Privacy Policy

1. What TotShot does

You pick a country and a document. The app loads the requirements that issuing authority publishes, guides the shot, and sends the frame to our servers, which measure it against those requirements and return a print-ready file.

Two things happen in two different places, and the difference is the whole privacy story: finding the face and guiding the capture happen on your phone, offline, with nothing leaving the device. Measuring the result, checking the background and producing the final file happen on our servers.

2. What we collect

• Your account. An email address, or the identifier and email address Apple or Google release when you sign in with them — if Apple gives you a private relay address, that is all we ever see. Plus the language you read in.
• Your child. A name, and optionally a nickname and a date of birth. The date of birth does one job: several authorities allow a younger child closed eyes or a looser head size, and the app has to know which rule is yours.
• Photos. The frame you capture, the previews made from it, and the finished file.
• Measurements taken from the photo. Head height, eye line, crown margin, sharpness, exposure, the crop we applied, the verdict, and the exact version of the requirement your photo was judged against.
• Purchases. Which credit pack you bought, and the receipt Apple or Google gives us so we can verify it. Card numbers never reach us — buying happens inside the store's own purchase sheet.
• Notifications. A push token, if you allow notifications.
• How you use the app. Named events for the steps of a session — a shot captured, a verdict shown, a credit pack bought — each carrying numbers and a session id. Of a verdict they carry only pass or fail: how many of a session's shots passed and failed, and whether a shot whose reasons you opened had passed. Never the photo, and none of the other measurements taken from it — no head height, eye line, crown margin, sharpness, exposure or crop.
• An advertising identifier, for our own ads. On Android, Google Analytics reads the device's advertising ID. On iOS it reads the advertising identifier (IDFA) only if you allow it when the system asks whether TotShot may track your activity. It has one job: when we advertise TotShot in Google Ads or a similar network, it lets that network match an install to the ad that led to it, so we know what our advertising achieved. You can reset or delete the identifier in your device settings, and on iOS decline the prompt; the app works identically either way.
• Roughly where you are. Google derives a city-level location from the IP address your usage events arrive from. The device itself never reports its location to us, and the app asks for no location permission.
• Crash reports. When the app fails: the error, the stack trace, the device model and OS version, and the id of the account it happened to, so a crash that hits one person can be traced rather than guessed at.
• Server logs. For security and abuse prevention, our servers log each request, as every web service does: the IP address, the time, the URL requested, the referring page if the request names one, the user agent — the name and version of the app or browser that sent it — and, for a signed-in request, the account it came from. An IP address can be personal data, so it is named here rather than passed over. Our log store keeps these lines for 7 days; the copy each server writes locally is capped in size and overwritten as newer lines arrive. A small sample of requests is also traced, to follow a slow or failing one through our services; a trace carries the IP address, the user agent, the URL and the account, and is kept for 3 days. Requests to the photo check on this site are the exception, and its own section below says what is recorded instead.

There is nothing else. TotShot asks for no address and no phone number, and shows no advertising. The usage events and crash reports above are keyed to a random per-install id and to your account. The advertising identifier is the one thing here an ad network ever sees, and it goes no further than measuring our own campaigns.

3. The measurements are geometry, not a faceprint

The numbers we take off a photo exist to crop a picture and to judge it against a published rule — how tall the head is in the frame, where the eyes sit, how much room is above the crown.

We never use them to identify anyone. They are not a biometric template, they are never matched against another photo or another person, and no face recognition of any kind runs on them. When a photo in the app is deleted, the measurements taken from it are deleted with it. The free check on this site keeps no photo at all, and keeps the numbers from each check for up to 365 days; its own section below lists exactly which.

4. A child's data, and why it is here

TotShot is used by an adult on behalf of a child. The account holder must be 18 or over; the child is the subject of the photograph, not a user of the app.

Their name, their date of birth if you gave one, and their photograph are used for a single purpose — producing and judging that photograph. They are never used for advertising, never sold, never shared for anyone else's purposes, and never used to train any model.

5. How long we keep it

TotShot is a camera and a validator, not a photo library. Everything expires on its own:

• A frame you uploaded but never turned into a session — 24 hours.
• The sources and previews of a session, and the renders of photos you did not buy — 72 hours. This is also why re-cropping a shot stays free for three days.
• A photo you bought — your retention window: 7, 30, 90 or 365 days, or kept indefinitely. The default is 365 days. You can change it in the app at any time and it applies to the photos you already have.

A year is the default because a child's document photo stops being usable well before that — the child has changed. Keeping it longer serves nobody.

When a photo in the app goes, the measurements taken from it go with it. What outlives a single deleted photo is the receipt — which document, when, whether it passed, which credit was spent — because you may still need to query a charge. It is shown nowhere in the app. The free check on this site keeps no photo, and keeps a record of each check for up to 365 days, as its own section below describes.

Download links are minted fresh each time you open a photo and expire after an hour. Nothing in our storage is publicly listed or publicly reachable.

Backups. Once a night we make an encrypted backup of our databases and photo storage, and we use it only to recover from a failure. Each backup is deleted after 14 days, so a photo or an account you delete can stay inside one for up to 14 days after it is gone from TotShot. The key that decrypts them is not kept on our servers.

6. Deleting your account

You can delete your account in the app, and it is unconditional. Your photos, the frames behind them, every measurement, the receipts, your child's details, your credit balance, your push tokens and your sessions are hard-deleted across every service that held them. Nothing is kept as a marker that you were here, and a part that fails is retried until it confirms rather than quietly left behind.

The one place your account outlives this is our encrypted nightly backup, which is deleted within 14 days, as described above.

Unused credits are destroyed with the account and are not refundable, so spend them or ask us first. You can also delete any single photo at any time, or write to support@totshot.app and we will do it for you.

7. Who else touches it

We do not sell or trade personal data. It reaches exactly these companies, each for one job:

• Apple and Google — signing in, and buying credits. They confirm to us that a purchase is real; we tell them nothing about your child. Apple can also ask what became of a purchase when you request a refund — the section after this one is about exactly that.
• Google (Firebase Cloud Messaging) — delivering a push notification to your device, if you turned notifications on.
• Google (Firebase Analytics and Crashlytics) — counting the usage events above and receiving crash reports. This is how we learn that a step of the flow is failing for people who never write to us. Google processes it on our instructions and on servers in the United States.
• Google (Google Ads) — when we run campaigns for TotShot, Google matches the advertising identifier above against the ad clicks it served and reports back which campaign an install came from. It is measurement of our own advertising; your child's data plays no part in it.
• Umami (Umami Software) — counting visits to this website, without cookies. It receives nothing from the app and never sees a photo; what it does receive is described under "This website".
• Resend — sending account and support email.
• Cloudflare — the secure connection to our servers. Everything the app and the photo check on this site exchange with api.totshot.app passes through Cloudflare: what they send, and what comes back to them, the finished photos the app downloads included. Cloudflare decrypts it at its network edge, and between that edge and our servers it travels through an encrypted tunnel. While it passes through, Cloudflare can technically see what it contains, photos included. We do not use Cloudflare to store anything.
• Our hosting provider — running the servers the app talks to.

Photos are measured and processed on our own servers, inside a private network. Your child's photo is never sent to a third-party AI service, and it is never sent to Google: the analytics and crash SDKs above see event names, numbers and identifiers, and no image data of any kind. The app carries no advertising SDK and shows no ads; the advertising identifier above is read by the analytics SDK, for the one purpose stated.

8. If you ask Apple for a refund

When you request a refund through the App Store, Apple may ask us what became of the purchase, and gives us a short window to answer. We answer. It is the only point at which we can say anything at all, and a request nobody answers is decided without us. Google Play has no equivalent step, so none of this applies to a purchase made there.

What we send is a summary, not a record: how much of the pack had been spent, whether the finished photos had been delivered, and the lifetime value of your purchases and your refunds as a range rather than an amount — and not even the range if any of your purchases were in another currency, because a dollar figure we cannot state is one we will not estimate. It is attached to the purchase by the token the store issued for it, and to nothing else.

We also tell Apple what we think the answer should be, and you are entitled to know the rule we use, because it is the whole of it: if you never spent the credits, we say the refund should be granted. If you spent all of them, we say it should be declined. If you spent some, we state no preference. We do not ask Apple to refuse a refund for something you never used.

We never send your photographs, and we send no personal data beyond that purchase identifier. Apple also asks how long you have held the account and how long you have spent in the app. We answer "not declared" to both, rather than estimate something we would then be asserting.

9. Where it is kept, and how

Our servers are in the European Union, rented from a commercial hosting provider. We name the region rather than the provider: the provider can change, the region is the commitment. Photos and the measurements taken from them are stored there and nowhere else, with one exception: pass or fail, which the usage events above also report to Google.

Five things leave that region. Usage events and crash reports go to Google in the United States. Push notifications pass through Google and Apple. Everything the app or the photo check on this site exchanges with our servers passes through Cloudflare's network — each request and each answer, the finished photos the app downloads included. On its way between you and us, Cloudflare decrypts it in whichever of its data centres is closest to you, which can be outside the European Union, the United States included. And this website is served by Vercel, a company in the United States, so its access logs described under "This website" — the IP address, time and user agent of every request for a page, the photo check's pages included — can be processed outside the European Union too. And the visit counter on this website sends each page view and each tap on a store badge to Umami, whose servers are in the United States and the European Union. These transfers run on the European Commission's Standard Contractual Clauses, which is the mechanism those companies publish for exactly this. Beyond these five, only what Apple, Google and Resend need for the jobs listed under "Who else touches it" crosses the border; photos, and the measurements taken from them, cross it only on their way through Cloudflare — except pass or fail, which the usage events carry to Google.

Traffic is encrypted in transit: with TLS between your device and Cloudflare, and through an encrypted tunnel between Cloudflare and our servers. Photos sit in private storage that is never publicly listed, and every download is a short-lived signed link. Sign-in tokens are held in your device's own keychain or keystore. Access is limited to the services that need it. No system is perfectly secure, and we will not pretend otherwise.

10. This website

totshot.app counts its visits with Umami, so we can see which pages people read and where they came from: a search engine, a social network, or a link someone shared. For each page view the counter sends Umami the address of the page — including a campaign tag the link carries, such as ?c= — the page that linked here, the browser's language, the screen size, and the device type, operating system and browser, which Umami reads from the user agent. A tap on an App Store or Google Play badge is counted the same way, with which store it was. Umami uses the IP address to work out the country and, together with the user agent, to compute a one-way code that counts unique visitors; it does not store the address. The counter sets no cookie and stores nothing on your device, so it cannot follow you to other sites, and it does not run at all if your browser sends Do Not Track. Umami processes this on our instructions, on servers in the United States and the European Union. The site serves no advertising, and apart from this counter it loads no third-party scripts, fonts or images — every other file the page uses comes from this domain.

The site itself is served by Vercel, our website host, which records the IP address, time and user agent of each request in its access logs for delivery and abuse prevention. Apart from Umami's counter above, it is the only company involved in showing you this page.

It stores one cookie, NEXT_LOCALE, which remembers which language you are reading in. It holds no identifier, is read by nobody else, and follows you nowhere.

11. The photo check on this site

totshot.app offers a free check of a child's photo against the requirements of one document, without an account. Before the photo leaves your browser it is resized and re-encoded, which also strips the file's metadata — the location a phone writes into a photo never reaches us. On our servers it is measured in memory — the temporary buffers our services work in included — and discarded when the answer is sent: it is never saved — not written to any file, database or storage — and never used for anything but the answer you get back.

What we keep is a record of the check without the image: the document and the version of its rules the photo was judged by; your child's age in months, if you gave it; the language of the answer; whether the photo passed; each issue found, with the value we measured and the range allowed; where the top of the head, the chin and the eye line sat, as fractions of the frame; the angles of the head; the scores for closed eyes, an open mouth and the direction of gaze; which detector measured the photo; how long the check took; and when it ran. It holds no image, no box around the face, no points marking the eyes, no file name and no IP address. These records are kept for up to 365 days and used to tune the thresholds the app judges by, and to count how many checks led to a tap on a store badge.

• Cloudflare carries the photo to our servers and our answer back to you, as it carries everything else exchanged with them. Both are decrypted at its network edge and travel between that edge and our servers through an encrypted tunnel, so Cloudflare can technically see the photo and the answer while they pass through. We do not use it to store anything.
• Rate limits protect the service. To count requests to the check per connection, our servers turn your network address into a keyed hash — a one-way code computed with a secret key that we replace at least once a day — and count against that code; for an IPv6 address, only its network part (the first 64 bits) goes in. The counts expire within 24 hours, and the check never stores the address itself.
• Our logs and traces record requests to the check without your IP address and without your browser's user agent — unlike the server logs described above. A check's log lines hold the time, the path requested (for a tap on a badge or the app link, it includes the check's id), the status of the answer and how long it took, a request id, and the verdict: the check's id, the document, the language, pass or fail, the issue codes and the measurements of the head, the eye line, the angles and the expression that the record above keeps, plus how sure the detector was that it had found a face and how many other faces it saw. A request the rate limits refuse is logged with the keyed code described above, never with the address. These lines are kept for 7 days, like the rest of our logs.
• If you tap a store badge or the app link afterwards, we record which one it was against the check's id, with the time and nothing else, so we know whether the check was useful. The badge's link itself tells the store no more than that the visit came from this site's check and for which document, which is how a store counts the installs a link leads to; it never carries the check's id.
• No account. The check sets no cookie beyond the language preference described above. The visit counter described under "This website" counts the check's pages like any other page; it never sees the photo or the answer.

The photo is of a child, and the children's-data section above applies to it in full: it is used for the one purpose you sent it for and for nothing else, never for advertising, never for training any model, and it is discarded the moment the answer is sent.

12. Your rights

You can ask for a copy of your data, a correction, an export, or its deletion. Deletion you can do yourself in the app; for anything else write to support@totshot.app. Every request is answered by a person.

In the EU and the UK these are your rights under the GDPR, and you may complain to your local data protection authority. In California, we do not sell or share personal information as the CCPA defines those words, and exercising a right costs you nothing.

13. Changes

The date at the top of this page shows when this policy last changed. If a change significantly affects how we handle your data, we will let you know in the app or by email.

14. Contact

Anything on this page — access, correction, export, deletion, or a question you cannot find the answer to: support@totshot.app. It is the fastest way to reach us and it is read by a person. Post reaches us at the address below.

15. Governing law

This policy is governed by the laws of the State of Delaware, United States.

It is published in every language the language switcher offers. The English version is the one that governs; a translation is there to be read, not to be argued from.