Privacy Policy

1. Who we are

This Privacy Policy explains how Original Pictures Technologies, Inc. (“Original Pictures”, “we”, “us”) handles personal information when you use the Original Pictures mobile app for iOS and Android (the “App”), the website at original.pictures and related services (together, the “Services”).

We are the controller of your personal information for the purposes of the EU and UK General Data Protection Regulation (“GDPR”) and the business responsible for it under U.S. state privacy laws.

2. Information we collect

2.1 Information you give us

• Account information: your email address, username, optional display name and optional profile photo, and a password (stored only as a salted, one-way hash). When you sign up with email we send a one-time verification code to your inbox.
• Sign in with Apple or Google: if you choose one of these, we receive an account identifier and the email address the provider shares with us. Apple’s “Hide My Email” relay addresses are supported. We also store the token Apple issues so that we can revoke Apple sign-in when you delete your account.
• Content you create: photos you capture in the App, captions (including hashtags), comments, likes, the accounts you follow, and the visibility setting you choose for each photo.
• Reports and blocks: when you report a post or profile, we record who made the report, what was reported, the reason and any details you add. When you block someone, we record the block.
• Communications: messages you send us, for example by email, and our replies.

2.2 Information collected when you capture a photo

Original Pictures verifies that a photo was taken by a real camera on a genuine device running our unmodified App. To do this, at the moment of capture we collect:

• Device integrity and attestation data: your device platform and model, a cryptographic key generated on your device for signing photos, and attestation results from Apple (App Attest / DeviceCheck) or Google (Play Integrity) confirming the App and device are genuine.
• Motion-sensor data: a short burst of accelerometer and gyroscope readings recorded during capture, used to check the photo was taken by a physical device. A fingerprint (hash) of these readings is embedded in the photo’s signed record.
• Security signals: indications that the device may be compromised (for example, jailbreak or root, a debugger or hooking tool, or screen capture during sensitive steps). These signals are used to protect the integrity of verification and the security of the Services.
• Capture details: the App name and version, the time of capture and, if signed in, your username and display name as the author.
• Location (optional): see section 3.

2.3 Information collected automatically

• Log data: like most online services, our servers record technical information about requests, such as IP address, date and time, the endpoint requested, response codes and app version. We use these logs to operate, secure and debug the Services.
• App updates: the App checks for updates through our update provider (Expo), which receives standard technical information such as IP address, platform and app version in order to deliver the right update.

We do not collect your contacts, phone number, date of birth, advertising identifiers or browsing history, and the App contains no advertising or third-party analytics SDKs.

2.4 Payment information

The Services are currently free. If we introduce paid features, purchases made in the App will be processed by Apple or Google, and purchases on our website will be processed by Stripe. We will receive confirmation of your purchase, the product, price and transaction identifiers, but not your full card number. See section 7 and our Refund & Cancellation Policy.

3. Location information

Location access is optional and the App only requests it while you are using the App (“when in use”). We never collect location in the background. If you allow location access:

• When you capture a photo, the App records the GPS coordinates of where it was taken and embeds them in the photo’s signed provenance record (see section 4). We also store the coordinates with the photo on our servers, to roughly 11 metres (about 36 feet) of precision, so the photo can be placed and searched by location.
• When you use Nearby / Explore, the App sends your current location to our servers so we can show photos taken near you and the approximate distance to them. We use it to answer that request and do not keep a history of your movements.

You can turn location off at any time in your device settings. Photos you take while location is off will not contain location data, and Nearby features will not be available.

4. Photo provenance and what other people can see

Every photo captured in the App is cryptographically signed and carries a tamper-evident provenance record based on the C2PA standard. This record is part of the image file itself. It is what lets anyone check a photo’s origin and integrity — and it means that some information travels with the photo. Please be aware that:

• The signed file contains the author name and username (if you were signed in), the capture time, the App and version, a device-integrity fingerprint and, if location was enabled, the precise GPS coordinates. Anyone who receives or downloads a copy of the signed file can read this information with standard tools.
• Each photo has a public verification page (for example, when you share a verification link). The page shows the photo, the author’s name, username and profile photo, the caption, the verification results and, if available, the location with a map link. It can be opened by anyone who has the link and offers the signed original for download.
• Visibility settings (Private, Friends, Public) control where a photo appears inside the App’s feeds — for example, only Public photos appear in Explore and Nearby. They are not a guarantee of secrecy: photo files are stored at long, hard-to-guess web addresses that are not password-protected, and verification pages are reachable by anyone with the link. At present, your profile page shows your most recent photos regardless of the visibility you selected.
• Your profile (username, display name, profile photo, follower and following counts and your posts) can be seen by other users.

If you don’t want a location or a photo to be visible to others, turn off location before capturing, and don’t capture or share that photo. You can delete photos at any time (see section 9).

5. How we use information

• To provide the Services: create and secure your account, capture, sign, verify, store and display photos, run feeds, profiles, follows, likes, comments and Nearby features, and send verification codes and service emails.
• To verify authenticity: check device attestation, motion data and security signals, generate provenance records, and show verification results.
• To keep people safe: detect and prevent fraud, abuse, spam, manipulation of verification and security threats; review reports; enforce our Terms and Community Guidelines.
• To communicate with you: respond to requests and send important notices about your account, security or changes to our terms. We do not send marketing email without your consent.
• To improve the Services: diagnose problems and improve reliability using server logs and aggregated information.
• To comply with law: meet legal obligations, respond to lawful requests and establish or defend legal claims.

We do not use your personal information for targeted advertising, and we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

6. Legal bases (EEA, UK and Switzerland)

Where the GDPR applies, we rely on: performance of a contract (providing the Services you sign up for); legitimate interests (securing the Services, verifying authenticity, preventing abuse, improving reliability — balanced against your rights); consent (location and other device permissions, which you can withdraw at any time in your device settings); and legal obligation (for example, tax records and responding to lawful requests).

7. How we share information

We do not sell your personal information and we do not “share” it for cross-context behavioural advertising. We disclose information only as follows:

• With other users and the public, as described in section 4, according to how you use the Services.
• With service providers who process information on our behalf under contracts that require them to protect it and use it only to provide their services to us:

• For legal reasons: if we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property or safety of our users, the public or Original Pictures — including reporting child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC).
• In a business transfer: as part of a merger, acquisition, financing or sale of assets, subject to this Policy.
• With your consent or at your direction.

8. Device permissions

• Camera — to capture photos in the App.
• Motion & fitness — to record motion data during capture for authenticity checks.
• Location (while using the App) — optional; see section 3.
• Photo library (read) — optional; only to choose a profile photo.
• Photo library (add) — optional; to save signed photos to your device.

You can grant or revoke permissions at any time in your device settings.

9. How long we keep information

• Account information is kept while your account is open.
• Photos, captions and comments are kept until you delete them or your account is erased. When you delete a photo or comment it is immediately removed from the App; stored copies are removed from our systems as described on our Delete Account page, and backups expire on their normal cycle.
• Verification and audit records (for example, the outcome of an authenticity check) are kept for as long as needed to keep previously issued verifications checkable and to protect against fraud. These records are append-only by design and are disassociated from your identity when your account is erased.
• Server logs are kept for a limited period for security and debugging, typically no longer than 90 days.
• Purchase records, if any, are kept as long as required for tax and accounting purposes (typically up to 7 years).
• We may keep information longer where required by law or to resolve disputes and enforce our agreements.

Account deletion is explained step by step on our Delete Account page, including what is removed immediately and how to request erasure of all remaining content.

10. Your choices and rights

• Access and export: in the App, go to Settings → Privacy & Diagnostics → Export my data to download your account information and photo records. For a complete copy of your data, email us.
• Correction: edit your profile in the App or contact us.
• Deletion: delete photos and comments in the App, delete your account in Settings → Account, or request full erasure by email.
• Deactivation: temporarily hide your account; signing in again restores it.
• Location and permissions: turn off in your device settings at any time.
• Objection and restriction: where we rely on legitimate interests you may object; you may also ask us to restrict processing.
• Withdraw consent at any time, without affecting processing that has already happened.

To exercise any right, email info@original.pictures from the address linked to your account. We will respond within 30 days (or the period required by law) and may need to verify your identity. You may use an authorised agent where the law allows. You also have the right to complain to your local data protection authority.

11. U.S. state privacy rights

Residents of California and other U.S. states with comprehensive privacy laws have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to obtain a portable copy; and to opt out of the sale or sharing of personal information and of profiling. We do not sell or share personal information and have not done so in the past 12 months, and we do not knowingly sell or share the information of consumers under 16. We use sensitive personal information (precise geolocation, account log-in credentials) only to provide the Services you request and for security, as permitted by law. We will not discriminate against you for exercising your rights. If we deny a request, you may appeal by replying to our decision; if the appeal is denied you may contact your state attorney general.

In the past 12 months we collected the following categories of personal information, for the purposes described in section 5, and disclosed them to the service providers listed in section 7: identifiers (email, username, account IDs, IP address); customer records (name, email); internet or electronic activity (logs, interactions in the App); geolocation (if enabled); audio/visual information (photos); inferences (none); and sensitive information (account credentials, precise geolocation).

12. International transfers

We are based in the United States and our main servers are in the European Union. Some service providers process information in other countries, including the United States. When we transfer personal information from the EEA, UK or Switzerland to countries without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) or the EU-U.S. Data Privacy Framework where the recipient participates in it.

13. Security

We protect information with encryption in transit (TLS), hashed passwords and refresh tokens, hardware-backed device keys, access controls and least-privilege database roles. No system is perfectly secure; if you believe your account or our systems have been compromised, contact us immediately at info@original.pictures.

14. Children

The Services are not directed to children. You must be at least 13 years old (or the minimum age of digital consent in your country, if higher — for example 16 in some EEA countries) to use Original Pictures. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it. See also our Child Safety Standards.

15. Cookies, tracking and advertising

The App does not use cookies, advertising identifiers or third-party analytics, and does not track you across apps or websites owned by other companies. Our website uses no advertising or analytics cookies; see our Cookie Policy. We do not respond to “Do Not Track” signals because we do not track, and we honour Global Privacy Control signals as an opt-out of sale or sharing (which we do not do).

16. Changes to this policy

We may update this Policy from time to time. If we make material changes we will notify you in the App or by email before they take effect. The “Last updated” date at the top shows when this Policy was last revised.

17. Contact us

Questions or requests about privacy: info@original.pictures · +1 (302) 694-1232
Original Pictures Technologies, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.