets it: Prodigi (Prodigi Group Ltd, United Kingdom), our print partner, receives the print files and the delivery details and makes your order in its lab nearest you (which may be outside your country, for example in the UK, EU, US or Australia), and passes your name, address and, where needed, email or phone to the courier that delivers it. Stripe processes your payment (Stripe's own privacy policy applies to the card details you give it, including Apple Pay or Google Pay).

How long: print files are deleted from our servers 30 days after your order is sent out (at once if the order is cancelled); Prodigi keeps them only as long as it needs them to make and deliver the order. Order records (items, amounts, dates) are kept as long as tax law requires (6 years in the UK); the delivery address, email and phone are removed from them when you delete your account, once the order has been delivered.

The launch list on photohawk.com

If you join the launch list on the Photohawk app's page on photohawk.com, we keep: your email address; that you asked to be emailed on launch day by pressing the button ("Email me on launch day", with "We'll email you once on launch day" right under it), and whether you also asked, with the separate "Also send me occasional updates" button shown after you join, for emails about app updates now and then; when you did, which version of that wording you saw, and the page's language; the country your visit came from (as our hosting provider sees it, a hint only); and where your visit came from: the campaign tags in the link you followed (such as utm_source), an ad click ID in it (Meta's fbclid or Google's gclid), the first page of your visit (without its query) and the website that sent you (its address without any query). No cookies are used for this: the page keeps where your visit came from in your browser's session storage (cleared when you close the tab) until you send the form. If you join through a sign-up form inside Facebook or Instagram (one of our ads that opens a form there), Meta passes us the email address you submit in it, and we keep it as above for the one launch email the form offers, with when you submitted it, which version of the form's wording you saw, and which of our ads the form was in (Meta's own privacy policy covers the form itself).

We use it to send the emails you asked for (through Postmark), and to see which of our ads and links bring people to the list. Your email address is never shared with Meta, Google or any other advertising platform. Only Photohawk's owner can see the addresses, and each look is recorded; anyone else sees counts. Every email has an unsubscribe link (and one-click unsubscribe in mail apps); unsubscribing deletes your address at once (we keep only an anonymous count). Legal basis: consent, for the emails (you can unsubscribe at any time); legitimate interests, for measuring our own advertising. Kept until you unsubscribe, ask us to delete it, or delete a Photohawk account with that address.

If you came from a Meta ad. If the link you followed came from an ad on Facebook or Instagram (it carries Meta's ad click ID, fbclid), then when you join the list our server tells Meta that a sign-up happened (a "Lead" event), with: that ad click ID, your IP address, your browser type (its user agent), the address of the page you signed up on (without any query), the time, and a random reference for the sign-up. We never send Meta your email address (not even scrambled, or "hashed"), your name or anything else about you, and we don't keep your IP address or browser type with your sign-up. We do this so we can count which of our ads bring people to the list and stop paying for ads that don't. Meta receives it as a separate controller and uses it, under its own terms and privacy policy, to measure our ads and to deliver them; for visitors in US states with privacy laws that call for it, we ask Meta to limit its use of it (Meta's "Limited Data Use"). Nothing is sent to Meta for a visit that didn't come from a Meta ad, and nothing goes to Google or any other advertising platform. Legal basis: legitimate interests (knowing which of our ads work). You can object: email support@photohawk.com and we'll stop sending Meta anything about you; to keep it from being sent at all, join from a link without the ad's click ID (for example by typing photohawk.com/friends-and-family into your browser). You can also manage the information Meta receives about you from other businesses in your Facebook or Instagram settings ("Your activity off Meta technologies").

Crash reports. When the app crashes or hits an error, it sends a crash report to Sentry, our error-reporting provider, so we can fix it: the type of error, where in the app's code it happened, the phone model, operating system and app version. Crash reports never include your name, email, account, photos, faces, names of people, places, messages or anything you type; they aren't linked to you. They are stored in Sentry's EU region and kept for 90 days. We don't use analytics beyond the library counts above and where an iPhone install came from (Apple Ads). Test versions of the app (TestFlight) send a short scan performance report after each scan (how long it took, how many photos, the phone model, OS and app version, battery and temperature state; never photos, faces, names, places or text), kept for 90 days. If we add reports to the public app, we'll update this policy and the store privacy labels first.

4. Who we share data with

We don't sell or rent personal data, and we don't share it for advertising, except that if you join the launch list on photohawk.com from a Meta ad, we tell Meta a sign-up happened, with the ad click ID, your IP address and browser type (never your email; see "The launch list on photohawk.com").

The people you share with and chat with see the photos and messages you send them, your name and your account's email address in the invite.
Meta, only for a launch list sign-up that came from a Meta ad, as described in "The launch list on photohawk.com".
Apple or Google, if you choose Sign in with Apple or Continue with Google: they confirm who you are and tell us your email address and name (see "Account" in section 3), under their own privacy policies.
Service providers who process data for us under contract and only on our instructions: Amazon Web Services (sign-in and hosting; cloud face matching with Amazon Rekognition, and the encrypted storage of face cut-outs with keys in AWS Key Management Service, in the EU (Ireland) region; and passing push notifications to Apple and Google with Amazon SNS), Twilio (texting and checking the 6-digit codes that confirm a phone number for "Find me by my phone number" or for an invite sent to that number: it receives the phone number, your app's language and the code you enter), RevenueCat (subscription status, and where an iPhone install came from when it was one of our Apple ads), Apple and Google (app store billing and push notifications; Apple also for Apple Ads attribution), Postmark (sending invite, account, verification code, report and launch list emails), Sentry (crash reports, in its EU region), and, only for print orders, Prodigi (printing and delivery) and Stripe (payments) as described in "Print orders".
Authorities, if the law requires it. Shared photos are end-to-end encrypted, so we cannot provide their contents.
A buyer, if Photohawk is merged or sold, under this policy's protections.

5. International transfers

Our servers, and cloud face matching, run in Amazon Web Services' EU (Ireland) region. Some of our providers may process data outside your country, including in the United States. Where EU/UK law applies, we rely on adequacy decisions or the European Commission's standard contractual clauses (and the UK addendum). Twilio, which texts phone codes, processes the phone number in the United States (and the text passes through the mobile networks that deliver it to your phone); for that we rely on Twilio's data processing terms, which include the European Commission's standard contractual clauses and the UK addendum.

6. How long we keep data

Account data: until you delete your account, then deleted within 30 days, except what we must keep by law (for example, tax records of purchases).
Shares, chats and invites: until the share is stopped, you leave the chat (a chat's messages go when the last member leaves) or the account is deleted.
Shared photos and chat messages: kept encrypted for 30 days after they were sent (a year if the sender had the Photohawk subscription when sending), or less if the sender unsends or deletes them; a one-time share's photo is deleted once every recipient device has received it. A storage rule deletes anything left after 400 days.
Reports: 400 days.
Being found: until you turn it off, remove your number or delete your account. A code works for 10 minutes; the record of a waiting code (Twilio's reference for it; for an emailed invite code, a keyed, one-way code made from it) is deleted when the code is used, and otherwise within a few days after it expires (the same for a code sent to confirm an invite's address).
Addresses confirmed for invites: until you delete your account (we keep your 10 most recent).
Cloud face matching: face cut-outs, face templates, groups and similarity scores are kept until you tap "Delete all face data", delete your account, change where you live to Illinois, ask us to delete them (within 30 days), or after 3 years without using the app, whichever comes first. They are then deleted within 24 hours (the cut-outs can't be opened from the moment the deletion starts). They are not deleted when a plan or free trial ends. The face data of a photo or video that leaves your phone is deleted from the cloud the next time the app runs. If you agreed only to the cloud face matching wording before 6 November 2026 and not yet to the updated one, your cut-outs are deleted as soon as they are matched (minutes; at most a day), as before. See the Face Data Policy's retention schedule.
Where an iPhone install came from (Apple Ads): kept with your subscription record, like the rest of your account data.
Support audit log: 3 years. It records who took an action, when, why and on which account (by a code, not your email or account ID), and holds no face data.
Launch list: until you unsubscribe, ask us to delete it, or delete a Photohawk account with that address.
Library counts and install IDs: kept with your cloud face data and deleted with it: when you tap "Delete all face data", delete your account, or after 3 years without using the app.
Print orders: print files 30 days after the order is sent out; order records as long as tax law requires, without the delivery address after account deletion (see "Print orders").
Server logs: 30 days.

7. Your rights and choices

In the app: withdraw your face data consent by deleting all face data (on the phone and in the cloud, kept cut-outs included) at any time (Settings > Privacy and data > Delete all face data); stop any share; leave a chat; block or report someone; stop people finding you (Settings > Who can find you); choose which photos the app can see (iPhone "limited access", Android "selected photos").
Delete your account: in the app (Settings > Plan and account > Delete account) or at photohawk.com/personal/delete-account. This deletes your account, sharing and chat data and cloud face data from our servers, and the face data on your phone.
Access, correction, portability, objection, restriction: depending on where you live (for example the EU/UK GDPR or US state laws such as the CCPA/CPRA), you can ask us for these. Email support@photohawk.com. We'll answer within one month. We won't discriminate against you for using your rights.
Complaints: you can complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), or the authority where you live in the EU.

California residents: we don't sell personal information, and we don't use sensitive personal information to infer characteristics about you. The one thing that could count as "sharing" under the CCPA is the launch list's sign-up event to Meta (see "The launch list on photohawk.com"), which we ask Meta to process under its Limited Data Use for visitors in California; to opt out, email support@photohawk.com.

8. Security

Shared photos, messages, captions and album names are encrypted end to end on your phone. Face cut-outs travel encrypted (TLS) to a private store in the EU (Ireland). There each cut-out is encrypted with a key that belongs to your account alone (AES-256), the store is encrypted again with a key held in AWS Key Management Service, and public access is blocked: no app, website or link can download a cut-out, the Photohawk app included. Only our matching service and our audited support tools can open them. Each account's face templates are kept in a collection of their own. Access to account data is limited to named people, each with their own sign-in, and their support actions are recorded. All traffic to our servers is encrypted in transit (TLS). Account passwords are handled by our sign-in provider and never stored in plain text. Face data and scan results on your phone stay in the app's private storage, excluded from backups.

9. Children

The app is not directed to children under 13 (16 in the EU and UK where local law requires), and we don't knowingly create accounts for them. If you think a child has given us personal data, contact us and we'll delete it.

Your photos may include children. Their faces are grouped for you like everyone else's, and their face cut-outs are kept in your cloud collection like everyone else's (our cloud service doesn't know which faces are children; see the Face Data Policy), but a person the app thinks is a child is never offered as someone to send photos to, can't be invited to a chat, and can't be matched with your contacts.

10. Changes

We'll post changes here and update the effective date. If a change materially affects how we use your data, we'll tell you in the app before it takes effect.

Version history:

1.6.4, 8 November 2026: the 6-digit codes that confirm a phone number ("Find me by my phone number", and an invite sent to that number) are texted and checked by Twilio, in the United States (it receives the number, your app's language and the code you enter; we keep only its reference while a code waits), no longer Amazon SNS. An invite sent to an email address or number can be accepted only by an account that has shown it has that address: the keyed code and masked form we keep for it, and the addresses you confirm with a code. Signing in with Apple or Google: they pass us your email address and name. Reactions can be any emoji; when each photo or video reached and was seen by each member (read receipts). Push notifications go to Apple and Google through Amazon SNS. Nothing else changes.
1.6.3, 8 November 2026: on iPhone, where an install came from: if you installed the app from one of our App Store ads, Apple tells RevenueCat, our subscription provider, which campaign, ad group and keyword it was (Apple's AdServices; no tracking permission, no advertising identifier), so we can see which ads lead to free trials and subscriptions. The launch list: if you join through a form in Facebook or Instagram, Meta passes us the email address you submit for the one launch email. Nothing else changes.
1.6.2, 7 November 2026: the launch list on photohawk.com: there is no tick box; you ask for the one launch day email by pressing the button, and we record that you did, with the time, the wording version and your language. Emails about updates stay a separate choice. Nothing else changes.
1.6.1, 6 November 2026: the launch list on photohawk.com: if you joined from a Meta ad, we tell Meta that a sign-up happened (the ad click ID, IP address, browser type, page, time and a random reference; never your email), to measure our ads; how to object. Nothing else changes.
1.6, 9 November 2026: face cut-outs are kept in the cloud, encrypted, to match your faces again and to support you (with the updated cloud face matching consent of 6 November 2026, which the app asks for); deleted within 24 hours of "Delete all face data", account deletion or 3 years unused; who can see account data and face cut-outs for support, and the audit log; the launch list on photohawk.com (your email for the launch email and, if you ask, updates; where your visit came from); the in-app paths for deleting face data and the account.
1.5, 5 November 2026: the app in the App Store and Google Play sends crash reports (Sentry, not linked to you, no personal data).
1.4, 5 November 2026: the paid plan is called "the Photohawk subscription" (it no longer has a name of its own); nothing else changes.
1.3, 4 November 2026: the Family plan is no longer offered, so its data (invited addresses, member accounts) is no longer collected.
1.2, 3 November 2026: library counts and an install ID sent with cloud face matching, to measure and control its costs.
1.1, 28 October 2026: chats (end-to-end encrypted messages, reactions, reports and blocks), being found by email or phone (optional), face grouping with cloud face matching needed to use the app, cloud face data no longer deleted 30 days after a plan ends, account deletion also deleting the face data on your phone, where you live sent with the cloud consent, retention of shared photos and messages, TestFlight scan reports.
1.0, 20 October 2026: first published version.

11. Contact

CLOUDCONCUR LTD (company no. 13399913), trading as Photohawk, 23 Caldey Gardens, Ingleby Barwick, Stockton-on-Tees, TS17 5HW, United Kingdom. Email: support@photohawk.com. Support: photohawk.com/personal/support. Our Data Protection Officer is Andrew Hammond (support@photohawk.com). We have not appointed an EU representative, on the basis that our processing of EU residents' data is occasional (GDPR Art. 27(2)); we will appoint one if that changes.