Your photos stay on your phone.

The short version

Stills is a film camera and personal memory app made by Neurovia. Your photographs live on your device and are never uploaded — not to us, not to anyone. Two things leave your phone. One is the email address on your account, which signs you in and is used for nothing else. The other is your profile: your name, handle, bio, birthday, profile picture, the cover frames you choose, and how many frames, rolls and places you have — which exists so the friends you meet in person can see who you are. There are no analytics SDKs, no ads, and no tracking. We cannot see your photos, and we do not want to.

Signing in

Setting up Stills creates an account. It is required, and there are two ways to make one:

• Sign in with Apple. Apple gives us an account identifier and an email address — you can choose to hide the real one and Apple will supply a relay address instead.
• Your email address, with a one-time code. We email you six digits, you type them in, and you are signed in. There is no password to invent, forget, store or leak, because there isn't one.

Either way the address is used to identify the account and to reach you about the account itself — the sign-in code, and the confirmation link if you ever move the account to a new address. Nothing else is ever sent to it: no newsletter, no product mail, no announcements. It is never shown to anyone, including your friends.

Sending those messages means an email provider handles your address, in the same way a letter has to pass through a postal service. We use Resend to deliver them, and they process the address for that delivery and nothing else. Codes expire ten minutes after they are sent.

You can change the address on your account at any time, from Settings in the app or from stills.cam/account. A confirmation goes to the new address and the change only happens once it is clicked, and the old address is told as well — an email change is the usual way an account gets stolen, and both halves knowing about it is the thing that stops it.

What syncs, exactly

Alongside the account we store one row about you: display name, handle, bio, birthday if you set one, and six counts — frames, rolls, places, current streak, best streak, and days shot. Two kinds of image travel with it — your profile picture, and up to five cover frames you pick yourself. Those covers are the only photographs that ever leave your device, and only because you chose them for a profile other people are meant to see.

Everything else — every other frame, your rolls, your search index, Dailies, your locations — stays on the phone. Your friend list is stored as a list of account identifiers so both sides can see each other; who you are friends with is visible only to you and to them.

Who can see your profile

Only people you have met in person and added by touching phones. Both sides must have added the other before either can read the other's profile — that rule is enforced by the database, not just the app, so a one-sided claim reveals nothing.

Stills has no browsing, no discovery, no search by name, and no public profiles. Your profile picture and covers are stored privately and served through short-lived signed links rather than public URLs, so nobody who is not your friend can reach them.

Capturing and developing

Photos you take are written to the app's private storage on your device. The film develop — tone, grain, colour — is computed by the app on your phone's own processor. Rolls, both the film in the camera and finished rolls waiting in the darkroom, are records kept in the same private storage. Frames you toss on the develop contact sheet are deleted from that storage.

What the intelligence reads

To make search and memories work, Stills analyses each developed frame on the device: it recognises text visible in the photo (signs, labels), classifies the scene (beach, food, night), counts faces without identifying who they are, writes a one-line caption, and computes numeric embeddings used to match your search words to images. All of this — the models and the index they build — runs and stays on your phone. Nothing about your photos is transmitted anywhere.

Search

When you search, your query is processed on the device against that local index: the words you type never leave the phone. Time phrases such as "sunset" or "last weekend" are resolved against each photo's capture time; place words against the photo's own location tag; everything else against the local text, caption, scene and image indexes.

Location, trips and spots

If you grant location access, each capture is tagged with where it was taken, and the app groups located frames into trips and named spots — all computed locally from your own photos. If you never grant location, none of this exists. "Include location" under Capture controls whether coordinates are written into files you export; turn it off to keep exported files clean.

Presence and friends

The Tap connects two phones directly over Bluetooth and local radio, phone to phone, in person. When you connect you exchange a display name, avatar and a cryptographic public key so your phones recognise each other later, all stored locally on each device. Each phone also records the friendship on the server, which is what lets you see each other's live profile afterwards.

Frames shared between phones travel over the direct link and are stored only on the two devices involved; they are never uploaded. Removing a friend deletes your side, and they stop being able to read your profile.

Saving, sharing and the date stamp

Saving writes the developed photo into your iOS Photos library, and into a "Stills" album if you enable it. Sharing hands the photo to the iOS share sheet — where it goes from there is up to you and the app you pick. The optional date and time stamp is burned into the exported image only when you turn it on in the save sheet. Exported files can include EXIF metadata and location if those toggles are on.

Inviting people

The invite sheet hands a link — stills.cam — to whatever you choose: the iOS share sheet, Messages, an email you write yourself, the clipboard, or a QR code. The QR is drawn on your phone by the app; it is not fetched from a service, it carries no identifier, and scanning it tells nobody anything. We do not see who you invited, we never ask for your contacts, and an invite is not tracked back to you — there is no referral code in the link because there is no referral system.

Recaps and covers

Monthly memories, recap films and featured picks are assembled on the device from your own frames using the local index. Nothing is curated by a server. Profile covers are also chosen on the device, but unlike the rest, the covers you pick are uploaded, because their whole purpose is to be seen by your friends. Choosing none means uploading none.

Permissions, in context

• Camera — taking photos. The one permission Stills cannot work without.
• Photos — saving developed frames to your library, and importing if you choose.
• Location — tagging frames with a place.
• Local network and Bluetooth — the Tap.
• Microphone — only if you use voice dictation, and speech is transcribed on the device.
• Notifications — one optional daily nudge.

Each is requested when first needed and can be changed at any time in iOS Settings. The related feature simply switches off without it.

Backups

Stills data lives in the app's storage, so it rides along in the device backups you control — iCloud Backup or a computer backup — under Apple's terms. Stills never uploads your library.

The app can also export a single backup file you keep yourself. That file is encrypted with a key held for your account, so it can only be opened by signing in as you. A backup that ends up in the wrong hands cannot be read. That key is stored on our server and is readable by nobody but you, including your friends.

What we do not do

We do not sell your data. We do not show ads. We do not fingerprint or track you across apps or websites. We do not collect analytics about how you use the app. We do not train models on your photos — we do not have your photos. We do not read your profile for any purpose beyond showing it to the friends you chose.

Children

Stills is not directed to children under 13, and we do not knowingly collect their information. If you believe a child under 13 has created an account, contact us and we will delete it.

Your control

An account is required to use Stills, and you can close it whenever you like. Settings gives you the full set of levers: see exactly what is stored under Storage, clear the image cache, export every frame, back up everything, reset your local profile — which permanently erases your photos, profile, friends and index from the device — and delete your account, which removes your profile, profile picture, covers, backup key and every friendship from the server for good.

The same account controls are on the web at stills.cam/account, so you can change your address or close the account without the app in front of you — including from a phone you no longer have Stills on.

The two are separate on purpose: deleting your account does not touch your photographs, and resetting the device does not close your account. Deleting the app erases the device half. There is no other copy of your photos anywhere to chase.

Changes to this policy

If the app ever changes how it handles your information, this policy and the date above change with it, and material changes will be surfaced in the app, not buried.

Contact

Questions about privacy? Reach Neurovia at hi@stills.cam. We read every note.