Privacy Policy

Last updated: 23 October 2026

Photo Memo+ is a free app for iPhone and iPad, made by Peter Kurzok, with an optional one-off Pro purchase. This page explains what the app does and does not do with your data.

There is no account and no login. We run no server of our own. The single exception is a picture set you deliberately choose to share, which is encrypted on your device before it goes anywhere — that is described in full under Sharing picture sets below.

Your photos

The pictures you choose are copied into the app’s own storage on your device, so that a board still works after the original has been moved or deleted. That copy stays on your device. It is not uploaded, not shared, and not visible to us — unless you yourself share a picture set, which is the one case described below.

The app asks iOS for access to your photo library only at the moment you pick pictures, and iOS decides what it hands over. Removing the app removes its copies with it.

The player names you type, your high scores and your settings are stored on the device in the same way, and are never uploaded.

VoiceOver photo descriptions

With VoiceOver on, Photo Memo+ can describe your photos in a few words — “dog on the sofa” instead of “photo 3” — so a blind or partially sighted player can remember the cards. On iPhones with Apple Intelligence (iOS 27 and later), the descriptions are made on your device by Apple’s on-device model. Your photos are not sent anywhere to be described, not to us and not to Apple.

The descriptions are stored on your device next to the picture set they belong to, and are deleted with it. They are never shared: a picture set you send contains the photos only, and the recipient’s device describes them itself. No analytics event carries a description. You can switch the feature off in Settings under VoiceOver.

Sharing picture sets

When you open the share sheet for a picture set, the photos in that set are packed up and encrypted on your device. Only the encrypted copy is uploaded, to our iCloud (CloudKit) container. The key that opens it travels only inside the link you send, in the part of the address that is never sent to any web server — so we cannot read what you share, and neither can anyone we host with.

The encrypted copy is kept for up to 7 days and then deleted. Anyone you give the link to can open it during those 7 days; after that the link stops working and the copy is gone.

This happens when the share sheet opens, so a set is uploaded even if you close the sheet without sending it. That copy is deleted on the same 7-day schedule as any other.

Sending needs an iCloud account on your device. Receiving needs none — no account, no sign-in. No analytics event ever carries the link, the key, or the photos.

Advertising — Kickstart Exchange

The free version can show a single small banner below the board, supplied by Kickstart Exchange. It promotes other independent apps. Buying Pro removes it.

The banner reports which advert was shown and whether it was tapped. That is not tied to your name, your Apple Account or any identifier we could use to recognise you, and it is not used to track you across other companies’ apps or websites. It never includes your photos, your picture sets or the player names you type.

Kickstart Exchange’s own privacy notice: https://exchange.kickstart.tools/privacy

Feature requests — Kickstart Signal

On iOS 18 and later, Settings has a Feature Requests board where you can suggest new features, vote for other people’s ideas and comment on them. It is run by Kickstart Signal. If you never open that row, the app never connects to the service.

While you browse the board, the app sends the service its own app key, its bundle identifier and the version of the Signal software. If the service asks for it, the app also sends Apple’s signed receipt for the app itself, which proves the request comes from the genuine app. None of that describes you.

When you first vote, suggest an idea or write a comment, a random installation identifier is created on the device. It is not derived from the device or from anything else, and it is used for nothing but this board. From then on, the service receives:

• that identifier,
• the text you write — an idea’s title and description, or a comment,
• your votes,
• whether Pro is active, so ideas from paying customers can be marked.

Like any server, the provider sees your IP address; by its own account it is used only temporarily to prevent abuse and is not stored.

What is never sent: no name, no e-mail address, no account, no advertising or device identifier, no photos, no picture sets and no player names. Please do not write anything personal into an idea or a comment.

Moderation. Every idea and comment stays private until we have reviewed and published it. We may edit or delete it. Nothing is ever shown with a name.

Who receives it. Hudson Heavy Industries Ltd, 37 Great Pulteney Street, Bath, BA2 4DA, United Kingdom (company number 11883499), operator of Kickstart Signal at api.kickstart.tools, delivered over Cloudflare’s network. The United Kingdom is covered by the EU’s adequacy decision.

How long. Ideas, comments and votes are kept as long as the board exists. Because the service cannot tell who wrote what, a contribution of yours is deleted on request to the contact address below — tell us what it said.

How to avoid it. Do not open the Feature Requests row.

Kickstart Signal’s own privacy notice: https://signal.kickstart.tools/privacy

Crash reporting — Sentry

If the app crashes, a crash report is sent to Sentry so the fault can be found and fixed. A report describes the state of the program — which code failed, on which iOS version and which device model. It contains none of your photos and none of your game data.

Crash reporting is controlled by Crash Reports in the app’s Settings. It is on by default. Switching it off shuts the Sentry SDK down immediately, without a restart, and nothing further is sent.

Sentry’s own privacy policy: https://sentry.io/privacy/

Usage statistics — Mixpanel

Anonymous usage statistics are sent to Mixpanel to show which parts of the app are actually used. The events are things like which screen was opened, which board size was chosen, which table background was picked, how many players were playing, and whether sound or haptics are switched on. They are not tied to a name or an account.

These events never include your photos and never include the player names you type.

One exception is worth stating plainly: if you deliberately send feedback from Settings, the message you write is transmitted along with it. That happens only when you choose to send it.

Usage statistics are controlled by Data Analytics in the app’s Settings. This is likewise on by default and can be switched off at any time.

Mixpanel’s own privacy policy: https://mixpanel.com/legal/privacy-policy/

Purchases

Photo Memo+ is free to download and free to play. Photo Memo+ Pro is a single purchase that removes the banner and lifts the free tier’s limits. The app also offers optional tips, which unlock nothing — a tip is a tip.

Anyone who bought Photo Memo+ while it was a paid app keeps every Pro feature, free and forever, with nothing to buy and nothing to restore.

Every purchase is handled by Apple. Payment details are never seen by us and never reach the app; we only learn that a purchase succeeded.

Apple’s privacy policy: https://www.apple.com/legal/privacy/

Children

The app plays with the pictures that are already on the device, and with any picture set someone shares with you. The only place anyone can write anything is the Feature Requests board in Settings (iOS 18 and later), described above. Nothing written there is visible to anyone until we have reviewed and published it, and nothing is ever shown with a name. From inside the game there is still no way onto the open web. The free version shows one banner advertising other apps, described above; Pro removes it.

Changes to this policy

If this policy changes, the new version appears on this page with a new date at the top.

Contact

Questions about this policy: [email protected]

The person responsible, and the postal address required by § 5 DDG, are given in the imprint.