Privacy
Last updated 26 September 2026
CameraOnce has two parts: an iPhone camera that keeps its captures on your phone, and this web app, where you can keep an account, upload photos and review other people’s. This page explains both, plainly.
The short version
- The web app uses your email address to sign you in with a one-time code.
- Photos you upload are private until you choose to make one public.
- We read a photo’s camera settings (camera, lens, exposure) to show them. We never read or keep its location.
- No advertising, no analytics trackers, and nothing is sold.
- The iPhone camera needs no account. Its captures stay on your phone unless you upload them here.
The web app: what we store
Your account | Your email address, username, display name, bio and the profile and banner images you choose. Your username, name, bio and images are shown on your profile; your email is never shown to anyone. |
Sign-in | A short-lived one-time code is emailed to you and stored only in hashed form until it is used or expires. Once you are in, your browser keeps secure, HTTP-only session cookies and a cookie that protects your account against cross-site requests. |
Photos | We keep three copies of each photo — full size, a display copy and a thumbnail — and every one has its metadata removed before it is stored. The full-size copy is only ever downloadable by you. Photos are private by default. |
Camera settings | At upload we read the camera make and model, lens, focal length, aperture, shutter speed, ISO and the time the photo was taken, and show them with the photo. GPS and any other location data are never read, stored or shown. |
Reviews | Your score and notes on someone’s public photo, shown with your username beside that photo, on your profile, and to the photographer. |
Social | Who you follow, follow requests, blocks, reports you send, and notifications. If you switch on push notifications, your browser’s push subscription. |
Uploaded photos are labelled Unverified: CameraOnce cannot vouch for how a file was made. Only a capture taken in the CameraOnce camera without a generative edit can ever be marked as not AI-generated, and you can never set that label yourself.
The web app: who helps us run it
Railway | Hosts the web app, its server and database. |
Railway Storage | Stores photo files in a private bucket. Nothing there is publicly addressable: each image is served through a signed link that expires within about two hours. |
Cloudflare | Runs our domain and sends your sign-in emails. |
They process data only to provide those services to us. We do not use advertising networks, analytics trackers or data brokers, and we do not sell or rent your data.
Your choices
- Make any photo private or public at any time, or delete it.
- Edit or delete any review you wrote.
- Make your whole account private so only approved followers see your photos.
- Block anyone; neither of you will see the other.
- Delete your account in Settings → Delete Account. That removes your profile, your photos and the reviews you wrote.
The iPhone app: what stays on your phone
Photos and videos | Saved in the app’s own storage and not uploaded anywhere. Tapping Save copies one to your photo library. Deleting one in the app removes it from the app. |
Settings | Your controls, theme, context switches and chosen AI model. |
API keys | In the iOS Keychain, marked to stay on this device only — not synced to iCloud and not restored onto another phone. |
Deleting the app removes all of it, including your API keys.
The iPhone app: what leaves your phone
1. AI Help
Nothing is sent until you tap AI Help, and nothing while you are recording. When you tap it, the app sends — directly from your phone to the AI provider you chose — one frame from the live preview reduced to about 1024 pixels on its long edge, your current control values and exposure reading, the preset you are using, and the context sentences below. It goes to whichever provider’s key you added: Anthropic, OpenAI or Google. Their terms govern what they do with it, and your account with them is billed for it. It does not pass through any server of ours.
Your coordinates are never sent to the AI provider, only sentences derived from them such as “busy road 30 m west”. You can read the exact text first in Settings → Context → What AI Help sends.
2. Location-based context
If you switch on Location, the app looks up what is around you, and your coordinates are sent to these services to answer that:
Apple | Reverse geocoding and nearby points of interest, to name the street and the place you are in. |
Apple WeatherKit | Cloud cover, rain and visibility for your position. |
OpenStreetMap | Roads, water, bridges, viewpoints, parks and stations near you, through the public Overpass service at |
These lookups happen on the phone’s own behalf and we never receive the results. Sun position and golden hour are calculated on the phone with no network call. Location is off until you turn it on, and every source has its own switch in Settings → Context.
What the iPhone app never collects
- No account, email address, name or contacts.
- No analytics, usage tracking, advertising identifiers or third-party trackers — which is why it never shows the App Tracking Transparency prompt.
- No access to your existing photo library: it can add a photo, never read one.
- No face recognition. Scene detection runs on your phone with Apple’s Vision framework and only counts faces and measures their size in the frame; nothing about a face is stored or sent.
Permissions the iPhone app asks for
Camera | Required, to show the preview and take photos and videos. |
Microphone | Optional, only to record sound with videos while that switch is on. |
Photos (add only) | Optional, asked the first time you tap Save. It cannot read your library. |
Location (while using) | Optional, for sun position, golden hour, weather and what is near you. Precise, because the advice depends on distances of a few metres. |
Motion | No prompt. Tilt and shake tell you when the phone is level and how slow a shutter your hands can hold. |
Children
CameraOnce is not directed at children under 13 and does not knowingly collect anything from them.
Changes
When CameraOnce changes what it stores or sends, we update this page and its date first.
Contact
Questions about your data or this policy: [email protected]