Privacy

Selfeed is a private photo diary. This page says what we store, where it lives, and how you delete it — in plain words, because the subject is your face.

What we store

Your daily photos and the face-centered crops made from them — the square frames. For photos in an album about a face, where your face and your eyes are, as numbers: that is how the frames are lined up. Your account identity as the sign-in provider gives it to us: a provider user id, and — when the provider shares them — your name and email. When you sign in with Apple, the iPhone app asks Apple for your name only; if Apple's sign-in token also carries an email address — a real one, or Apple's private relay address — we keep it, and if it does not, we have none. X does not give us an email address at all. Your settings: language, time zone, reminder hours.

In the iPhone app your diary lives on your phone, and without an account it stays there. Once you sign in, the app uploads the days already in it, one at a time, and each new photo after that.

What other people can see

Nothing in your diary is visible to anybody else until you decide so. If you choose a handle and turn your profile public, anybody can see your handle, your name and avatar, how long you have been a member, your streaks and how many photos you have, and the people who follow you get the frames of your main album in their feed and on their home-screen widget: the square frame, its date and its caption — never the original photo. If you also feature an album, anybody can see that album's frames on your public page, and the people who follow you get them too. Your other albums stay private unless you feature them or give them a public address. If you give an album a public address, anyone who has the address can watch that album's timelapse, with the album's name and your name, handle and avatar. Each of these can be switched off again; turning your public profile off, or removing your handle, takes your frames out of every feed and widget at once.

Replies, reactions, reports and blocks

A reply is text of up to 500 characters, sent with your name and avatar; an emoji can be sent on its own. Replies and emoji are private: only the person whose photo they answer can read them. When you report a photo or a reply, we keep the report — what was reported, who reported it, the reason and any note — and our team can see the reported content. We also keep who you follow, who follows you and who you have blocked.

Your phone and notifications

While you are signed in, the iPhone app registers your phone with us each time it starts: its push token, the platform, the app version and build, your language and your time zone. It does this whether or not you have allowed notifications. We use the token to send the daily reminder and the countdown that goes with it on your lock screen, alerts about replies to your photos, a notice when a newer version of the app is ready, and silent updates that keep the home-screen widget current. Reminders and alerts appear only if you allow notifications and keep Reminders switched on in Settings → Reminders.

Subscriptions

Selfeed Pro is paid through Apple, which handles your payment; we never see your card or payment details. When your subscription is recorded on our server, we keep which plan it is, its status, when it ends and Apple's reference number for it.

Records of what happens in the service

Each time you add, change or delete something — a photo, an album, a follow, a block, a report, a reaction, a registered phone — we write an audit entry: what changed, when, the IP address the request came from and the name your app or browser gives itself (its user agent). The text of a reply is not copied into it. We also keep a change history of account records, which can include your name, email address and handle. Both are an audit trail, kept so there is a record of what happened in the service, and neither is deleted when you delete your account.

Who else receives data

Apple. Push notifications reach your phone through Apple's push service, so Apple carries what they say: the alert for a reply holds the sender's name and the start of the message. Purchases go through Apple, which also tells us when a subscription renews, lapses or is refunded.

Google, Apple and X. When you sign in, the provider you chose confirms to our servers who you are.

Telegram. When somebody reports something, our team is alerted in a Telegram chat: the reason, the handles or names of the people involved and a short excerpt of the reported content. The same chat is told when a subscription starts, renews, lapses or is refunded, with the plan, the account's handle or name and the end date.

Admins also receive notices about new accounts, with the name, email when provided, sign-in provider, handle, language and time zone, and about photo uploads, with the account's name or handle, photo dates and album names. Uploads close together are grouped into one notice. The photo files and their captions are not sent in upload notices.

Our error tracker. Reports of crashes and errors go to a tracker we host ourselves.

What we do not do

Photos are private by default. There is no public feed unless you turn your profile public yourself, and even then only what you share is visible. We do not sell data, run third-party advertising, or train models on your photos. Error reports go to our own self-hosted tracker, not a third party.

How long we keep things

On a free account the server keeps the original photograph for 90 days after it was uploaded, then deletes it. The square frame made from it is kept until you delete it or your account. Your phone keeps every original it took. An account that has Selfeed Pro recorded on our server keeps its originals for as long as it does.

Audit entries and the change history have no end date. Reports about an account are kept as the record of the complaint, even after the account is gone.

Where it lives

Photos are stored in object storage and the database on servers we operate. Transport is TLS everywhere. Access tokens are device-scoped; you can sign a device out at any time, and a session unused for a year dies on its own.

Age

Selfeed is for people who are 13 or older, and it is not directed at children. If you think a child under 13 has an account, write to us at the address below.

Deleting your data

Deleting your account removes your photos, your albums, your replies and reactions, your follows and blocks, the reports you filed, your sign-in links, your registered phones and your subscription record from our systems. In the app: Settings → Account → Delete account. The same is available over the API (DELETE /api/v1/me). Deletion is immediate and cannot be undone.

Some things stay. The audit entries stay on record: they are no longer tied to your account, but they keep the IP address and the user agent. The change history stays too, and can still hold your name, email address and handle. Reports other people filed about you stay as well. Routine backups and server logs may keep a copy of deleted data until they are rotated out.

Contact

Questions about your data: lapster.me@gmail.com.