Privacy Policy — Sundae Camera

1. Scope

This policy explains how Sundae Camera ("Sundae"), an app by Andre Dalwin Tan, handles information when you use the Sundae app, its Apple Watch companion, sundae.cam, support, and any TestFlight beta. It describes the 1.0 release.

Apple separately controls information it processes through the App Store, TestFlight, iCloud, Photos, and other Apple services. Those activities are governed by Apple's own terms and privacy notices.

2. Data at a glance

Photos and RAW negatives: Processed on your device and saved to your Photo Library. They are not uploaded to Sundae or its analytics provider.
Location: Optional. When Location Tagging is on, location can be embedded in the photo you save. Photo coordinates are never sent to app analytics.
Photography history: Capture statistics for future Year in Review features, saved automatically on your device and backed up to your private iCloud storage when available. This history is separate from Share Analytics and is never sent to PostHog.
App analytics: Product, performance, and bounded failure events associated with a random device identifier and handled by PostHog only if you enable analytics. Off by default for new installs; existing saved choices are respected.
Accounts and ads: Sundae has no user accounts, targeted advertising, cross-app tracking, or sale of personal data.

3. Photos, settings, and device permissions

Sundae's camera, Vibes, Film Emulation, Adaptive Tone, Gallery, and Lab run on your device. Developed photos and optional RAW negatives are written to Apple Photos. App preferences, onboarding progress, and editing state are also stored locally in the app or alongside the relevant Photos asset.

When you choose to share or export a photo, the app or recipient you select receives that content. Original photo and RAW exports may retain embedded metadata, including location if it was saved. Generated Photo prints and Story images do not copy private source metadata; a place caption you choose to show remains visible in the image. Widgets can display your selected photos on your device's Home Screen.

Sundae asks for access only when a feature needs it:

Camera to capture photos and provide the live viewfinder.
Photos to save work and let you browse, favorite, import, edit, and redevelop media in the Gallery and Lab.
Location to tag where a photo was taken when Location Tagging is on. This permission and feature are optional.
Motion to render the live horizon level in the viewfinder.

You can change system permissions in Apple Settings. Turning off a permission may make the related feature unavailable. Deleting Sundae does not delete photos or RAW negatives already written to Apple Photos; manage those separately in Photos and through your Apple sync and backup settings. Photos may sync through iCloud Photos if you have enabled it with Apple.

Sundae also keeps local edit information and pending-save recovery data. These are separate from photography history and are not synced through Sundae's history backup. Do not delete the app while a photo is waiting to save: app deletion can remove the only pending copy.

Available storage is checked locally before capture so Sundae can warn you when space is too low. Free-space readings and storage-based capture rejections are not sent to PostHog.

4. Private photography history

Photography History records limited facts about saved original photos for your Year in Review, coming in a future update. Photography History must be on for future Year in Review features to be available. This is not a photo backup or a recap you can view in 1.0. These facts include Vibe, lens, capture time and mode, framing, manual exposure, flash, timer, Save Negative, and how the Shutter was triggered. The records contain no images, photo GPS coordinates, free-form Vibe names, Photos asset identifiers, or analytics device identifier. Edited copies and photos still waiting to save do not count as new original captures. Older photos are not backfilled into this history.

Recording and iCloud backup start automatically, separately from PostHog and Share Analytics. Turning off Share Analytics does not stop this history or its iCloud backup. In Settings → Analytics & Privacy → Photography History, you can turn recording or iCloud sync off independently on this device. Turning Photography History off makes future Year in Review features unavailable while it is off. Turning it back on resumes recording; photos taken while off are not added later. Existing history is kept. Previously saved pauses remain respected.

Export a Copy creates a readable JSON file of the history currently on this device, including records already received from iCloud. Open the copy in Files or a text viewer to inspect the stored data. Sync first to include available history from other devices. The export is not an import file or a photo backup. Sync status and Sync Now are available on the same Settings screen.

iCloud backup runs automatically by default when iCloud is available. It stores these image-free records in your Apple account's private CloudKit database. Sundae attempts to sync when you open the app and after saving a photo. Continuous or background sync is not guaranteed. The analytics device identifier and analytics choice stay in this device's Keychain and are never included in this history. The developer cannot browse your private history through the CloudKit dashboard.

Devices using the same Apple account merge their capture facts after syncing. Each capture has its own random record ID, so syncing adds distinct captures rather than replacing another device's entire history. A confirmed Clear Photography History clears local facts and requests removal of the shared iCloud history. Other devices adopt the clear when they next sync; older offline records do not restore the cleared history. Cloud removal waits while sync is paused or a connection is unavailable. Clearing keeps your recording and sync preferences and does not delete photos or pending photo saves.

Successfully synced history can restore after reinstalling Sundae with the same Apple account and the same iCloud data environment. Development builds and distributed builds can use separate environments. Records that are offline or waiting to upload can still be lost if you delete the app. Deleting the app does not delete records already stored in iCloud. Changing Apple accounts pauses sync so history from the previous account is not uploaded to the new account.

For questions about access to or removal of private history, contact hello@andredalwin.com. The developer does not have a server-side copy that can be searched or deleted on your behalf. Use the in-app history controls to export or request removal of your private records.

5. Apple Watch

When you use the Apple Watch companion, live preview frames, camera state, and control commands travel between your nearby Apple devices using Apple connectivity frameworks. This content is used to operate the session and is not routed through a Sundae server or included in PostHog analytics.

Limited operational events—such as whether a Watch session connected or a remote Shutter request succeeded—may be included in optional app analytics. Endpoint addresses, ports, device-to-device identifiers, packet previews, and diagnostic log text are removed before an event can be sent.

6. Optional app analytics

Sundae uses PostHog Cloud in the United States for product, performance, and bounded reliability analytics. Events retain a random device identifier and technical context. PostHog groups activity into a pseudonymous device profile to help measure active devices. Sundae has no accounts and does not attach your name or email to that profile. Analytics are off by default for new installs. Onboarding offers Yes, enable analytics and Not now. Existing saved choices are respected. You can change the choice in Settings → Analytics & Privacy. Turning it off stops new app analytics and stops queued events from being sent. It does not delete data already received by PostHog. Enabling it later does not replay activity from the off period.

Sundae creates the identifier randomly and keeps it with your analytics choice in this device's Keychain. Neither syncs through iCloud nor transfers to another device. They may survive deleting and reinstalling Sundae, but recovery is not guaranteed. The identifier is not derived from your Apple account, an advertising identifier, or your photos.

What may be sent

App interactions and outcomes, such as completing onboarding, taking a photo, opening the Gallery or Lab, saving an edit, or using a companion feature.
Bounded capture context, such as Vibe identifier, resolution, capture family, output format, lens category, camera position, and whether Save Negative was on.
Performance and reliability measurements, including durations, memory or thermal conditions, queue state, and bounded app-defined operation or failure codes.
Standard technical context supplied by the analytics SDK, such as app version, build, device model and type, operating-system version, locale, screen size, network type, TestFlight status, and the random device identifier.
An approximate country may be derived by PostHog from the network address used to deliver an event. Sundae does not send photo GPS coordinates for this purpose.

Before an app event is sent, Sundae applies a key-based denylist and value-type checks. The filter removes designated sensitive property names and unsupported opaque values; non-redacted scalar properties, including scalar values inside sanitized arrays or dictionaries, can be forwarded. It is not a strict property allowlist.

What is deliberately excluded

Sundae does not send photos, thumbnails, live-preview media, image bytes, filenames, file paths, Photo Library identifiers, photo GPS coordinates, nearby-device endpoints, free-form diagnostic logs, raw system errors, stack traces, or exception screenshots. Session replay, automatic screen capture, automatic element interaction capture, surveys, advertising profiles, and automatic fatal-crash capture are disabled in Sundae's app configuration.

Learn more in the PostHog privacy policy.

7. Website analytics

sundae.cam uses separate browser analytics. When configured, PostHog collects page visits, referrers, interactions such as joining the beta, browser errors, browser and device context, and approximate location derived from network information. Its browser identifier can be stored in cookies or local storage. Website session recording is disabled in the site configuration.

Vercel hosts the site and provides Web Analytics for aggregate traffic measurement, including visited pages, referrers, device and browser information, and approximate location. Vercel Web Analytics does not use cookies for visitor identification. Hosting providers also process network requests to deliver and protect the site. See Vercel's analytics privacy documentation.

Sundae's in-app Share Analytics choice applies to the native app. It does not control website analytics, browser storage, Apple's services, or information you choose to send in a support message. Browser privacy settings can restrict cookies and site storage.

8. TestFlight, feedback, and support

If you install Sundae through TestFlight, Apple automatically provides Apple and the developer with beta testing data such as sessions, device and operating-system details, performance statistics, and crash logs. This collection is part of TestFlight and cannot be controlled by Sundae's in-app analytics switch.

You may also choose to submit written feedback, screenshots, or crash comments. That feedback can contain personal information or visible photo content, so review it before sending. Public-link testers normally appear anonymous unless they include an email address with feedback. Apple controls TestFlight's collection and delivery of this information.

If you email support, the developer receives your email address, message, and any attachments you choose to send. This information is used to reply, investigate issues, and keep a record of the request. You do not need to send your photo library; review screenshots and remove private details before sending them. Email delivery providers process the message as part of delivering it.

See Apple's TestFlight Terms of Service and Privacy Policy.

10. Retention

The random analytics device identifier and analytics choice are stored in a device-only Keychain record. They may remain after you delete Sundae. They are not synchronized through iCloud or restored onto another device, and reinstall recovery is not guaranteed.
Private photography history remains locally until you clear it or remove the app data. A synced copy can remain in your private iCloud storage after deleting Sundae. A previously saved recording or sync pause does not delete existing records. Clear Photography History requests removal locally and in iCloud; cloud removal waits until sync is enabled and the request succeeds. Only successfully synced records can restore after reinstalling with the same Apple account and iCloud data environment.
Other app-local preferences, onboarding state, and working data remain until you reset them where a control is available or delete Sundae, subject to device backups and operating-system behavior.
Photos and RAW negatives already written to Apple Photos are not app-local data and are not removed when you delete Sundae. They remain until you delete them through Apple Photos, subject to Recently Deleted, iCloud Photos, and backup settings.
PostHog controls storage for app analytics and website analytics data under the project's service configuration and PostHog's retention practices. Sundae does not promise a fixed event-retention period in this policy.
Support messages remain as needed to respond, investigate the issue, keep relevant correspondence, or meet legal obligations. You can request removal by email, subject to any information that must be retained.
TestFlight information and Vercel Web Analytics data follow Apple's and Vercel's respective service configurations and retention practices.

11. International processing

Sundae is developed in the Philippines. PostHog's configured app analytics service is hosted in the United States, and Apple, Vercel, and email providers may process information in other countries where they operate. Data-protection laws in those places may differ from the laws where you live. Sundae limits the information sent to these providers and relies on their contractual and technical safeguards.

12. Security

Sundae uses on-device processing, Apple platform protections, transport encryption, and a key-based analytics denylist with value-type filtering to reduce risk. The filter forwards non-redacted scalar properties and is not a strict allowlist. No method of storage or transmission is perfectly secure, so absolute security cannot be guaranteed. Keep your device and operating system updated, protect your device passcode, and maintain backups of photos that matter to you.

13. Children

Sundae is not directed to children under 13, or the equivalent minimum age in their jurisdiction. Children below that age are not permitted to use TestFlight. If you believe a child has provided personal information through beta feedback or another channel, please get in touch so it can be addressed.

14. Your choices and privacy rights

Turn off app analytics in Settings → Analytics & Privacy.
Open Settings → Analytics & Privacy → Photography History to pause recording or iCloud sync, export a readable copy, sync, or clear history. These controls are separate from Share Analytics. Photography History is required for future Year in Review features.
Change available Camera, Photos, Location, and Motion permissions in Apple Settings.
Turn Location Tagging off in Sundae's capture settings.
Delete photos and RAW negatives using Apple Photos. Deleting Sundae removes ordinary app-local data but does not delete media already saved to Apple Photos. Synced photography history may remain in iCloud. The analytics identifier and choice may remain in Keychain as described above.
Contact hello@andredalwin.com about support information or privacy requests. If you leave a TestFlight beta, first make sure important photos are saved; deleting the app can remove pending saves and unsynced history.

Depending on where you live, you may have rights to be informed, access, correct, delete, restrict, object to, or receive a copy of personal information, and to lodge a complaint with a privacy regulator. Sundae has no account and intentionally avoids direct account identifiers, so it may not be possible to connect an event associated with a random analytics identifier to a particular requester. Requests will be handled to the extent the information can be reasonably identified and applicable law requires.

15. Changes and contact

This policy may change as Sundae adds features or its data handling changes. Material changes will be reflected by a new effective date and, when appropriate, an in-app notice.

For privacy questions or requests, contact Andre Dalwin Tan in Manila, Philippines, at hello@andredalwin.com. If you are in the Philippines, you may also learn about your rights or submit a complaint through the National Privacy Commission.