Privacy Policy

Effective October 9, 2026

The short version: Phloto processes your photos on your own device. We do not upload, store, or look at your photos, and we do not run analytics or advertising trackers.

What Phloto does with your photos

• Photos you add are stored in your browser's private storage on your device (the Origin Private File System or IndexedDB). They are not sent to our servers.
• Face and body detection, face recognition, alignment, sequencing, color matching, and video or GIF encoding all run on your device, in your browser.
• Phloto measures the faces in your photos to line them up. This face data stays on your device and is described in full under Face data below.
• Videos and GIFs you export are saved directly to your device.

Face data

What face data Phloto creates. For each face (or pet's head) it finds in a photo or video frame you add, Phloto computes:

• the positions of facial landmarks, such as the eyes, nose, mouth, chin and the outline of the face, and the head's size and angle;
• expression scores, such as whether the eyes are open or the person is smiling;
• a face descriptor: a list of 128 numbers that lets Phloto tell whether two faces in your photos are the same person.

It is computed entirely on your device, by on-device models (Apple's Vision framework in the iOS app, and Google MediaPipe and face-api models that Phloto ships with the app). Your photos and this face data are never sent anywhere to be processed.

How it is used. Only to make your video: to line up each face in the same place, level the eyes, choose which person (or pet) to follow when a photo has several people, group the same person across photos so you can pick who to track, and order photos so the expressions flow. Phloto does not use face data to identify who anyone is, to look anyone up, for advertising, for analytics, or to train any model.

Sharing. Face data is never sent to us, and never shared with, sold to or disclosed to any third party. It is not included in exported videos or GIFs, and not uploaded when you share a link. (A shared link contains only the finished video or GIF you chose to share.)

Where it is stored. On your device only, in Phloto's private app storage, as part of the project the photos belong to. It is not stored on our servers and Phloto does not back it up. (If you back up your whole device with iCloud or a computer, that backup includes app data, including Phloto's, as it does for any app.)

How long it is kept, and deleting it. Face data is kept only as long as the photo or video it came from is in a project on your device. Removing a photo or video from a project deletes its face data; deleting a project deletes all of that project's face data; deleting the Phloto app (or clearing this site's data in your browser) deletes all of it. There is no copy anywhere else to delete.

Google Photos

If you choose to import from Google Photos:

• You sign in with Google and grant Phloto the photospicker.mediaitems.readonly permission. This only lets Phloto read the specific photos you select in Google's own picker. Phloto cannot see the rest of your library.
• The access token Google issues is kept in your browser's memory for the session and is not stored or sent to us.
• Because Google does not allow browsers to download picked photos directly, the photo files pass through a relay at phloto.app on their way from Google to your device. The relay streams each file without storing it, does not log its contents, and only forwards requests to Google's photo servers.
• After import, Phloto deletes the picker session with Google. You can revoke access at any time in your Google Account settings.

Phloto's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Phloto uses Google user data only to import the photos you select into your own project on your device. It is not used for advertising, sold, or used to train models.

Sharing a link

When you tap Share a link, the finished video and/or GIF you choose, plus one still frame for link previews, are uploaded to Phloto's storage (Cloudflare R2) with the title you give it. Anyone with the link can watch and download them; the page is not listed or indexed. Your photos and projects are never uploaded. We keep a view count. Shared files stay until you tap Stop sharing, which deletes them.

Adding photos from links

When you paste links to photos, Phloto downloads each one to your device. Your browser fetches a link directly when the site allows it. Otherwise, and only when you are signed in, the file passes through a relay at phloto.app, which streams it without storing it, does not log its contents, sends no cookies or credentials to that site, and refuses anything that is not a photo or video. The relay counts downloads per account (to limit abuse) and keeps that count for a day.

What we do collect

• Phloto is hosted on Cloudflare. Like any website, Cloudflare processes standard request information (such as IP address, browser type, and the pages requested) to deliver and protect the site.
• Phloto uses your browser's local storage to remember which project you last opened. We do not use advertising or tracking cookies, and we do not run advertising or usage analytics.
• Your account. To use Phloto you sign in with an email address and password. We store your email address, a salted hash of your password (never the password itself), when the account was created, and sign-in sessions. We use your email only to sign you in and to send password-reset emails you ask for. Account data is stored in a Cloudflare database. Your photos, videos and projects are not part of your account and never leave your device.
• Error reports. When something goes wrong in the app, Phloto sends an anonymous error report so we can find and fix bugs: the error message with file names, links, ids and numbers removed, the app build and platform (iOS or web), and a random install id used only to count how many devices see an error. It also records that the app was opened, per build, so we can measure error rates. Error reports never include photos, videos, file names, your email or your account, and are not linked to you. They are kept for 90 days.
• If you email us, we receive your email address and message so we can reply.

Your control over your data

• Delete a project from the Projects menu to remove its photos and analysis from your device.
• Clearing site data for phloto.app in your browser removes everything Phloto has stored.
• Delete your account any time from the ••• menu (Delete account). This removes your email, password hash and sessions from our database.
• Browsers can clear site storage on their own. Use Projects, then Back up project, to keep a copy.

Photos of other people and children

Phloto is a general-purpose tool and is not directed to children under 13. If your photos include other people, make sure you have their permission, or their parent's or guardian's permission for a child, to use their photos. Because processing happens on your device, we do not receive these photos.

Changes

If this policy changes, we will update this page and its effective date.

Contact

Questions or requests: hello@phloto.app