Privacy Policy

This policy explains what information Mosaic collects, how we use it, who can see it, how long we keep it, and the choices and rights you have. It applies to the Mosaic app and the services behind it, provided by [COMPANY LEGAL NAME] ("we", "us"). Face recognition has its own terms, which you see before you turn it on; they are part of this policy.

If you have questions, contact our privacy officer at [PRIVACY EMAIL].

1. THE SHORT VERSION

• Mosaic analyses your photo library on your iPhone. Photos only leave your iPhone when they are added to an album.
• The locations stored in your photos are sent to our servers to look up place names, even for photos you don't add.
• Everything you add to an album, including where and when each photo was taken, is visible to everyone in that album.
• Your profile (name, username and photo) is visible to every Mosaic user.
• Face recognition is optional. Your face template is encrypted on your iPhone, and we can't read it.
• We use service providers, mainly Google, to run Mosaic. Your information is stored in the United States.
• We don't sell your personal information.

2. WHAT HAPPENS ON YOUR IPHONE

Most of Mosaic's work happens on your device, using the photos you let it access in iOS Settings (all of them, or only those you select).

Library analysis. The app analyses each photo it can access: what's in it (for example, scenes, objects, people and animals), how good it is, when and where it was taken, and whether it is a screenshot or similar. It finds faces and describes each one as a set of numbers, so it can tell faces apart and match them. It also checks for explicit content, so it can be kept out of albums. This analysis uses Apple's on-device tools and models built into the app.

These results stay on your iPhone and aren't linked to any name or account. Face descriptions are never uploaded; the only part that leaves your iPhone is the short text summary the album assistant receives when you use it (section 6). Face descriptions are only matched against people if you turn on face recognition, and only against people who have chosen to share their face with you. The results are kept until you sign out or delete the app, and are removed sooner when you delete a photo (if Mosaic has access to your full library).

Album suggestions. The app may suggest albums from patterns in your library, such as trips, places, dates, pets and friends you can recognise. These are written on your iPhone using Apple's on-device language model.

Exception: photo locations. To show place names, the app sends the GPS coordinates stored in your photos, including photos you don't add to an album, to our servers, which look them up with Google (section 6). We send only the coordinates, never the photos.

3. WHAT WE COLLECT

Account information

• Your email address, or the name and email (which may be a private relay address) Apple shares when you use Sign in with Apple.
• Your password, if you use one. It is stored only in hashed form by our authentication provider.
• Your username, display name and optional profile photo.
• Your settings, such as your scan mode and notification preferences, and the version of our terms you accepted and when.
• Sign-in records, such as when your account was created and last used.

Photos you add to albums

• The photo file, as stored on your iPhone, including the information inside it (such as camera details and the place it was taken), and the video of a Live Photo. We make smaller copies for display.
• Details the app sends with it: when and where it was taken (GPS coordinates, altitude, speed and direction), the address it corresponds to, camera and lens details, whether it's a favourite, and the app's analysis of it: content labels, quality scores, where faces, people and animals are in it, and which people it recognised (only people who share their face with you).
• Image descriptors (sets of numbers describing the photo's content), which we use to group similar photos and you can use to search.

Your activity and content

• Albums you create or join, their names, descriptions and rules, your role, and the photos you add or remove.
• Comments, replies, reactions and drawings.
• Friends, friend requests, album invites and invite links, blocks, and reports you make or that are made about you, with any details you give.
• What you type into the album assistant (section 6).

Face recognition data (only if you turn it on)

• Your face template, encrypted on your iPhone so we can't read it, and the encrypted copies you share with people you choose.
• Your public encryption key, and who you share with or have asked to share.
• Marks showing that you were recognised in a photo.
• A record of when you agreed to the face recognition terms, and when you turned it off.

The face recognition terms explain how this data is protected, shared, kept and destroyed.

Device and usage information

• A token that lets us send notifications to your device, and an identifier for the device.
• Information about how you use the app, collected through Google Analytics for Firebase: events such as opening the app, creating an album or confirming photos for one, plus your device model, operating system, app version, language, and approximate location (country or region) worked out from your IP address. We don't give Google Analytics your name, email address or account ID.
• A check, using Apple's App Attest, that requests come from a genuine copy of the app.
• Technical logs from our servers, such as errors and the account a request came from.

Your device location

If you allow it, the app uses your approximate location (to about 100 metres) while you search for places, to show nearby results. It is sent to Google with your search (section 6), not stored by us.

Information from others

Other users can add photos you appear in, comment on your photos, invite you to albums, recognise you in photos (only if you share your face with them), and report you.

What we don't collect

Mosaic doesn't access your contacts, and doesn't track you across other companies' apps or websites.

4. HOW WE USE INFORMATION

We use information to:

• provide Mosaic: build and suggest albums, store and show photos, run sharing, comments, friends, notifications and face recognition;
• look up place names and search for places;
• keep Mosaic safe: prevent fraud and abuse, enforce our Terms of Use, review reports, and protect users and the public;
• understand how Mosaic is used, fix problems and improve it;
• communicate with you about your account, and respond when you contact us;
• comply with the law.

Our legal basis is your consent, which you give when you accept our Terms of Use and when you grant permissions or turn features on, and the need to provide the service you asked for. You can withdraw consent at any time (section 9), though some features won't work without it.

Automated selection. Mosaic uses automated analysis to choose which of your photos fit an album and to recognise people who share their face with you. Depending on your scan mode, matching photos may be added without you reviewing each one. You can change your scan mode, and remove any photo you added, at any time.

5. WHO CAN SEE YOUR INFORMATION

Every Mosaic user: your username, display name and profile photo. Anyone signed in can find you by username, and we may suggest you to other users as someone they might know.

Your friends: that you are friends, and whether you use face recognition.

Members of an album: everything you add to it, including each photo's file, location, address, time, camera details, and who was recognised in it, and your comments, reactions and drawings. Members can save and share what they see. People you invite, and anyone who holds an invite link, see a preview of the album and its members.

People you share your face with: an encrypted copy of your face template, which their app uses to recognise you in their photos.

People you block, and who block you, can't see each other.

6. SERVICE PROVIDERS AND OTHER DISCLOSURES

We use these service providers. They process information on our behalf, under contract, for the purposes in this policy:

• Google Cloud and Firebase (Google LLC): hosting, databases, file storage, authentication, server processing, notifications (Firebase Cloud Messaging) and app integrity checks (App Check).
• Google Maps Platform: turning photo locations into place names (our servers send coordinates), and maps and place search (your iPhone sends your search and, if allowed, your approximate location).
• Google's Gemini models, through Firebase AI Logic: the album assistant, when you create or edit an album with it. It receives what you type, your album's settings, today's date, the display names of you and the friends you can recognise, and a text summary of your photo library: place names (to the town or neighbourhood), dates and photo counts. It doesn't receive your photos, their exact locations, image descriptors or your face data. We don't keep a log of what's sent to it.
• Google Analytics for Firebase: app usage analytics (section 3).
• Apple: Sign in with Apple, push notification delivery and App Attest.

We may also disclose information:

• when the law requires it, or to respond to valid legal process;
• to protect anyone's safety, rights or property, including reporting child sexual abuse material to the National Center for Missing & Exploited Children;
• as part of a merger, acquisition or sale of assets, in which case the new owner must honour this policy or tell you;
• with your consent.

We don't sell your personal information.

7. WHERE YOUR INFORMATION IS STORED

Our servers are in the United States, on Google Cloud. Our service providers may process information in other countries, and the album assistant may be processed wherever Google runs its models. If you live in Canada, including Quebec, your information is stored and processed outside Canada, where it may be accessible to courts, law enforcement and national security authorities under local law. We use contracts and safeguards so that it gets protection comparable to what it would receive in Canada.

8. HOW LONG WE KEEP IT

• On-device analysis: until you sign out or delete the app.
• Your account and profile: until you delete your account. Deleting starts a 30-day grace period in which you can restore it (unless you choose "Delete now", which ends it at once). Once it can't be restored, permanent erasure of everything below starts about an hour later and completes in the background.
• Photos and their details: until you remove them, leave the album, the album is deleted, or your account is deleted. Photos registered but never uploaded are removed after about 8 days.
• Comments, reactions, drawings, friends and invites: until you remove them or delete your account.
• Face recognition data: until you turn it off, delete your account, or don't use Mosaic for three years, as set out in the face recognition terms. A mark of you on a photo also goes when you stop sharing with whoever marked you, or remove yourself from it.
• Place-name lookups: 30 days. They contain a location and an address, but nothing that identifies you.
• Notification tokens: until you sign out or delete your account.
• Analytics: [ANALYTICS RETENTION PERIOD], per our Google Analytics settings.
• Server logs: about 30 days.
• Reports, including copies of what was reported, and the record of your face recognition consent: kept after the account is deleted, for safety and to show we followed the law, for [RETENTION PERIOD].
• Anything we must keep longer by law.

9. YOUR CHOICES

• Photos: change which photos Mosaic can access in iOS Settings. Removing access stops new analysis; signing out deletes the analysis on your iPhone.
• Scan mode: choose in Settings whether photos are added automatically or only after you review them.
• Location: turn off location access in iOS Settings. Photo locations come from your photos, not this permission.
• Face recognition: off unless you turn it on; turn it off in Settings, stop sharing with anyone, or remove yourself from any photo you're marked in, at any time.
• Notifications: turn categories off in Settings, or all notifications in iOS Settings.
• Your content: edit your profile, remove photos, comments and drawings, leave albums, block people.
• Your account: delete it in Settings.

10. YOUR RIGHTS

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy, including in a structured, commonly used format;
• correct it;
• delete it;
• withdraw your consent;
• object to or limit certain uses;
• know who we have disclosed it to;
• complain to a privacy regulator.

You can do much of this in the app. For anything else, email [PRIVACY EMAIL]. We'll confirm your identity, and respond within 30 days (or the time your local law sets). We won't treat you differently for exercising your rights. If we refuse your request, we'll explain why, and in the US you can appeal by replying to our decision; if you disagree with the outcome, you can contact your state attorney general.

Canada. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or your provincial regulator.

Quebec. You have these rights under Quebec's Act respecting the protection of personal information in the private sector, including to have information about you de-indexed or stop being disseminated where the law allows. Mosaic's face analysis, location features and face recognition can identify or locate people; section 9 explains how to turn each one off. You can complain to the Commission d'accès à l'information (cai.gouv.qc.ca).

11. CONSUMER HEALTH DATA (WASHINGTON AND NEVADA)

Washington's My Health My Data Act and Nevada's similar law treat biometric data as consumer health data. For Mosaic, that means face recognition data and the face descriptions made on your iPhone (sections 2 and 3).

• We collect it from you and your device, with your consent, only to analyse and organise your photos and to recognise people who share their face with you.
• We share face templates only with the people you choose, as encrypted copies, and with Google Cloud, which stores encrypted copies it can't read. Face descriptions made on your iPhone aren't shared with anyone.
• You can withdraw consent, and ask to see, or delete, this data, as set out in sections 9 and 10. To appeal a decision, reply to it; if we deny your appeal, you can contact the Washington or Nevada attorney general.
• We never sell it.

12. SECURITY

We protect your information with encryption in transit and at rest, strict access rules on our databases and storage, app integrity checks, and limited internal access. Face templates are also encrypted on your iPhone so that only the people you choose can open them. No system is perfectly secure. If a breach puts you at real risk, we'll tell you and the regulators as the law requires.

13. CHILDREN

Mosaic is not for children under 13 (under 14 in Quebec), and face recognition is only for adults. If we learn that we hold information about a child under these ages without their parent's consent, we will delete it. If you think we do, contact [PRIVACY EMAIL].

14. CHANGES TO THIS POLICY

We'll update this policy as Mosaic changes, and change the effective date above. If a change matters, we'll tell you in the app before it takes effect, and ask for your consent where the law requires it.

15. CONTACT

[COMPANY LEGAL NAME]

[POSTAL ADDRESS]
Privacy officer: [PRIVACY OFFICER NAME OR TITLE], [PRIVACY EMAIL]