←  Back to Privacy

Hush Hush Snap Snap Privacy Policy

Effective Date: April 25, 2026 · Last Updated: August 20, 2026 · Version 1.10 · Publisher: Thomas Ray Publishing LLC

0. Privacy at a glance

Hush Hush Snap Snap is built to work mostly on your device.

We do not upload your photos or videos to Thomas Ray Publishing. When you take a photo or video, it is saved to your iOS Photos library through Apple's permission system. We cannot see it.

We ask for Camera access so the app can work, Microphone access only when you record a video with audio, Photo Library access so we can save your captures, notice when you keep or delete a photo Hush Hush Snap Snap created (to improve automatic framing, entirely on your device), and — only if you choose it — save metadata changes back onto a photo you picked, Location (While Using the App) only if you turn on photo location tagging, Motion & Fitness sensors only while the camera is open (for the horizon level and stability detection), and Speech Recognition only if you arm the optional hands-free voice trigger.

We collect pseudonymous usage analytics by default to help us improve the App, and we receive feedback only when you choose to send it. Analytics are tied to a random identifier on your device that we do not link to your name, your Apple Account, or your advertising identifier. You can turn analytics off at any time in Settings → Privacy & Legal → "Share Anonymous Analytics." If you send feedback, you may choose to include your name and email so we can reply.

We do not use advertising SDKs, data brokers, the advertising identifier (IDFA), App Tracking Transparency tracking, or any third-party crash, analytics, or marketing tools. This version of the App contains no third-party software development kits of any kind — only Apple system frameworks and our own code.

Our on-device intelligence — including any text the App suggests — never leaves your device. Some of what the App shows you (short photo captions, title suggestions, and the camera settings produced from a scene description you type or dictate) is generated by Apple's on-device models as a suggestion for you to review, edit, or discard (Section 7). Nothing you type, and none of the generated text, is transmitted to us or to any third party, including any third-party AI.

The Snappy Kit tools run entirely on your device and make no network requests (Section 6.8). Text the App recognizes, images it magnifies, and metadata it reads out of a photo you select are never transmitted to us. The Metadata Editor exists so you can see and remove what your photo files disclose before you share them.

When you point the camera at a QR code or barcode, its content is detected and decoded entirely on your device and is never collected, stored, or transmitted to Thomas Ray Publishing. We record only an anonymous count that a code of a given type was scanned (for example, "a Wi-Fi code was scanned") as part of the optional analytics described above — never the decoded link, network name, contact, or other content. A scanned link is never opened automatically: we always show you the full destination first, and only open it (in Safari) or take another action when you explicitly choose to. Scanning itself never makes a network request.

All of our on-device intelligence (subject framing, smile/palm/voice triggers, scene assistance, burst ranking, adaptive defaults, noise reduction, text recognition) runs locally on your device and is not transmitted to us. (Auto Snap's on-device "feature print" analysis stays entirely on your device: it is never contributed to analytics or transmitted in any form — the earlier off-device contribution was retired on July 2, 2026. Section 6.5 describes how it works, including an honest discussion of that feature print's privacy properties.)

Photos and videos you capture may contain standard file metadata (date, time, camera settings). If you turn on location tagging, your photos may contain GPS coordinates. Live Photos, and Cinematic and Spatial videos, contain additional audio, video, or depth data. If you share these files, that metadata travels with them.

Purchases and subscriptions are handled entirely by Apple. We never see your payment details, and we cannot cancel a subscription or issue a refund (Section 6.3).

You can turn analytics off at any time in Settings, revoke any permission in iOS Settings, delete on-device data by deleting the App, and request deletion of developer-accessible analytics or feedback using the contact details in Section 20.

---

1. About this policy

This policy explains what information Hush Hush Snap Snap (the "App") and Thomas Ray Publishing LLC ("Thomas Ray Publishing," "TRP," "we," "us," "our") handle, why, and the choices you have. It applies worldwide to everyone who uses the App. Where a specific law gives you rights, we describe them in Section 13 and apply the strongest reasonable standard to all users as a matter of policy.

This policy is separate from our Terms of Use, which governs your use of the App.

2. Who we are and how to contact us

Controller / publisher: Thomas Ray Publishing LLC

Privacy contact:
Thomas Ray Publishing LLC
c/o InCorp Services, Inc.
2360 Corporate Circle, Suite 400
Henderson, NV 89074-7722
Email: contact@thomasraypublishing.com
Web: https://thomasraypublishing.com/

We are a single-developer business. There is no separate data protection officer; the privacy contact above reaches the person responsible for privacy.

We have not appointed a representative in the European Union under GDPR Article 27 or in the United Kingdom under UK GDPR Article 27. If you are in the EU/EEA or the UK and have a question, request, or complaint about your personal data, please contact us at the email above and we will respond directly.

3. What the App does

Hush Hush Snap Snap is a camera app for iPhone with an Apple Watch companion. Its core function — taking photos and short videos with visual, audio, and haptic countdown cues, and optional hands-free triggers — happens on your device. It also includes Snappy Kit, a set of on-device utility tools for reading, magnifying, and inspecting what your camera sees (Section 6.8). The App has no user accounts, no login, and no Thomas Ray Publishing backend server other than Apple's CloudKit and StoreKit services described below.

4. Permissions we request, and why

The App requests the following iOS permissions. Each is requested in context, the first time the related feature is used, and each can be changed at any time in iOS Settings → Privacy & Security.

• Camera — required for the App's core function. The App cannot operate as a camera without it, and the Snappy Kit reading tools use the live camera view.
• Microphone — requested only when you record a video, so the video includes audio.
• Photo Library — requested for three purposes: so the App can save the photos and videos you capture; so the optional Auto Snap feature can observe whether you keep or delete a photo it created (Section 6.5); and, only if you choose it, so the Snappy Kit Metadata Editor can save your metadata changes back onto a photo you selected ("edit in place," Section 6.8). The App never reads, browses, imports, or transmits any other photo in your library. Most saving uses add-only access, which cannot read your library at all. Two optional features request the broader read-and-write access — Auto Snap's retention learning and the Metadata Editor's edit-in-place option — each requested in context, only when you use that feature, and each declinable without losing the rest of the App.
• Location (While Using the App) — requested only if you turn on GPS location tagging, which is off by default. It is used solely to embed coordinates into the metadata of photos you capture, on your device. These coordinates are not transmitted to Thomas Ray Publishing and are not stored by us in any database, log, or cache (Section 8).
• Motion & Fitness — read only while the camera screen is open, to show the on-screen horizon level and to detect when your hand is steady or the device is resting on a surface so capture features can wait for the right moment. Motion data is processed entirely on-device, never persisted, never transmitted, and never associated with you.
• Speech Recognition — requested only if you arm the optional hands-free voice trigger. Recognition runs on-device to detect a single configurable trigger word; no audio recording is stored or transmitted (Section 7).
• Calendar (Add Only) — requested only if you tap "Add to Calendar" on an event QR code you scan. The App can add that one event to your calendar but uses write-only access — it cannot read any of your existing calendar data. If you never scan an event QR code, the App never requests Calendar access.

The App does not request: Contacts, Reminders, Health, Bluetooth, Face ID, "Always" or background location, or App Tracking Transparency tracking. (Scanning a contact QR code opens Apple's system "Add Contact" card, which manages its own access — the App itself requests no Contacts permission and cannot read your contacts.) If you choose to allow notifications, the App may schedule a single local reminder before a free trial ends (Section 6.3); notifications are optional and you can decline or revoke them at any time.

5. What we do not collect

For this version of the App, we do not collect, and the App does not contain code to collect (each statement is accurate as of this version; if a future version changes any of these, we will update this policy before that change takes effect):

• Your photos or videos. They are saved to your device's Photos library. If you have Apple's iCloud Photos turned on, Apple may sync them across your devices — that is your relationship with Apple, not with us, and we have no access to it.
• Anything the Snappy Kit tools recognize, display, magnify, speak, or edit — including recognized text, cropped images, and any metadata value read out of a photo you select (Section 6.8).
• Your name, postal address, or phone number (unless you type them into a feedback submission — see Section 6.2).
• Your Apple Account identifier, device serial number, the vendor identifier (IDFV), or the advertising identifier (IDFA).
• Any cross-app or cross-site tracking signal. The App does not track you across other companies' apps or websites.
• Biometric identity data. The App uses Apple's Vision framework on-device to detect faces, smiles, palms, and human bodies for its trigger and framing features, and to recognize text (Sections 6.8 and 7), but it does not identify who a person is, build a faceprint identity, or perform facial recognition.
• Contacts, calendar, or health data. (If you tap "Add to Calendar" on a scanned event QR code, the App writes only that one event using write-only access and never reads your calendar; scanned contact cards are handed to Apple's system "Add Contact" card, so the App never reads your contacts.)
• Payment card information. All purchases and subscriptions are handled by Apple; we never see your card.
• Data through any third-party SDK. This version of the App integrates none — including, for clarity, no Firebase, Sentry, Crashlytics, Mixpanel, Amplitude, AppsFlyer, Adjust, Branch, Segment, Meta, Google, or AdMob software.

6. The data we do handle

We handle data in a limited set of situations. Several are optional, and analytics can be turned off at any time.

6.1 Usage analytics (pseudonymous; on by default; you can turn them off)

By default, the App records limited usage information to help us improve it. This may include: which features you use and tap, session start and length, screen navigation, engagement with paid features, capture performance such as latency and frame rates, accessibility setting states (for example whether VoiceOver is active, the Dynamic Type size, and Reduce Motion / Reduce Transparency states), your device model and iOS version, locale, and time zone, your subscription or entitlement state, and non-crash error context.

For the optional hands-free smile trigger specifically, these usage records may include anonymous values derived from on-device face detection — that the trigger fired, the number of faces in the frame, and a coarse smile-intensity bucket — but never any face image, facial geometry or landmark data, feature print, or biometric identifier, and nothing that identifies a person.

For the Snappy Kit tools, these records are limited to counts, outcome labels, and duration buckets — that a tool was opened, declined, or closed; that a recognition produced a result or was saved; that an operation failed; and whether a hardware button triggered it. No recognized text, no image, no filename, and no metadata value is ever included in an analytics event (Section 6.8).

Crash and performance diagnostics. The App uses Apple's MetricKit to receive crash, hang, and performance reports about the App from iOS. Beginning with version 1.4.0 these reports are included in the diagnostics described above; in earlier versions they were collected but discarded without ever being sent. A report describes how the App itself behaved — stack information, timing, and resource use — and contains no photo, no recognized text, and none of the content of anything you captured, scanned, or edited.

These records are associated with a random identifier generated on your device that is used to group your own usage records together — so we can measure reliability (such as crash-free rate), improve the App, and locate your records if you ask us to delete them (Section 14). You can view this identifier at Settings → Privacy & Data → "Your Anonymous ID." It is not the IDFA or IDFV, is not linked by us to your name, Apple Account, or device serial, and resets when you delete the App (it is excluded from device backup and does not carry over to a new device through a backup or transfer). We do not use this data to build a profile of you or to re-identify you, and we never use it for cross-app or cross-developer tracking.

Analytics are stored in an Apple CloudKit public database (see Sections 10 and 18). You can turn analytics off at any time in Settings → Privacy & Legal → "Share Anonymous Analytics." This single toggle is your opt-out worldwide. When analytics are off, the App does not queue, generate, or send analytics events, and any queued events are purged.

6.2 Feedback (only when you submit)

If you send feedback through Settings → Feedback, we receive a record containing: the message you write; basic technical context (device model, iOS version, App version and build, locale, time zone, a snapshot of accessibility settings, device thermal state and battery level at submission, and a short log of your most recent in-app actions used to reproduce issues); and your name and email address only if you choose to provide them. An anonymous submission also includes the random analytics identifier so we can connect your report to diagnostic context; if you provide a name or an email address, the App omits that identifier from the diagnostics it attaches to the submission — a report you sign is never automatically paired with the key to your usage history. (One deliberate exception: the optional data-deletion request in Settings → Privacy & Data pre-fills your Anonymous ID into the message text itself, because locating your records is that request's purpose — the pre-filled text is visible and editable before you send.) You may also optionally attach up to three screenshots from your photo library; attachment is entirely user-initiated. If you include identifying details in your message, that feedback is no longer pseudonymous to us. Feedback records and any attached screenshots are stored in Apple CloudKit (the public database — see Sections 10 and 18) and are used solely to respond to you and to diagnose and fix issues — never for analytics profiling, advertising, or model training.

6.3 Purchases, subscriptions, and the free trial

Purchases and subscriptions are processed entirely by Apple through StoreKit. The App reads your current entitlement from Apple only to unlock the features included in your tier. We do not receive or store your payment details, we cannot see your payment method, and we do not export StoreKit transaction data anywhere. Refunds and cancellations are handled solely by Apple; we cannot cancel a subscription or issue a refund. See the Terms of Use for the commercial terms.

The App offers a 7-day free trial. The trial is opt-in: it begins only when you choose to start it from the App's upgrade screen — it does not start automatically when you install or open the App. The trial is not an App Store introductory offer: it is managed on your device by the App, it requires no payment information, and it never converts into a charge. Apple does not bill you when the trial starts or ends.

The App records the date the trial started in two places on your device: in the App's settings, and — to protect the one-time trial against tampering — as a signed entry in the device Keychain, Apple's secure storage. The Keychain entry stays on your device but is not removed when you delete the App: it persists across deletion and reinstall, and it moves to a new device only inside an encrypted device backup or transfer (a full device erase clears it). Its only content is the trial start date and an integrity signature; we never receive it, and other apps cannot read it. If you have iCloud enabled, the App also syncs the start date through your iCloud Key-Value Store so the trial does not restart on a new device signed into the same Apple Account. If you allow notifications, the App may schedule a single local reminder before the trial ends; the reminder is generated entirely on your device and no notification data is transmitted off the device.

6.4 iCloud and your data (we cannot read it)

In the current version of the App, your settings, per-lens default timer durations, capture history, adaptive-defaults learning, and any saved Snappy Kit results are stored on your device only — they do not sync to iCloud or anywhere else. The exceptions are the free-trial start date (Section 6.3), which syncs through your iCloud Key-Value Store — encrypted by Apple, tied to your Apple Account, and not readable by Thomas Ray Publishing — so the trial does not restart on a new device signed into the same Apple Account, and that date's tamper-protection copy in the device Keychain (Section 6.3), which stays on the device, survives deleting the App, and moves only inside an encrypted device backup. You can disable iCloud for the App in Settings → [Your Name] → iCloud → Apps Using iCloud → Hush Hush Snap Snap. (Cross-device sync of per-lens defaults and adaptive-defaults learning is planned to return in a future update; if it does, it will use your personal iCloud private database, which we also cannot read, and this policy will be updated.)

6.5 Auto Snap retention observation and the on-device "feature print"

Auto Snap is available as a paid feature. The retention observation described below runs only if you use Auto Snap and grant the broader Photo Library access it requests.

The optional Auto Snap feature crops a photo around its subject. To measure and improve framing quality, the App observes — only for photos Auto Snap itself created — whether you delete the cropped photo within one hour, twenty-four hours, or seven days, and whether you deleted the cropped photo while keeping the original. This observation runs entirely on your device via Apple's PhotoKit `PHPhotoLibraryChangeObserver` API. We never read, copy, or transmit the photo itself, and we never observe any photo you did not capture with this App. Only an anonymous retention statistic is included in the analytics report described in Section 6.1, which you can turn off at any time. If you decline the broader Photo Library access prompt or revoke it in iOS Settings, the App continues to save photos but does not collect retention data.

To improve the Auto Snap framing algorithm, the App also uses Apple's Vision framework to generate a mathematical "feature print" — a 768-number summary of an Auto Snap photo's visual characteristics.

These feature prints are computed and stored only on your device and are never transmitted to us or anyone else, in any form. The off-device "fleet contribution" that an earlier version of this section described was retired on July 2, 2026 and removed from the App; feature prints now always stay on your iPhone, regardless of your Share Anonymous Analytics setting. Only the anonymous retention statistic above — never the feature print itself — is ever included in analytics.

An honest note about the feature print. A feature print is much smaller than the original photo, but it is not cryptographically irreversible: peer-reviewed academic research has demonstrated that similar deep-learning image embeddings can in some cases be partially reconstructed into approximate source images (see Reversing Deep Face Embeddings with Probable Privacy Protection, arXiv:2310.03005, and Unlocking Visual Secrets: Inverting Features with Diffusion Priors for Image Reconstruction, arXiv:2412.10448). We disclose this so you can make an informed decision. The dispositive point, however, is that these summaries never leave your device and we never receive them — so this property does not expose your data to us. On-device, they are used only to help a local model predict which crops you tend to keep; no part of this leaves your iPhone.

6.6 On-device photo-framing analysis

Hush Hush Snap Snap can analyze photos you take, entirely on your device, to improve its automatic framing. This produces small mathematical summaries ("feature prints," Section 6.5) and framing-preference signals that stay on your device and are never transmitted to us or anyone else. As part of this analysis, the App checks whether a captured photo is still in your Photos library one hour, twenty-four hours, and seven days after you take it, and records only which of those checkpoints the photo survived — never the photo itself, and never why you kept or deleted it. You can turn this off, and erase everything it has learned, at any time in Settings → Privacy & Data → Improve Photo Framing → "Help Improve Photo Framing" (toggle) or "Reset Learning" (erases all derived records). This feature is on by default because it operates entirely on-device and is not transmitted; GDPR Article 6(1)(f) (legitimate interest) is the legal basis, balanced against the low privacy impact of purely local processing and the easy opt-out above. Derived records are capped at a fixed maximum — approximately 2,000 records, a few megabytes — and once that cap is reached, the oldest records are discarded automatically to make room for new ones.

6.7 Club Mode access code

Some free features can be unlocked with an access code you enter ("Club Mode"). Your code is checked entirely on your device by comparing a salted, one-way SHA-256 digest against a value built into the App. Your code is never logged, never stored in readable form, and never transmitted to us. Club Mode unlocks only free features; it is not a way to obtain the paid features (those come only from an App Store purchase or subscription). If you enter a code, the only thing recorded in the optional analytics described in Section 6.1 is whether an unlock attempt succeeded or failed — never the code you typed.

6.8 Snappy Kit tools (on-device; no network)

Snappy Kit is a set of utility tools reached from a palette on the camera screen and from Settings. Every Snappy Kit tool runs entirely on your device and makes no network requests. Nothing a Snappy Kit tool recognizes, displays, magnifies, speaks, or edits is transmitted to Thomas Ray Publishing or to anyone else.

• Text Grab — point the camera at text and the App recognizes it using Apple's Vision framework, on device. You can copy it, hear it read aloud, share it, or save it.
• Fine Print — freezes a full-resolution still so you can magnify it, raise contrast, and hear it read aloud; an optional torch helps in low light. A magnified image can be saved to a "Fine Print" album in your Photos library using the App's add-only access.
• Metadata Editor — lets you choose one photo and see everything its file discloses (EXIF, GPS coordinates, device details, timestamps), then edit or remove those fields and save.

Live camera frames used by Text Grab and Fine Print are analyzed in memory and discarded immediately. Recognized text and cropped images are held in memory only unless you tap Save.

If you save a result, it is written to a database inside the App's own storage on your device (its Application Support directory). A saved record holds the recognized text, confidence values, and the cropped image. Saved results are never transmitted, are not synced to iCloud, and are deleted when you delete the App. You can delete them individually in the App.

Read Aloud uses Apple's on-device speech synthesis. Nothing is recorded and no audio leaves your device. Additional or higher-quality voices are downloaded by iOS itself, from iOS Settings — that is a system action you take, not something the App does.

The Metadata Editor and your photos. You choose a photo through Apple's system photo picker, which hands the App exactly that one photo — the App cannot see, browse, or enumerate anything else in your library, and the picker itself requires no photo-library permission. Saving a corrected copy uses add-only access. If you instead choose to edit the original in place, the App asks for the broader read-and-write Photo Library access at that moment; you can decline and still save copies. The Metadata Editor reads the location and other metadata inside the photo you selected in order to show it to you and let you remove it. This is the opposite of collection: nothing it reads is sent to us, logged by us, or retained by us. Please read Section 6 of the Terms of Use for what this feature does and does not guarantee before you rely on it to strip data from a photo you intend to share.

What Snappy Kit contributes to analytics (only if analytics are on, Section 6.1): counts, outcome labels, and duration buckets — that a tool was opened, declined, or closed; that a recognition produced a result or was saved; that an operation failed; and whether a hardware button triggered it. No recognized text, no image, no filename, and no metadata value is ever included in an analytics event. The Metadata Editor's telemetry was deliberately built so that it can report that a save failed without ever naming what was edited.

7. On-device intelligence (ML / AI)

Hush Hush Snap Snap uses several on-device machine-learning features to improve the camera experience. All inference and training run locally on your iPhone or Apple Watch. None of the inputs, models, or learned parameters are transmitted to Thomas Ray Publishing or any third party, including any third-party AI. (Section 6.5 describes Auto Snap's on-device feature-print analysis; those feature prints stay on your device and are never contributed to analytics or otherwise transmitted. Section 6.8 describes the Snappy Kit tools, which likewise run only on your device.)

AI-generated suggestions. Some of the text the App shows you is generated by Apple's on-device models as a suggestion for you to review, edit, or accept — specifically: short photo captions and photo-title suggestions shown in burst review and Smart Titles, and the camera settings produced when you turn a typed or dictated scene description into a Scene Preset. This is assistive output, not authored content presented as fact; you decide whether to use it. Where a caption is shown in the App it is labeled as on-device AI. Nothing you type, and none of the generated captions, titles, or settings, is transmitted to us or to any third party. All of it is produced on your device by Apple's local models.

• Apple Vision — face landmarks, smile, palm, and hand-pose detection for the silent-trigger features; face / human-body detection for Auto Snap framing and cinematic subject tracking; and text recognition (OCR) for the Snappy Kit reading tools (Section 6.8). Each live-view frame is analyzed in memory and discarded immediately; no frames are stored or transmitted, and no person is identified.
• Apple Foundation Models — used for optional on-device scene assistance and quality scoring, for turning a typed or dictated scene description into camera settings (Scene Presets, paid), and for generating the short photo captions and photo-title suggestions shown in burst review and Smart Titles (paid), via Apple's local models. Runs entirely on-device; neither the photo, the generated text, nor anything you type is transmitted.
• Apple Speech Recognition — used only when the voice trigger is armed, to detect a single configurable trigger word, on-device. No audio recording is stored or transmitted.
• Apple Speech Synthesis — used by Read Aloud (Section 6.8) to speak recognized text on your device. Nothing is recorded and no audio is transmitted.
• User-trained smile classifier (paid, opt-in) — when you enable "Train Smile," a k-nearest-neighbor classifier is trained from your labeled examples using Apple's `VNGenerateImageFeaturePrintRequest`. The classifier file is stored in the App's local Application Support directory, is never transmitted off your device, and is erased when you delete the App. Re-training it ("Re-train Smile" in Settings) replaces the previous model; there is no separate reset control.
• Adaptive Defaults (opt-in) — when enabled, the App records bounded, automatically pruned capture metadata (lens, ISO, exposure, scene category, cue settings, whether you reshot) to learn your preferred defaults over time. It never includes the photo itself or any personal identifier. You can reset all learned data and disable the feature at any time in Settings → Adaptive Defaults. This data is stored in your local on-device database only; in the current version it does not sync to iCloud (Section 6.4).
• Burst Ranker (paid) — a Core ML model trained entirely on-device from your own capture data to pick the best frame from a burst. The trained model file is stored in the App's local sandbox.
• Enhanced Noise Reduction — an on-device noise-reduction stage that runs on captured photos. Processing happens entirely on the device; no frames, intermediate images, or model parameters are transmitted off the device.
• Night capture modes (paid) — Hush the Night Away, Long Exposure, and Astro each combine multiple frames captured in quick succession into a single low-light or night-sky photo. All of it runs entirely on-device; no frame, intermediate image, or merged result is ever transmitted off your iPhone.

Photos already in your Photo Library are never read by the App for any AI, training, or analytics purpose. The one place the App reads an existing photo at all is the Snappy Kit Metadata Editor, which reads only the single photo you hand it through Apple's picker, at your request, to show you its metadata (Section 6.8). Camera frames are processed momentarily for the active trigger, capture, or recognition and are not persisted unless you save them.

8. Photo and video metadata, location, and Live/Cinematic/Spatial media

Photos and videos you capture may contain standard technical metadata, such as date and time and camera settings (lens, exposure, ISO). This metadata is written into the file on your device.

If you turn on GPS location tagging (off by default), your captured photos will additionally contain your location coordinates in their metadata — latitude, longitude, altitude, horizontal accuracy, a UTC timestamp, and, when moving, speed/direction and compass heading. We do not see or transmit this; the coordinates are embedded in the photo file and travel with the file if you share it. Anyone you share the photo with may be able to read them. The App requests "When In Use" location only, and location reading stops when the camera screen is dismissed or the App is backgrounded. If you grant approximate location, the App embeds the approximate location with a processing-method indicator so downstream viewers recognize the lower precision.

To remove location or other metadata before sharing, you can use the iOS Photos app's built-in option (share sheet → Options → Location), or the App's own Metadata Editor (Section 6.8), which shows you every field a photo discloses and lets you strip it. If you are removing metadata for privacy or safety reasons, check the result yourself before you share the file — see Section 6 of the Terms of Use, which sets out the limits of that feature. Metadata can also survive in another copy of a file, in a cloud backup, in a version history, or in a file you already shared, none of which the App controls.

Live Photos contain a short audio and video segment in addition to the still image. Cinematic video contains depth information, and Spatial video is recorded in 3D for viewing on Apple Vision Pro. If you share any of these files, that additional audio, video, or depth data travels with the file.

9. Why we handle data, and our legal bases

For users in the EU/EEA and the UK, the legal bases under the GDPR / UK GDPR are:

• Core camera and tool functions (Camera, Microphone, Photo Library, Motion, on-device capture, voice trigger, the Snappy Kit tools, and location tagging you enable): performance of the service you requested and your consent expressed through the relevant iOS permission and in-app toggles (Articles 6(1)(b) and 6(1)(a)).
• Analytics: our legitimate interest in maintaining and improving the App (Article 6(1)(f)), balanced against your ability to turn analytics off at any time in-app at no cost. Where the ePrivacy Directive 2002/58/EC (EU/EEA) or the Privacy and Electronic Communications Regulations (UK) requires consent for non-strictly-necessary storage on or access to your device, we rely on consent; you can express the absence of consent by turning analytics off in Settings, which is available worldwide from first launch.
• Feedback you submit: your consent (Article 6(1)(a)) and our legitimate interest in diagnosing issues and improving the App (Article 6(1)(f)).
• Purchases and subscriptions: performance of a contract and compliance with Apple's payment processing (Article 6(1)(b)), handled by Apple.

For users elsewhere, we handle data on equivalent grounds: to provide features you request, with your consent for optional features, and for our legitimate interest in maintaining and improving the App.

10. Where your data is stored, and who processes it

We use only Apple as a service provider:

• Apple CloudKit stores optional analytics and feedback records in a public database. Separately, your free-trial start date syncs through Apple's iCloud Key-Value Store (Section 6.3), which we cannot read. In the current version, no other App data is stored in iCloud. (The same CloudKit container also holds Thomas Ray Publishing's own App Store sales and impression figures, which Apple supplies to us as the developer. That is our business data, not data collected from you — it contains nothing about you or about your use of the App.)
• Apple App Store / StoreKit processes purchases and subscriptions.

Apple acts as our processor for the CloudKit data we can access, under Apple's published terms and Data Processing Addendum. We use no analytics vendor, crash reporter, support desk, email service provider, customer-relationship tool, or non-Apple payment processor.

11. International data transfers

Captured photos and videos remain on your device unless you use Apple's own iCloud features. For the limited analytics and feedback data we handle, Apple processes and stores CloudKit data across its global infrastructure; the processing location depends on Apple's routing. Apple applies its own safeguards for international transfers, including Standard Contractual Clauses where required, under Apple's Data Processing Addendum. We do not transfer your data to any non-Apple recipient.

12. How long we keep data

We keep data only as long as necessary for the purpose it was collected, then delete or de-identify it.

Deleting the App removes its on-device data, including the random analytics identifier and any saved Snappy Kit results — with one exception: the Keychain trial entry described above remains until a full device erase. Because analytics and feedback records are keyed to that identifier, deleting the App makes it harder for us to locate those specific records for a later deletion request (Section 14).

13. Your rights

We extend the following rights to all users as a matter of policy, regardless of where you live, to the extent they apply:

• Access — ask what data we hold that is associated with your random analytics identifier.
• Correction — ask us to correct inaccurate data.
• Deletion / erasure — ask us to delete developer-accessible analytics or feedback associated with your identifier.
• Restriction and objection — ask us to limit or stop processing.
• Portability — ask for a copy of data you provided, in a portable format.
• Withdraw consent — turn analytics off, or revoke any iOS permission, at any time, without penalty to the App's core function.
• Non-discrimination — we will not degrade your experience for exercising these rights.

If you are in the EU/EEA, the UK, Brazil, Canada, Japan, or another region with a privacy authority, you also have the right to complain to that authority (Section 20). If you are in California, see Section 16.

14. How to exercise your rights

Because the App has no accounts, we have no name, email, or login tied to your usage. We identify developer-accessible records by the random analytics identifier described in Section 6.1, which you can view in the App at Settings → Privacy & Data → "Your Anonymous ID" and which resets when you delete the App. As a result:

• The most reliable way to stop all analytics collection is to turn off "Share Anonymous Analytics" in Settings → Privacy & Legal, which takes effect immediately.
• Deleting the App removes all on-device data, including the identifier and any saved Snappy Kit results.
• To request access to or deletion of developer-accessible analytics or feedback, email contact@thomasraypublishing.com. To make this precise, open Settings → Privacy & Data → "Your Anonymous ID", copy the identifier shown, and include it in your request — it is the only key by which we can locate the exact analytics records tied to your install. (A feedback submission that included your name or email carries no analytics identifier in its attached diagnostics — reference those contact details and we can locate the submission itself directly. A deletion request sent through the App pre-fills the identifier into the message text for exactly this purpose.) Without it, records are pseudonymous and we can only make reasonable, good-faith efforts to locate them. We aim to respond to rights requests within 30 days (45 days for California requests, Section 16).

15. "Do Not Track" and opt-out preference signals

The App is not a web browser and does not track you across third-party websites or apps for advertising. Because there is no cross-context tracking to disable, the App does not act on browser "Do Not Track" headers. Where a recognized opt-out preference signal applies to us under law, we honor it; however, as described in Section 16, we do not sell or share personal information, so there is nothing to opt out of.

16. We do not sell or share your personal information (California and beyond)

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you. We have not done so in the 12 months preceding the effective date of this policy.

This policy complies with the California Online Privacy Protection Act (CalOPPA). If you are a California resident, you have rights under the CCPA as amended by the CPRA: the right to know, to delete, to correct, to opt out of sale/sharing (we do none), and to non-discrimination. Under California Civil Code §1798.83 ("Shine the Light"), we confirm we do not disclose personal information to third parties for their direct marketing purposes. To submit a California request, email contact@thomasraypublishing.com with the subject "California Privacy Rights Request"; we will verify your identity and respond within 45 days.

17. Children's privacy

The App is rated 4+ but is not directed to children under 13 and is not offered in Apple's Kids Category. We do not knowingly collect personal information from children under 13 (or under the higher age of digital consent that applies in your country). If you believe a child has provided us personal information, contact contact@thomasraypublishing.com and we will delete it.

18. How we protect data

Data on your device is protected by iOS sandboxing and data protection. Analytics and feedback are transmitted to Apple's services over encrypted connections (TLS) and stored on Apple's infrastructure.

Please note an important distinction: the analytics and feedback we can access are stored in an Apple CloudKit public database. This data is encrypted in transit and protected on Apple's infrastructure, but a CloudKit public database is not end-to-end encrypted in the way Apple's private databases are. This means it is technically accessible to us (and to Apple as our infrastructure provider) and could be disclosed if required by valid legal process, as with any cloud-hosted data. We minimize what is sent and key analytics to a random per-install identifier, not your identity. Your free-trial start date (Section 6.4) is held in your iCloud Key-Value Store, which we cannot read. Everything the Snappy Kit tools produce stays on your device and is never transmitted at all (Section 6.8). No method of transmission or storage is completely secure.

19. Changes to this policy

We may update this policy. When we do, we will change the "Last Updated" date and version above and post the updated policy at its URL. For material changes affecting data we collect or how we use it, we will provide an in-app notice and, where the law requires, ask for your renewed consent. Continued use after a non-material update means the updated policy applies.

20. Contact and supervisory authorities

Questions, requests, or complaints:

Thomas Ray Publishing LLC
c/o InCorp Services, Inc.
2360 Corporate Circle, Suite 400
Henderson, NV 89074-7722
Email: contact@thomasraypublishing.com
Web: https://thomasraypublishing.com/

If you are in the EU/EEA or the UK and are not satisfied with our response, you may lodge a complaint with your local data protection authority — for example, your national supervisory authority in the EU/EEA, or the Information Commissioner's Office (ICO) in the UK. In California, you may contact the California Privacy Protection Agency or the California Attorney General. In Brazil, the Autoridade Nacional de Proteção de Dados (ANPD). In Canada, the Office of the Privacy Commissioner.

---

Hush Hush Snap Snap is a product of Thomas Ray Publishing LLC. This Privacy Policy is version 1.10, last updated August 20, 2026.

© 2026 Thomas Ray Publishing LLC. All rights reserved.

---

Hush Hush Snap Snap Terms of Use →  ·  All TRP apps →