Privacy Policy
Last updated 2026-06-25
Effective Date: 2026-06-21
This Policy is offered in Traditional Chinese, Simplified Chinese, English, and Japanese for your convenience. In case of any inconsistency between language versions, the English version prevails.
In short
We can’t read your photos. They’re encrypted on your device before they ever leave it — our servers only ever hold encrypted ciphertext.
If this matters to you — and if you’re using this app, it does — the rest of this document shows how we deliver on that promise.
1. Scope
This Policy describes how Amazingface (the domain amazingface.app, “we”, “us”) collects, uses, and protects your data through the Amazingface app and its backend relay service (relay.amazingface.app, “the Relay”).
2. What we collect
We collect only the following categories of data, all the minimum required for the app to function:
| Category | What | Source | Why |
|---|---|---|---|
| Account identifier | Anonymous Sign in with Apple subject (sub) from Apple | Apple SIWA flow | Authenticate you and create your account |
| Device public keys | Ed25519 / age public keys generated on your device | Generated automatically by app | Lets other devices encrypt photos for you |
| Encrypted ciphertext | Photos uploaded as encrypted binary + envelopes (encrypted key exchange) | Encrypted on your device, then uploaded | Temporary storage for recipient to download |
| Subscription status | Your tier (Free / Plus / Pro), current-period usage, renewal date | Apple StoreKit Server Notifications | Quota enforcement, subscription management |
| Transaction IDs | Apple-issued subscription and consumable transaction IDs | Apple | Prevent duplicate charging (replay prevention) |
3. What we don’t collect
Important — we have absolutely no access to the following, and we won’t collect it:
- ❌ Your photo content (raw or thumbnails) — encrypted before leaving your device
- ❌ Your Apple ID email or name (unless you voluntarily include them in a support email)
- ❌ Your IP address (used only for the TLS connection and transient rate-limiting; server access logs are disabled, so it is not written to logs or stored)
- ❌ Your location
- ❌ Your contacts
- ❌ Advertising identifiers (IDFA / IDFV)
- ❌ Analytics data (we do not use Firebase, Google Analytics, Mixpanel, or any third-party analytics)
- ❌ Crash reports (no crash reporter in the current version)
- ❌ Who you exchange AmazingDrops with in any identifiable form (we see envelopes only — the recipient is identified by an internal hash, not by their real identity)
4. How we use your data
Only for the minimum necessary functions:
- Authenticate you: verify your SIWA sub so only you can sign into your account
- Buffer encrypted AmazingDrops: hold encrypted ciphertext for the recipient to download within 24 / 48 / 72 hours (per tier)
- Enforce quota: ensure you stay within your tier’s byte allowance
- Process subscription renewals: receive Apple webhooks to keep subscription state correct
We do not:
- Analyze your usage patterns
- Train AI models
- Sell or share any data with advertisers or data brokers
5. Third-party services
We share data only with these necessary third parties:
| Service | What they receive | Why |
|---|---|---|
| Apple | Subscription transaction info | App Store policy — IAP must go through Apple |
| Amazon Web Services (AWS) (our server host) | Encrypted ciphertext + envelopes (the original photos are encrypted on your device; AWS cannot see plaintext) | Cloud host running the Relay service |
| Let’s Encrypt (TLS certificates) | Domain name | HTTPS connection encryption |
Future plan: We intend to migrate AmazingDrop ciphertext storage to Cloudflare R2 (zero-egress-fee object storage) to lower cost and improve transfer speed. R2 will still only see encrypted ciphertext, and we will update this Policy version at that time.
We do not use: Google Analytics, Firebase, Facebook SDK, AppsFlyer, any ad SDK, any analytics SDK.
6. Data retention
| Data type | Retained for |
|---|---|
| AmazingDrop ciphertext (Free users) | 24 hours, then auto-deleted |
| AmazingDrop ciphertext (Plus users) | 48 hours |
| AmazingDrop ciphertext (Pro users) | 72 hours |
| Account data (SIWA sub, subscription status) | Until you delete your account |
| Post-deletion backups | 30 days, then permanently destroyed |
| Application logs (event timestamps, no IP, no request content) | 30 days |
7. Your rights
Regardless of where you live, we provide:
- Access: you can export your encrypted albums anytime (in-app feature)
- Deletion: delete your account instantly in-app (Settings → AmazingDrop identity → delete), or email support@amazingface.app to request permanent server-side deletion; email requests are processed within 30 days
- Correction: your photos live on your device; you edit them directly — we have no copy
- Withdraw consent: cancel your subscription anytime (via Apple)
EU (GDPR), California (CCPA), and UK users have additional statutory rights (including data portability and the right to file complaints with regulators), which we honor under GDPR / CCPA standards.
8. Children
The Service is not directed at children under 13. If we discover we have inadvertently collected data from a child under 13, we will delete it immediately.
9. Encryption details (technical transparency)
For technical users, we disclose our encryption implementation:
- Photo encryption: each photo is encrypted with XChaCha20-Poly1305 (AEAD), keys derived from your password using Argon2id, stored only in your device Keychain
- AmazingDrop encryption: each AmazingDrop is encrypted using the age format, with the recipient device’s X25519 public key as the key exchange point
- Transport: TLS 1.3 end-to-end
- Zero-knowledge architecture: server receives only encrypted envelopes + Ed25519 signatures, never holds plaintext keys
10. Changes
We notify you in-app and update the “Effective Date” for any material changes. Material changes are notified 30 days in advance.
11. Contact
Privacy questions or data rights requests: support@amazingface.app
We commit to responding within 30 days.
Version history
- 2026-06-21: Updated the relay domain to
relay.amazingface.appand the contact email tosupport@amazingface.app; added Simplified Chinese and Japanese versions. - 2026-05-26: Initial release.