Photohawk Family: Privacy Policy
Version: 1.0
Effective date: 20 October 2026
Applies to: the Photohawk Family app for iPhone and Android (in the app stores as "Photohawk: Family Photos"; "the app") and the services that support it.
Controller: CLOUDCONCUR LTD (company no. 13399913), trading as Photohawk, 23 Caldey Gardens, Ingleby Barwick, Stockton-on-Tees, TS17 5HW, United Kingdom ("Photohawk", "we", "us").
Published at: photohawk.com/personal/privacy
Photohawk finds faces, people and things in the photos on your phone, and helps you share photos with the people in them. It is built so that most of what it does happens on your phone, and we receive as little as possible.
1. The short version
- Your photo library is scanned on your phone. We don't receive your photos, what's in them, or your searches.
- Face data is made on your phone. If you also agree to cloud face matching (asked separately; you can keep everything on your phone), small face cut-outs (never your photos or videos) go to our cloud face-matching service, run for us by Amazon Web Services in Ireland (EU), which keeps face templates for you so new photos can be matched. See the separate Face Data Policy.
- Photos leave your phone only when you share them, encrypted so that only you and the people you share with can see them, or when you order prints of them: then the photos you chose, at full size, go to our print partner to make and deliver your order, and only after you agree to it for that order (see "Print orders" below).
- We hold what we need to run your account, sharing and subscription: your email address, who you share with, and your subscription status.
- No ads, no selling of data, no tracking across other companies' apps or websites.
2. What stays on your phone (we never receive it)
- Your photo library and the scaled-down copies the app makes to scan it.
- What the app finds: things and people in each photo and video, and (only if you turn face grouping on) face data, groups of people and the names you give them. Names and your corrections stay on your phone even with cloud face matching on.
- Your searches.
- Where you told the app you live (used only to decide which features are available).
- Your settings, such as "only scan while charging".
3. What we collect, and why
| What | When | Why | Legal basis (EU/UK) |
|---|---|---|---|
| Account: email address, an account ID, and a password (handled by our sign-in provider in a form we can't read; we never see it). The same Photohawk account works across Photohawk apps. | When you create an account (needed to share, receive, subscribe or order prints). | To sign you in and secure your account; to send account and service emails. | Contract |
| Sharing: the name you give each person you share with, their email address or phone number, the invites you send and receive, and each share's settings (one time or automatic, "check before sending", stopped or active). | When you share or accept an invite. | To deliver invites and photos, and to let you and the people you share with see and stop shares. | Contract; for recipients, our legitimate interest in delivering an invite they can accept or ignore |
| Shared photos: the photos you choose to share (or that an automatic share sends), encrypted end to end on your phone. We store and forward them but can't see them. We can see technical details needed to deliver them (size, time sent, sender and recipient accounts). | When photos are shared. | To deliver them to the recipient's devices. | Contract |
| Subscription: which plan you have (Personal or Family, and for Family the accounts it covers), free trial and renewal dates, and store transaction IDs. We never receive card details: payment is handled by Apple or Google. | When you subscribe or restore. | To unlock your plan's features and handle free trials, renewals and refunds. | Contract |
| Cloud face matching (only if you agree): small face cut-outs from your photos and videos, sent in batches; an opaque key per photo (so two faces of one photo are never matched to each other) and each face's size; the face templates and groups the service makes from them; your consent record (version and time) and the country, and US state, you told the app you live in. Never your photos or videos, names or corrections. | When you agree, and then as new photos and videos are scanned. | To group the people in your photos and videos more accurately and match new ones. | Explicit consent (GDPR Art. 9(2)(a)) |
| Family plan: the email addresses the subscriber invites, masked when shown, and which accounts are on the plan. | When the subscriber invites someone or a member joins. | To give members the plan's features. | Contract |
| Notifications: a push token for your device. | If you allow notifications. | To tell you about invites and new shared photos. | Consent (system permission) |
| Technical data: app version, operating system, and IP address in server logs. | When the app talks to our servers. | To run, secure and fix the service. Logs are kept for 30 days. | Legitimate interests |
| Support: what you send us. | If you contact us. | To help you. | Legitimate interests |
Print orders and photo products
When you order prints, a framed print, a canvas or a photo book, the app asks you each time, before you pay: "To print, the full-size photos you chose are uploaded to our print partner. Nothing else leaves your phone." Nothing is sent until you agree and your payment has gone through.
| What | When | Why | Legal basis (EU/UK) |
|---|---|---|---|
| Print files: the photos you chose for the order, as the app prepares them for printing (cropped as you chose; a photo book's pages laid out on your phone). Not encrypted end to end: the printer has to see them to print them. | After you agree for that order and your payment succeeds. | To make your order. | Contract |
| Order details: what you ordered, prices, the delivery method, order status and tracking, and your consent for the order (version and time). | When you order. | To fulfil, deliver and support your order; to keep sales records. | Contract; legal obligation (tax and accounting records) |
| Delivery details: the name, address, email address and (optional) phone number you enter at checkout. | When you order. | To deliver your order and send delivery updates; the courier may need your email or phone. | Contract |
| Payment: handled by Stripe. We receive the payment's status, amount and a reference, never your full card number. | When you pay. | To take payment and handle refunds. | Contract; legal obligation |
Who gets it: Prodigi (Prodigi Group Ltd, United Kingdom), our print partner, receives the print files and the delivery details and makes your order in its lab nearest you (which may be outside your country, for example in the UK, EU, US or Australia), and passes your name, address and, where needed, email or phone to the courier that delivers it. Stripe processes your payment (Stripe's own privacy policy applies to the card details you give it, including Apple Pay or Google Pay).
How long: print files are deleted from our servers 30 days after your order is sent out (at once if the order is cancelled); Prodigi keeps them only as long as it needs them to make and deliver the order. Order records (items, amounts, dates) are kept as long as tax law requires (6 years in the UK); the delivery address, email and phone are removed from them when you delete your account, once the order has been delivered.
We don't currently collect crash reports or analytics. If we add them, we'll update this policy and the store privacy labels first.
4. Who we share data with
We don't sell or rent personal data, and we don't share it for advertising.
- The people you share with see the photos you share with them, your name and your account's email address in the invite.
- Service providers who process data for us under contract and only on our instructions: Amazon Web Services (sign-in and hosting, and, if you agree, cloud face matching with Amazon Rekognition in the EU (Ireland) region), RevenueCat (subscription status), Apple and Google (app store billing and push notifications), Postmark (sending invite and account emails), and, only for print orders, Prodigi (printing and delivery) and Stripe (payments) as described in "Print orders".
- Authorities, if the law requires it. Shared photos are end-to-end encrypted, so we cannot provide their contents.
- A buyer, if Photohawk is merged or sold, under this policy's protections.
5. International transfers
Our servers, and cloud face matching, run in Amazon Web Services' EU (Ireland) region. Some of our providers may process data outside your country, including in the United States. Where EU/UK law applies, we rely on adequacy decisions or the European Commission's standard contractual clauses (and the UK addendum).
6. How long we keep data
- Account data: until you delete your account, then deleted within 30 days, except what we must keep by law (for example, tax records of purchases).
- Shares and invites: until the share is stopped or the account deleted.
- Shared photos: kept encrypted until every recipient device has received them, and then deleted; a photo that is never collected is deleted 30 days after it was sent (365 days if the sender has a Personal or Family plan).
- Cloud face matching: face cut-outs are deleted as soon as they are matched (minutes; at most a day). Face templates are kept until you turn cloud face matching or face grouping off, delete your face data or your account, ask us to delete them, 30 days after your plan ends, or after 3 years without using the app, whichever comes first.
- Print orders: print files 30 days after the order is sent out; order records as long as tax law requires, without the delivery address after account deletion (see "Print orders").
- Server logs: 30 days.
7. Your rights and choices
- On your phone: turn face grouping or cloud face matching off, or delete all face data (on the phone and in the cloud) at any time; stop any share; choose which photos the app can see (iPhone "limited access", Android "selected photos").
- Delete your account: in the app (Sharing and privacy > Delete account) or at photohawk.com/personal/delete-account. This deletes your account and sharing data from our servers.
- Access, correction, portability, objection, restriction: depending on where you live (for example the EU/UK GDPR or US state laws such as the CCPA/CPRA), you can ask us for these. Email support@photohawk.com. We'll answer within one month. We won't discriminate against you for using your rights.
- Complaints: you can complain to a data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), or the authority where you live in the EU.
California residents: we don't sell or share personal information as those terms are defined in the CCPA, and we don't use sensitive personal information to infer characteristics about you.
8. Security
Shared photos are encrypted end to end on your phone. Face cut-outs travel encrypted (TLS) to a private store that only our service can read, and each account's face templates are kept in a store of their own. All traffic to our servers is encrypted in transit (TLS). Account passwords are handled by our sign-in provider and never stored in plain text. Face data and scan results stay in the app's private storage on your phone.
9. Children
The app is not directed to children under 13 (16 in the EU and UK where local law requires), and we don't knowingly create accounts for them. If you think a child has given us personal data, contact us and we'll delete it.
10. Changes
We'll post changes here and update the effective date. If a change materially affects how we use your data, we'll tell you in the app before it takes effect.
Version history: 1.0, 20 October 2026: first published version (until then this policy was a draft).
11. Contact
CLOUDCONCUR LTD (company no. 13399913), trading as Photohawk, 23 Caldey Gardens, Ingleby Barwick, Stockton-on-Tees, TS17 5HW, United Kingdom. Email: support@photohawk.com. Support: photohawk.com/personal/support. Our Data Protection Officer is Andrew Hammond (support@photohawk.com). We have not appointed an EU representative, on the basis that our processing of EU residents' data is occasional (GDPR Art. 27(2)); we will appoint one if that changes.