Privacy Policy

Effective: October 21, 2026 · Operated by Wizz Inc.

This policy explains how Wizz Inc. ("we") handles information in the iPhone app FamilyPhoto (the "App"): what is sent off your device and what stays on it. It describes how the App actually works. If this English version differs from the Japanese version, the Japanese version prevails.

In short

Whether a photo shows your family is checked on your iPhone. Photos without your family are never sent off the device.
Photos with your family are stored on our server so they can reach your partner. The date and place the photo was taken (location) that are already in the photo are shared as they are.
The face photos you register and the numbers that describe those faces are shared within your family, so your partner's iPhone can recognize the same people.
No ads, no tracking, and no third-party analytics. We do not sell your information.
No account (email, phone number, or Apple ID) is used. Each device is identified by an ID the App creates.

1. What stays on your device

The following never leave your device.

Your photo library and any photo without your family. The App uses photo library access to check new photos, but does not send photos it finds have no family in them.
Face checking. Finding faces in a photo and matching them against registered family members happens entirely on your device. Photos are not analyzed on our servers.
Location log (only if you chose "Always Allow" during setup). Significant moves and visits, with location, time, and battery level, are stored on the device (up to 5,000 entries). They are not sent to our server and are not attached to shared photos.
The sync log on your device. The sync log (up to 500 entries) you can export from Settings › Diagnostics is not sent anywhere unless you export and share it yourself. Diagnostics sent automatically to our server are described in section 3.

2. What is shared with your partner

The App shares photos only within a "family" of two devices, such as a couple. Nothing is made public or posted to other services. Your partner can see:

Photos found to include your family (with the date and place they were taken), and the names of the family members in them
The display name you entered, and the names and relationships of family members
The photos chosen for face registration (downsized), and the numbers that describe those faces for matching
Stickers and comments, records that a photo was received or saved, and the number of photos each of you shared per month

If you unshare a photo in the Share tab, it no longer appears in your partner's app. Photos your partner has already saved to the Photos app remain on their device.

3. What is sent to and stored on our server

To deliver photos and return reactions and notifications, the following is sent to and stored on our server.

Type	Details	Purpose
Shared photos	Photos found to include your family, as HEIC downsized to 2048px on the long side, plus a 512px thumbnail. The downsized photo keeps metadata from the original, such as the date taken and location (latitude and longitude). Thumbnails carry no metadata	To deliver them to your partner and let them save the photo to the Photos app with its date and place
Photo details	Date taken, date received, file type and size, which family members are in it (the on-device match result), whether it is shared or unshared, groups of similar photos, and the App version that sent it	To show lists, notifications, and stats
Face registration	Names and relationships of family members, the photos chosen for face registration (downsized to 1024px, with no location or other metadata), and numbers describing each face (512 numbers per face)	So your partner's device can recognize the same family members
Reactions	Stickers and comments (up to 140 characters)	To deliver them and keep them viewable
Device and family	Device ID and family ID created by the App, display name, a hash of the device secret, push notification token, the device's time zone, and when you joined the family	To identify the device, keep exchanges within the family, and send notifications
Invitations	Hashes of the invite code and invite token (never the plain values; valid for 10 minutes)	To invite your partner
Abuse prevention	A hash derived from the IP address when registering a device or joining with an invite (the IP address itself is not stored)	To limit repeated attempts in a short time
Diagnostics	Success or failure and timing of sync, upload, notifications, and similar steps; error types and messages; photo sizes; device state (thermal state, Low Power Mode, battery level, memory); network type; App and OS versions. URLs, credentials, and per-photo IDs are masked before sending. Stored linked to the device ID and family	To investigate problems and make syncing faster

Records of requests to the server (time, path, IP address, and similar) are kept for a short period by Cloudflare's systems, which we use to run the server.

4. Who else handles information

We do not sell or provide your information to third parties. We use the following providers to run the App, and information passes through their systems for that purpose only.

Cloudflare, Inc. (United States): server processing and storage of photos and data.
Apple Inc. (United States): delivering notifications (Apple Push Notification service). A notification includes the sender's display name, the number of photos, the beginning of a comment (up to 40 characters), the date taken, and photo and family IDs. Photos themselves are not included.

Both are U.S. companies, and information may be handled in their facilities, including in the United States. The United States has no single comprehensive privacy law equivalent to Japan's Act on the Protection of Personal Information; it has sector- and state-specific laws instead. We use these providers under their data handling terms (Cloudflare's Data Processing Addendum and the Apple Developer Program License Agreement), only to run the App.

We respond to legally binding requests for disclosure only to the extent required by law.

5. What the App does not use

Advertising, the advertising identifier (IDFA), or tracking across other companies' apps and websites
Third-party analytics or crash reporting services
Email address, phone number, postal address, contacts, camera, or microphone

6. How long information is kept

Diagnostics: 30 days (up to 20,000 most recent entries per device). Older entries are deleted automatically every day.
Face registration photos left unfinished: deleted automatically after 24 hours.
Everything else (shared photos, face registration, reactions, notification records, device and family information): kept with no fixed limit, until deleted by the actions in section 7 or until no one remains in the family, so that received photos stay viewable in the App.

7. How to delete

Reset the App completely (Settings › Data › Reset App Completely): deletes this device's information, the photos this device shared and their details, this device's reactions, and diagnostics linked to this device from our server, and deletes the data and secret on the device. If your partner remains in the family, the family's face registration (names and relationships, face photos, and face numbers) stays in the family so their device can keep matching. If no one remains, the family's information and face registration are deleted as well.
Delete a registered face (Settings › Family Faces › the person › Delete All Registered Faces): deletes that person's face photos and face numbers from our server.
Remove your partner (Settings › Family › Remove Member): your partner leaves the family. Photos and reactions shared until then stay in the family.
Unshare a photo (Share tab): it no longer appears in your partner's app. The current version has no way to delete a single photo from our server; contact us below if you want one deleted.
Location log: kept only on the device, and removed when you delete the App.

After a deletion, photo images on the server are removed in order, usually within about 15 minutes.

8. Security

All communication is encrypted (HTTPS).
Access to the server is authenticated with a per-device secret, and only devices in the same family can retrieve that family's photos and data. The secret is stored as a hash on the server and in the Keychain on the device.
Photos are stored separately per family, and no public URLs are created for them.

9. Photos of children

The App is for parents to share family photos, including photos of their children, with each other. It is intended for adults. If you register a child's face, that face registration is used only for matching within your family.

10. Requests about your information

To request access to, correction of, suspension of use of, or deletion of information we hold about you, contact us below. Because the App has no accounts, we may ask you for information shown in the App's Settings or for an action on your device to confirm it is you. Our address and the name of our representative are available on request without delay.

11. Changes to this policy

We update this policy when the App's behavior changes. Important changes will be announced in the App or on this page.

12. Contact

Wizz Inc.
Email: support@family-photo.app