Privacy

Summary

Metrochrome develops your photographs on your device. There is no account to create, we never receive your pictures, and we do not sell, rent or share personal data.

The app does send anonymous crash reports and usage statistics, through Google Firebase. Both can be turned off in Settings → Privacy, and section 05 says exactly what they contain.

Your photographs

Metrochrome reads the photographs you choose through Apple's own photo picker, which runs outside the app. Only the frames you pick are handed over; the app has no permission to read your photo library and cannot browse the rest of it.

• Every emulsion, development and print adjustment is computed on the device. Nothing is sent anywhere to be processed.
• Imported frames, their scans and thumbnails are stored inside the app's own folder, and are removed when you delete the app.
• Your originals in the photo library are never altered.
• Nothing is uploaded, and there is no account, no cloud copy and no sync between devices.

The app asks for permission to add to your photo library only, and only when you save an export. It never asks for read access.

What an export carries

An exported print keeps the original photograph's camera and exposure metadata by default — the date, the camera and lens, the exposure settings. Location is removed by default, including the GPS coordinates and any place names.

Both are yours to change in Settings → Export defaults, and on the export sheet itself. An export goes only where you send it.

Purchases

The Metrochrome Pass is sold through the App Store. Apple processes the payment; we never receive your name, address, card or Apple Account details.

Purchases are managed for us by RevenueCat, which records the purchase against a randomly generated, anonymous identifier. We do not give it your email address, name or any identifier of our own. It receives the App Store transaction, and device and locale information sent by its SDK.

Diagnostics and usage

Metrochrome uses two Google Firebase services: Crashlytics for crash reports and Analytics for usage statistics. Both are on unless you turn them off, and both can be turned off at any time in Settings → Privacy. Turning one off takes effect immediately.

Crash reports are sent only when the app stops unexpectedly. A report describes where the app was in its own code — it contains no photographs and no file names of yours.

Usage statistics tell us how the app gets used, never who used it. Firebase records its own standard events, such as a first launch, a session starting and which screens were opened, against a random app instance identifier. Alongside those, the app sends exactly three events of its own, all about the Pass: that a purchase completed (its product, price, currency and App Store transaction id), that one failed (and the reason), and that a restore ran (and whether it found anything). Google also works out an approximate location — the city and country — from the IP address each report arrives with. That is why the app's privacy manifest declares coarse location; the app itself has no location code and never asks where you are.

We set no user id, no user properties and no custom keys, so nothing we send identifies you. Advertising storage, advertising data and ad personalisation are explicitly refused, and the app does not link Apple's advertising identifier or ask to track you across other apps.

Google's handling of this data is described in its privacy policy. Both services are used for fixing faults and understanding which parts of the app get used, and for nothing else.

What Metrochrome never does

• No advertising, and no advertising code.
• No tracking across other companies' apps or websites.
• No selling or sharing of personal data.
• No location permission — the app contains no location code and never asks for your device's location.
• No access to contacts, calendar, microphone or camera.
• No account, no sign-in and no email capture.

Writing to us

The Contact item in the app opens a letter in your mail app, prefilled with the app version, your device model, the iOS version and the app's display language, so a fault can be placed. Nothing is sent until you send it, and you can delete any of it first.

This website

This site sets no cookies, runs no analytics or tracking scripts, and loads nothing from a third party. The typeface is served from this site rather than fetched from Google Fonts, so your browser makes no request elsewhere in order to draw the page.

The pages are static files served by Firebase Hosting, which is Google. Google's network logs each request, including your IP address, in order to deliver the page and keep the service secure. That log is Google's and is kept under its own terms; we do not read it and keep no server logs of our own.

Children

Metrochrome is not directed at children and does not knowingly collect personal information from anyone, of any age, beyond the anonymous diagnostics described above.

Your rights

Because there is no account, we hold nothing that identifies you, and so there is no record with your name on it for us to look up, export or delete.

Usage data and Crash reports, in Settings → Privacy, are the controls that matter: turning them off stops the collection. Deleting the app removes everything it stored on your device. If you have a question about any of this, or want to exercise a right you believe you have under the GDPR, UK GDPR or CCPA, write to us and we will answer.

Changes and contact

If this policy changes, the new version will be published here with a new effective date.

Questions: hello@metrochrome.app. Metrochrome is made by Piotr Stojanowski Consulting.