Privacy Policy

1. Scope and who we are

This Privacy Policy applies to the Throwback iOS application, Throwback Web at throwback.now, and related services operated under the Throwback brand (together, "Throwback" or the "Services"). Throwback is operated by App Star Family ("we," "us," or "our").

The iOS and web experiences belong to the same product, but they use different account and payment systems. Platform-specific differences are labeled in this policy. Questions or privacy requests can be sent to info@appstarfamily.net.

2. Information we handle

Information you provide

• Photos, camera input, captions, layout choices and other content you choose to open, edit, generate, save or export.
• Your email address and one-time verification codes when you create or use a Throwback Web account through Supabase. Throwback does not ask you to create a separate account for the current iOS app.
• Information you include when you contact us. Please do not send a password, sign-in code or full payment card number.

Photos and generated content

We handle the source photos you select and the edited or generated results needed to provide the feature you request. Section 3 explains which operations stay local and which require server or cloud processing.

Accounts and authentication

For Throwback Web, Supabase provides private browser sessions and email-code authentication. An eligible first AI Time Portrait can be created without entering an email address or creating a visible account. A necessary first-party identifier protects the private result and enforces the free allowance. Our web records include the status of AI generations, whether the account's successful free generation has been used, paid-generation usage and web subscription status. The browser stores the Supabase session needed to recognize your private journey. You may later verify an email to recover it on another device. A billing email supplied to Stripe is not proof of account ownership; verification is required before linking an existing account.

Purchases and subscriptions

Stripe processes Throwback Web payments. We receive identifiers, checkout and subscription status, plan and billing-state information needed to provide web access; we do not receive your full card number. Apple processes iOS App Store purchases, and RevenueCat processes the related product, receipt and entitlement information used by the iOS app. We do not receive full payment-card details for App Store purchases.

Technical information

When you use an online feature, our hosting and service providers may process ordinary network and request information such as IP address, browser or device type, operating-system or app version, request time, requested route and error information. This information is used to deliver, secure and troubleshoot the Services. The current iOS app does not include a separate third-party advertising, analytics or crash-reporting SDK. Apple may make diagnostics available according to your Apple device and App Store settings.

3. Photos and AI processing

Throwback Web: local browser tools

Photo Lab, Rolls, Retro Cards and Year Vault are designed to process photos locally in your browser where applicable. Those local tools use only the files or camera input you choose. Year Vault reads the selected files and available capture-date metadata; it does not scan your full photo library in the background. Working images may remain in browser memory for the current visit, and exports are saved where you direct your browser to save them. Using a local tool does not send the selected photo to OpenAI and does not use an AI-generation allowance.

Throwback Web: AI Time Portrait

AI Time Portrait is a separate, server-authorized feature. After you select a photo, give permission for AI processing and tap Create, the web app sends that photo to a Throwback server. The server validates, resizes and re-encodes it as a JPEG, which removes embedded metadata such as GPS and EXIF data, and then sends the normalized image and the chosen era instructions to OpenAI for image generation. The source photo is handled during the request and is not saved in Throwback's web result bucket or account database.

A successful web result is stored in a private Supabase storage bucket and is made available only to its owning private session or verified account through short-lived access links. The result-retention period is described in Section 7. Cancelling a request does not guarantee that OpenAI has not already received or processed the image.

Throwback iOS

Native editing, Rolls, Cards and the on-device library store operate on the iPhone or iPad. The app asks for camera or Photos access only when the related feature needs it, and you can change those permissions in iOS Settings. Creations saved to Throwback's native gallery are stored on the device using Apple's local data frameworks; saving to Photos writes a copy to the Apple photo library at your request or according to the app's auto-save preference.

The current iOS AI Time Portrait flow prepares the selected image as a JPEG and sends it directly from the app to OpenAI using a network session that does not use a persistent response cache. Generated results remain in app memory unless you choose to save them to the native Throwback gallery or Photos. OpenAI's own processing and retention controls still apply to images it receives.

4. Cookies and similar technologies

Throwback Web currently uses only storage that is necessary to provide requested features, security and privacy controls. In particular:

• Authentication storage: Supabase stores a session in your browser so you can remain signed in and securely call account, generation and billing endpoints.
• Private-session security: a necessary first-party, HttpOnly cookie remembers the free allowance for up to one year. It cannot by itself open previous portraits. A separate, single-use cookie lasts up to 30 minutes when you choose to connect a private journey to a verified account. Clearing browser data or ending an unverified session can prevent recovery of its portraits or membership; verify your email to return on another device.
• Abuse prevention: the server uses short-lived keyed network-address hashes and request records to limit automated or excessive free generation. These rate-limit records are scheduled for deletion after 48 hours. We do not use device fingerprinting or advertising identifiers for this flow. Necessary identity and security storage is not optional analytics or advertising tracking.
• Consent storage: Throwback stores your privacy choice, the consent-system version and the time of the choice in local storage so the banner does not reappear on every visit.
• Temporary feature state: local photo workflows may use browser memory while you work. Closing or refreshing the page can clear unsaved work.
• Optional analytics: if you accept Analytics in Privacy choices, Google Analytics measures page visits and a small set of product events such as opening Studio, selecting a decade or completing a portrait. We do not send photos, photo names, email addresses, account or billing identifiers, sign-in codes or payment details to Google Analytics.

Google Analytics does not load or send data before you accept the optional Analytics category. Rejecting non-essential technology keeps it off. Advertising storage and personalization remain disabled. If additional optional categories are introduced, we will update the disclosure and consent version and ask before they initialize where consent is required.

You can reopen the controls at any time using Privacy choicesin the site footer. Clearing site data in your browser also removes the saved choice and may sign you out. Rejecting non-essential technology does not block local editing or any other feature that does not genuinely require it.

5. Service providers and sharing

We disclose information only as needed to operate the Services, at your direction, or where law permits or requires it. Current providers include:

• OpenAI for AI Time Portrait image generation on web and iOS.
• Supabase for web authentication, account records and private result storage.
• Stripe for web checkout, subscriptions and the customer billing portal.
• Apple for iOS, camera and Photos permissions, App Store distribution and payment services.
• RevenueCat for iOS product offerings, purchase processing support and subscription entitlement status.
• Vercel for hosting and delivering throwback.now and its server routes.
• Google Analytics for optional, consent-based website and product measurement.

Providers process information under their own terms and our service arrangements. We may also disclose information to comply with law, respond to valid legal process, protect users or the Services, or in connection with a merger, financing, acquisition or sale of assets, subject to applicable privacy law.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use uploaded photos for targeted advertising.

6. Why we process information and our legal bases

We process information to:

• provide local editing, AI generation, saving and export features;
• authenticate web users and keep accounts private;
• administer the successful free-generation offer, paid allowances and platform-specific subscriptions;
• process payments and maintain transaction records;
• secure, maintain, troubleshoot and improve the Services;
• respond to support, privacy and legal requests; and
• comply with legal obligations and enforce our Terms of Use.

Where data-protection law requires a legal basis, we rely as appropriate on performance of our contract with you, your consent, compliance with legal obligations, and our legitimate interests in operating, securing and improving Throwback without overriding your rights. You may withdraw consent for future processing where consent is the basis, but withdrawal does not make earlier processing unlawful.

7. Retention

• Local web work: working photos used by local tools are held in browser memory for the visit and are not a Throwback cloud backup. Files you export remain wherever you save them.
• Web AI source photos: the normalized source is handled during the generation request and is not saved in our web account database or private result bucket. OpenAI's provider retention is governed by its applicable API data controls.
• Successful web AI results: private result objects are scheduled for removal 30 days after generation. Short-lived viewing links can expire sooner; expiration of a link is not itself deletion of the object. This cleanup depends on the scheduled maintenance infrastructure operating successfully.
• Failed or cancelled web generations: result objects, if any were created before failure or cancellation, are scheduled for cleanup after the operation and through maintenance. Status records may remain for accounting, security and troubleshooting.
• Web account and billing records: retained while needed to provide the account and subscription, administer generation allowances, prevent abuse, resolve disputes and meet legal, tax or accounting obligations. They are reviewed when a deletion request is processed.
• iOS content: local creations and preferences remain on the device until you delete them, clear them through the app, or remove the app's local data. Copies saved to Photos are controlled separately through Apple's Photos app and services.

We do not promise a provider deletion period that the provider has not committed to us. When information is no longer required, we delete or de-identify it where reasonably practicable, subject to backups, security needs and legal obligations.

8. Security and international transfers

We use reasonable technical and organizational measures appropriate to the information and the Services, including account authorization, private web result storage, short-lived result links, input validation and keeping privileged web credentials on the server. No online or local system can be guaranteed completely secure.

Throwback and its providers may process information in countries other than the country where you live. Privacy laws may differ in those locations. Where applicable law requires safeguards for an international transfer, we take the steps required by that law, which may include contractual transfer protections. Providers describe their own transfer practices in the notices linked above. Contact us if you want more information about safeguards relevant to your information.

9. Your choices and privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to access, correct, delete or receive a copy of personal information; object to or restrict processing; withdraw consent; and appeal or complain about a privacy decision. We may need to verify your identity before completing a request.

EEA, United Kingdom and similar jurisdictions

You may have GDPR rights including access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and the right to lodge a complaint with your local data protection authority. Where processing is based on consent, you may withdraw it for future processing.

California and other United States state laws

Applicable law may give you rights to know the categories and specific pieces of personal information collected, correct inaccuracies, delete information, obtain a portable copy, and opt out of sale, targeted advertising or certain sharing. You also have the right not to receive discriminatory treatment for exercising a privacy right. Throwback does not currently sell personal information or share it for cross-context behavioral advertising, so there is no such activity to opt out of at this time.

Controls available to everyone

You can choose which files to open, decline camera or Photos access, use local web tools without an account, avoid AI Time Portrait, manage browser site data, change privacy choices from the footer, sign out of a web account, manage subscriptions with the applicable payment platform, and delete locally saved content.

Send a rights request to info@appstarfamily.net. If we deny a request, you may ask us to reconsider and may contact the regulator available in your jurisdiction.

10. Children's privacy

Throwback is not directed to children under 13, and we do not knowingly collect personal information from children under 13. A user who has not reached the age of legal majority where they live should use Throwback only with permission and supervision from a parent or legal guardian. If you believe a child has provided personal information contrary to this section, contact us so we can review and take appropriate action.

11. Account and data deletion

Throwback Web: the current browser account panel does not include automated account deletion. Email info@appstarfamily.net from the address used for the web account and state that you want the account or associated data deleted. We will verify and process the request subject to legal exceptions and records we must retain.

Throwback iOS: the current iOS app does not require a Throwback account. Delete creations from the native gallery and manage copies saved to Photos through Apple's Photos controls. Deleting the app removes its local app container according to iOS behavior, but it does not cancel an App Store subscription or remove copies saved to Photos. App Store and RevenueCat transaction records are controlled by those services and applicable retention requirements.

12. Changes and contact

We may update this Privacy Policy when Throwback, its providers or legal requirements change. We will change the effective date above and provide additional notice where required. Material changes apply prospectively from the stated effective date.

For questions, requests or complaints about this policy or how Throwback handles information, email info@appstarfamily.net.