Privacy Policy & User Agreement

1. Scope and operator

Effective from the date you create your GAPP account. This policy explains how Group Photo Share (GAPP) collects, uses, keeps and protects personal information through the iPhone and iPad app, App Clip, invitation pages and related services.

GAPP is operated by Group Photo Share, an Australian registered business name based in New South Wales (“we”, “us”, “our”). We are responsible for the personal information described here. Contact support@groupphotoshare.com for privacy or support enquiries.

2. Information we collect

• Profile and account information: your full name, verified mobile number, any email supplied through Sign in with Apple, private display image, Apple account identifier, feature preferences and consent records.
• Face information: the accepted camera images used for guided setup, a frontal display image, protected face templates, pose and quality measurements, profile-version records, facial-learning agreement records and quarantined observations from qualifying successful matches. Accepted reference images are orientation-normalised and stripped of ordinary image metadata. Live camera frames that are not accepted for setup are not retained.
• Photo-sharing information: photos you choose, deliberately capture or allow automatic sharing to select; face locations; encrypted matching information for faces in those photos, including people who are not tagged; sender and recipient records; photo-access permissions; invitations; delivery states; mismatch reports; and related timestamps.
• Selected contact information: the name and destination you deliberately choose for an invitation or number update, plus the minimum delivery records needed to route the request and prevent duplicate sharing. GAPP does not upload or scan your whole address book.
• Sign-in and security information: SMS-verification lifecycle records, provider references, hashed one-use codes and tokens, encrypted Apple refresh credentials, device labels, push notification tokens, platform and session timestamps, request identifiers and security or deletion records.
• Technical information: app permission status and the ordinary network and request information that Apple, telecommunications providers and hosting infrastructure may process when delivering the service.

3. How we collect it

• Directly from you when you create or edit a profile, complete guided face setup, choose settings, select a photo or contact, send an invitation, report a mismatch or contact support.
• From your device only after you use an Apple permission or system picker, such as Camera, Photos, Contacts, Notifications or Messages.
• From Apple for account authentication, from Twilio for SMS-verification results, and from other GAPP participants when they share a photo or invitation involving you.
• Automatically as you use the service, where limited technical, security, delivery and lifecycle records are needed to complete and protect a request.

4. Why we use it

• Create, authenticate, restore, secure and delete your account.
• Check, before sending an SMS code, whether a mobile number already has a GAPP account.
• Create your private face profile and check whether you appear in an eligible group photo.
• Evaluate qualifying successful matches so GAPP can test and, only after validation, improve future matching for your account without weakening the current delivery safeguards.
• Deliver photos only to confirmed recipients, create blurred invitations for selected contacts, and stop duplicate or unauthorised delivery.
• Allow people who join later and choose earlier-photo discovery to find earlier shared photos they appear in.
• Remember your choices for future-photo receipt, automatic photo sharing, earlier-photo discovery, profile-photo sync, number updates and notifications.
• Operate signed-in devices, investigate mismatches, prevent fraud or abuse, troubleshoot failures and protect people, the service and its legal rights.
• Comply with law, enforce the adopted User Agreement and respond to valid legal requests.

5. Face matching and automated processing

GAPP uses automated face detection and comparison to decide whether an enrolled member is a strong match for a face in a group photo. Some preparation happens on the device and protected matching evidence is handled through the authenticated service. A match may create access to that photo; a failure keeps the clear photo locked.

GAPP may keep a quarantined observation linking a qualifying automatic match or sender-contact-confirmed match to your protected profile and the encrypted photo-scoped face evidence. A quarantined observation does not immediately rewrite your profile or change a delivery decision. It can be promoted only through a separately tested, versioned workflow designed to reject ambiguous, low-quality or conflicting evidence.

Facial learning is part of the face-matching service described in the User Agreement, not a separate preference toggle. Successful account deletion ends this account-scoped learning and removes its agreement events, learning observations and any derived adaptive profile. Photo-scoped evidence may still be retained for the separate group-photo purposes described below where other entitled people rely on it.

Face matching can make mistakes: it may miss someone or match the wrong person, which can send a photo to someone who is not in it. If you receive a photo you are not in, tap “I don’t appear in this photo”. This removes the photo from your GAPP account and sends a report to our support team. Match scores and another member’s face profile are not shown to users.

A GAPP match is not proof of identity and must not be used for employment, credit, policing, surveillance or another decision outside photo sharing. We do not use face information for purposes outside GAPP’s photo-sharing service.

Encrypted matching information for faces in a shared photo, including people who are not tagged, stays protected with that photo. It supports GAPP’s photo-matching purposes, including finding people who join later and choose earlier-photo discovery. It is never shown to users and is deleted when the photo is deleted from our servers. The separate limits on account-scoped learning and shared-photo retention described in this policy still apply.

6. Photos, contacts and private invitations

You can choose a group photo yourself. If you separately enable automatic photo sharing and allow Photos access, the app checks new still photos for the required Apple iPhone camera evidence before face matching; screenshots, videos, animations and files without that evidence are rejected from automatic sharing.

When you select a contact for an unmatched face, GAPP uses only that selection to prepare a blurred invitation in Apple’s Messages composer. You decide whether to send it. The private link contains an opaque token rather than a photo address, person’s name, contact detail or face profile. A link alone never releases the clear photo.

7. Who receives information

• Confirmed GAPP recipients receive the group photo and limited sharing information needed to use it. A selected non-member receives only the invitation journey until account, consent and matching checks succeed.
• Apple may process information when providing Sign in with Apple, Camera, Photos, Contacts, Messages, notifications, App Clips and App Store services, subject to Apple’s terms and privacy practices.
• Twilio Verify receives the normalised mobile number and submitted security code needed to send and check the six-digit signup code, subject to Twilio’s terms and privacy practices.
• OpenAI provides the ChatGPT Sites hosting used by GAPP’s server services and processes hosted information on our behalf. Cloudflare provides underlying hosting infrastructure, databases and private photo storage. These providers process information needed to run and secure GAPP’s account, invitation and photo services under the applicable service and data-processing arrangements.
• Professional advisers, regulators, courts, law-enforcement bodies or a successor operator may receive information where reasonably necessary and permitted or required by law, with appropriate protections.
• We do not sell personal information, show advertising or track you across other apps. Microsoft ONNX Runtime performs face-model calculations within the app; GAPP does not send face data to Microsoft merely because that library is used.

8. Overseas processing

Apple, Twilio, OpenAI and Cloudflare may process or store information in the United States and other countries outside Australia.

We take the steps Australian privacy law requires for overseas handling of personal information.

9. Security

GAPP uses measures designed to protect information, including authenticated sessions, private storage, AES-GCM encryption for protected face and account data, hashed or keyed token records, single-use photo access that expires after no more than five minutes, integrity checks, bounded uploads and no public photo-object URLs.

No security method is perfect. You should protect your device, Apple account and mobile service, use device passcode protection, and promptly remove a signed-in device you no longer control.

10. Retention

• Camera frames not accepted during guided setup are not kept.
• Account information, settings, accepted guided face references, protected templates, facial-learning agreement events, quarantined learning observations and any derived adaptive profile are retained only while tied to your account and their protected source evidence, and are removed through successful account deletion.
• Shared photos and protected matching information for their faces, including untagged faces, may remain while the photo is active or anyone entitled to it still needs access, even if the original sender deletes their account. They are deleted when no longer needed.
• Photos started but not shared are deleted automatically.
• Manual invitation links expire after seven days. Clear-photo access grants last no more than five minutes and can be used only once.
• Push notification tokens are retained until you sign out, delete your account or the token is replaced.
• SMS-verification and security records are kept for a short period needed for security. Authentication and replay-prevention records use limited windows appropriate to their purpose.
• Mismatch reports and support records are kept until the report is resolved, then for up to two years.
• Owner-managed encrypted recovery backups retain the latest three verified weekly recovery points. Retention and deletion periods for providers’ operational and recovery copies are subject to the applicable provider terms and require separate confirmation.
• Completed deletion leaves only non-identifying retry records needed to make a lost deletion response safely repeatable. Records may also be retained where reasonably necessary for security, disputes or a legal obligation. Information no longer required is destroyed or de-identified where applicable law requires it.

11. Your choices and controls

• In Your Profile and Settings, you can turn future-photo receipt, automatic sharing, earlier-photo discovery, profile-photo sync, number-update sharing and notifications on or off where available.
• There is no separate facial-learning toggle. If you do not want the account-scoped facial learning described in this policy and the User Agreement, do not create or continue the face-matching account; successful account deletion stops it and removes the account-linked learning records.
• You can change Apple permissions in system Settings. Turning off a permission may stop the related feature from working but should not silently enable another feature.
• You can review signed-in devices, sign out this device, edit available profile details, report a mismatch and delete your profile from inside the app.
• Removing a photo from GAPP does not remove a copy another person has already saved to Apple Photos, sent onward, screenshotted or stored outside GAPP.

12. Account deletion

You can request account deletion in Your Profile. Successful deletion removes your member account, active sessions, encrypted credentials, private display avatar, guided face-reference archives, protected profile versions, facial-learning agreement events, quarantined learning observations, any derived adaptive profile, preferences, consent records, your photo-access permissions and unused grants. It also revokes your Sign in with Apple authorisation and clears account-owned information from the device.

Shared canonical photos may be retained for other people who already have an entitlement, and copies outside GAPP remain outside the operator’s control. If a provider is temporarily unavailable, deletion may remain pending and be retried rather than being falsely reported as complete.

13. Access, correction and complaints

You can ask to access or correct your personal information, or make a privacy complaint, by emailing support@groupphotoshare.com. We may need to verify your identity and will respond within 30 days. We may lawfully refuse or limit a request, explaining why when required.

Please contact us first so we can investigate your complaint. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

14. Data incidents

We investigate suspected loss, misuse or unauthorised access and take reasonable containment and remediation steps. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by law.

15. Children

You must be 16 or older to create a GAPP account. If we learn that someone under 16 has created an account, we will delete it and its face information.

16. Changes and contact

We will tell you about material changes in the app and ask for your agreement again where required before new handling begins. The current version is available in the GAPP app.

For questions, privacy requests or support, contact Group Photo Share, based in New South Wales, Australia, at support@groupphotoshare.com.

1. Accepting this agreement

Effective from the date you create your GAPP account. This agreement is between you and Group Photo Share, the operator of the GAPP app.

By creating a GAPP account you agree to this agreement and the Privacy Policy. If you do not agree, do not create an account. Material changes are notified and presented for fresh acceptance where required, as described below.

2. The service

GAPP helps people privately share a group photo with enrolled people whom the service strongly matches to faces in that photo. It also supports protected account-scoped facial learning from qualifying successful allocations, blurred invitations, private recipient access, optional earlier-photo discovery, optional automatic sharing and related account features.

Features can differ by device, permission, location, provider availability and app version. GAPP is a photo-sharing convenience, not an identity, security, emergency, records-preservation or guaranteed-delivery service.

3. Eligibility and your account

• You must be 16 or older and able to lawfully agree to these terms and provide the required consent for face processing.
• Give accurate information, verify a mobile number you control, use your own Sign in with Apple account, and keep your device and authentication methods secure.
• You are responsible for activity through your account until you sign out, remove a device, delete the account or promptly notify support of suspected misuse.
• Do not create an account for another person, impersonate someone, share authentication credentials or try to defeat the one-person account and face-profile safeguards.

4. Sending, receiving and privacy choices

Every GAPP member can be both a sender and a recipient. By creating an account you agree to both roles, subject to your sharing and receipt settings.

As a sender, you agree that GAPP may share the photos you select or permit automatic sharing to select with the people its face matching identifies in them, or the people you choose, subject to the service’s access checks. As a recipient, you agree that GAPP may send you photos it matches you to when you enable receiving photos.

You decide whether to grant Camera, Photos, Contacts and Notifications access and whether to use Apple’s Messages composer. You also choose the optional receipt, discovery and sharing settings shown in Your Profile. Those settings do not operate as a separate facial-learning opt-out.

You may change those choices, but some changes affect only future processing and cannot recall a photo or message another person already received or saved. The Privacy Policy explains the resulting data handling.

5. Face matching limits

Automated face matching can make mistakes: it can send a photo to someone who is not in it, miss someone who is, or reject an unusable photo. GAPP uses safeguards and keeps a clear photo locked when required checks fail, but does not promise perfect recognition. You accept this risk as both a sender and a recipient, without limiting your consumer rights described below.

If you receive a photo you are not in, tap “I don’t appear in this photo”. The photo is removed from your GAPP account and the report is sent to GAPP support. We use these reports to investigate and improve matching while preserving the safeguards described here.

By creating a face-matching account under this agreement, you agree that GAPP may retain qualifying successful automatic and sender-contact-confirmed allocations as quarantined learning observations for your account. They do not immediately rewrite your profile or override the current threshold and ambiguity safeguards. Only evidence that passes a separately tested, versioned promotion process may be incorporated into a future adaptive profile.

This facial learning is a core part of the face-matching service and is not offered as a separate opt-in or opt-out toggle. You can end it by deleting your account; successful deletion removes your agreement events, learning observations and any derived adaptive profile, subject to the separate shared-photo retention limits in the Privacy Policy.

Do not treat a GAPP result as proof of identity or presence outside the limited photo-sharing purpose. Use the mismatch tools if a photo is incorrectly connected to you.

6. Your photos and content licence

You keep any ownership you have in photos, names, messages and other content you submit. You grant the operator a non-exclusive, worldwide, royalty-free licence to host, encrypt, copy, process, format, transmit and display that content only as reasonably needed to operate, secure and support GAPP, comply with law and enforce these terms.

That licence ends when the content is deleted from the service, except for copies legitimately retained for other entitled recipients, secure backups, dispute or safety records, and legal obligations as described in the Privacy Policy.

7. Respecting other people

• Only upload, capture or share photos you have the right to share, of people who agreed to be photographed. Obtain any other permission reasonably required to share them.
• Select a contact destination only for the person you genuinely believe appears in the chosen face slot. A contact label does not prove identity or grant access to the clear photo.
• Respect requests not to photograph, tag, invite or share. Do not expose private, sensitive, intimate or confidential information without proper authority.
• Do not use GAPP to make decisions about another person’s employment, credit, housing, insurance, policing, safety or legal identity.

8. Prohibited conduct

• Do not use GAPP for unlawful, fraudulent, deceptive, threatening, abusive, harassing, discriminatory, exploitative or privacy-invasive activity.
• Do not upload child sexual abuse material, non-consensual intimate imagery, content that exploits a child, or content that infringes privacy, publicity, copyright or other rights.
• Do not spam invitations, knowingly choose the wrong contact, impersonate another person, evade a block or restriction, or misuse a private link or received photo.
• Do not probe, scrape, reverse engineer where lawfully restricted, disrupt, overload, introduce malware into, or bypass the security, authentication, matching, entitlement or rate-limit controls of the service.
• Do not use automated tools or extracted face information to build another identity database, train an unrelated model or conduct surveillance.

9. Invitations and communications

You control whether Apple’s Messages composer sends an invitation. Your carrier, internet or messaging charges may apply. You must not mislead a recipient about what the invitation is or repeatedly contact someone who does not want it.

Invitation links expire after seven days, can be revoked and should not be published. A link alone does not grant clear-photo access; account, consent and matching checks still apply.

10. Reports and enforcement

Report an incorrect match, unlawful content, abusive conduct or a security concern through the in-app option or at support@groupphotoshare.com.

The operator may investigate, preserve necessary evidence, restrict a photo or feature, revoke access, suspend or terminate an account, and refer conduct to relevant authorities where reasonably necessary. Enforcement decisions should consider safety, privacy, law and the rights of affected people.

11. Third-party services

GAPP relies on Apple, Twilio, OpenAI’s ChatGPT Sites hosting and infrastructure providers including Cloudflare. Their own terms and privacy practices apply to their services. We cannot control external services or copies of photos people save, screenshot or send outside GAPP.

Open-source components remain subject to their licences. Those licences do not give you rights to GAPP branding, private service code or another user’s content.

12. Availability and changes

We may maintain, secure, improve, replace or stop a feature. We will give reasonable notice of material changes that affect your stored photos or privacy choices.

Internet, Apple, SMS and hosting failures can delay or prevent signup, matching, invitations, notifications, delivery or deletion. The service should fail safely rather than claim a protected action succeeded when it did not.

13. Suspension, termination and deletion

You may stop using GAPP, sign out a device or request account deletion in Your Profile. Successful deletion ends account-scoped facial learning and has the other effects described in the Privacy Policy, but cannot recall external copies already saved or sent.

The operator may suspend or terminate access for a serious or repeated breach, legal requirement, security threat or risk to another person. Where appropriate and lawful, the operator should give notice and a reasonable opportunity to respond.

14. Intellectual property

Except for your content and third-party components, the app, service, software, design, branding and documentation are owned by or licensed to the operator and protected by intellectual-property laws.

Subject to these terms, you receive a personal, limited, revocable, non-exclusive and non-transferable right to use the app and service for their intended purpose.

15. Consumer rights and disclaimers

Nothing in these terms excludes, restricts or modifies a consumer guarantee, right or remedy that cannot lawfully be excluded, including rights that may apply under the Australian Consumer Law.

Subject to those rights, GAPP is provided on an “as available” basis. The operator does not promise uninterrupted availability, perfect face matching, delivery to every intended person, permanent storage, or that every misuse can be prevented. Keep your own copies of photos that matter to you.

16. Liability

To the extent the law allows, our liability for a claim relating to GAPP is limited to resupplying the service. We are not liable for loss caused by your own actions or by services we do not control.

This clause is subject to your consumer rights above. Nothing in this agreement excludes liability or a right or remedy where doing so would be unlawful.

17. Disputes and governing law

Please first contact support@groupphotoshare.com so we can try to resolve any problem. Urgent safety, privacy or legal rights are not limited by this informal step.

This agreement is governed by the laws of New South Wales, Australia, and its courts have jurisdiction, without removing mandatory consumer, privacy or other protections you have under the law where you live.

18. Changes and contact

We will notify you of material changes and ask you to accept them again where required. Continued use counts as acceptance only where lawful and where the change was properly notified. The current version is available in the GAPP app.

Contact Group Photo Share, based in New South Wales, Australia, at support@groupphotoshare.com.