Recapt - Privacy Policy
Last updated: September 30, 2026
Recapt is operated by Twentythree5 ("we", "us", "our"). These documents cover
the Recapt mobile application and the website at recaptapp.com (together, the
"App").
Contact: coleman.milligan@twentythree5.com · recaptapp.com
1. Overview
This policy explains what Recapt collects, why, who sees it, and what control
you have. We have tried to describe what the App actually does rather than what
is merely permitted.
2. Information We Collect
a. Information you provide
| What | Why | Required? |
|---|---|---|
| Phone number | Creating and verifying your account by SMS | Yes |
| Date of birth | Enforcing the 16+ age requirement | Yes |
| First and last name | Your display name to friends | Yes |
| Username | Your public handle, e.g. @you | Yes |
| Email address | Account recovery and service notices | Optional |
| Profile photo and bio | Shown on your profile | Optional |
| Photos | The core of the App | You choose |
| Support messages | Answering you | Only if you write in |
b. Contacts
If you grant contacts permission, the App reads your address book **on your
device** so you can choose people to invite.
**For contacts you explicitly choose to invite, we store their name and phone
number on our servers.** We do not upload your address book, and we do not
store contacts you did not invite. See §7 for what this means for them.
You can use Recapt without granting contacts permission.
c. Collected automatically
- Photo metadata — time of capture, the time zone you were in, day of week,
time of day, whether flash fired, front or rear camera, and lens. Used for
the date stamp and for your stats and annual Recapt.
- Device and diagnostic information — device model, OS version, and crash
reports, via Sentry.
- Usage data — features used and timestamps of activity.
- Push notification tokens — to deliver alerts you opted into.
d. From third parties
We do not purchase or receive personal data from data brokers or advertising
networks.
3. How We Use Your Information
- Creating and managing your account
- Delivering the App's features — photo capture, albums, friends, Beeps, chat
- Generating your stats, streaks, and annual Recapt
- Sending notifications you opted into
- Responding to support requests
- Detecting and preventing abuse, and acting on reports
- Diagnosing crashes and improving the App
**We do not use your photos or personal data to train machine learning models,
and we do not sell your data or show you advertising.**
4. How We Share Your Information
We do not sell your personal data. We share it only as follows.
a. With other users
- Your display name, username, and avatar are visible to friends, and on your
public profile link if you share one.
- Photos are visible to the members of the album you posted them to, once that
month reveals.
- Album chat messages are visible to that album's members.
b. With service providers
We use a small number of processors, each only to run the App:
| Provider | Purpose | What they handle |
|---|---|---|
| Supabase | Database, authentication, backend | Account data, photo metadata |
| Amazon Web Services (S3) | Photo storage | Photo files |
| Expo | Push notifications, app delivery | Push tokens |
| Sentry | Crash reporting | Diagnostics, device info |
| Apple | App distribution | As described in Apple's policy |
c. For legal reasons
We may disclose information where required by law, or to protect the rights,
safety, or property of our users or ourselves.
5. Data Retention
| Data | Retained |
|---|---|
| Photos (not saved to profile) | Until February 1 of the following year, then permanently deleted — see Terms §5 |
| Photos saved to your profile | Until you delete them or delete your account |
| Account data | Until you delete your account |
| Album chat messages | Messages expire automatically unless saved |
| Invitation records | Until the invitation is acted on, you delete it, or the invited person asks us to remove it (§7) |
| Content reports | Up to 2 years after resolution, for safety records and repeat-offender detection |
| Crash diagnostics | Per Sentry's retention, currently 90 days |
| Backups | Routine backups may retain deleted data for up to 30 days |
After account deletion is confirmed, we permanently delete your personal data
within 30 days, except where retention is required by law or where a content
report involving your account is still open.
6. Your Rights and Choices
Wherever you live, you may:
- Access — request a copy of the personal data we hold about you
- Correct — update your profile in the App at any time
- Delete — delete your account from Settings → Account → Delete Account
- Object or restrict — ask us to stop certain processing
- Withdraw consent — revoke contacts, camera, or notification permissions
in iOS Settings at any time
To exercise any of these, email coleman.milligan@twentythree5.com. We respond
within 30 days.
European Economic Area / UK (GDPR). Our lawful bases are: performance of a
contract (running your account), consent (contacts access, notifications), and
legitimate interests (safety, abuse prevention, diagnostics). You have the right
to lodge a complaint with your local supervisory authority.
California (CCPA/CPRA). You have the right to know what we collect, to
request deletion, to correct inaccurate information, and to opt out of sale or
sharing. We do not sell or share personal information as those terms are
defined, and we do not process it for cross-context behavioural advertising. We
will not discriminate against you for exercising these rights.
7. If Someone Invited You and You Do Not Use Recapt
If a Recapt user invited you, we hold **your name and phone number as that user
entered them**, so the invitation can be tracked.
You did not agree to our Terms, and you have rights over that record:
- Ask us to delete it — email coleman.milligan@twentythree5.com with the
phone number, and we will remove it and block future invitations to that
number.
- The person who invited you can also delete the invitation from within the App.
We do not use these records for advertising, we do not share them, and we do
not contact you other than the single invitation the user sent you.
8. Camera and Photo Access
- Camera — used only when you are taking a photo in the App.
- Photo library (read) — only when you choose a profile picture.
- Photo library (write) — only when you export a photo to your device.
We do not scan your photo library, and we do not access photos you have not
explicitly chosen.
9. Push Notifications
Notifications cover album activity, friend requests, reveals, chat, and Beeps.
Manage them per-type in Settings, or turn them off entirely in iOS Settings.
10. Data Security
Data is encrypted in transit (TLS) and at rest. Access to production data is
limited. Photo files are served through short-lived signed URLs rather than
public links.
No system is perfectly secure. If a breach affects your personal data, we will
notify you and the relevant authorities as required by law.
11. International Transfers
Our infrastructure is in the United States. Using Recapt from outside the US
means your data is transferred to and processed there, under the safeguards our
processors provide.
12. Children's Privacy
Recapt is not for anyone under 16. We do not knowingly collect their personal
information. If you believe a child under 16 has an account, contact us and we
will delete it promptly.
13. Changes to This Policy
We may update this policy. Material changes will be announced in the App or by
notice to you. The "last updated" date at the top always reflects the current
version.
14. Contact Us
Twentythree5
Email: coleman.milligan@twentythree5.com
Website: recaptapp.com
To report objectionable content or an abusive user, use the Report option in
the App (see Terms §9), or email the address above. We respond to reports within
24 hours.
*These Terms of Service and this Privacy Policy were last updated on
September 30, 2026.*