Privacy Policy

1. Scope and who we are

This Privacy Policy applies to the Throwback iOS application, Throwback Web at throwback.now, and related services operated under the Throwback brand (together, "Throwback" or the "Services"). Throwback is operated by App Star Family ("we," "us," or "our").

The iOS and web experiences belong to the same product, but they use different account and payment systems. Platform-specific differences are labeled in this policy. Questions or privacy requests can be sent to info@appstarfamily.net.

2. Information we handle

Information you provide

• Photos, camera input, captions, layout choices and other content you choose to open, edit, generate, save or export.
• Your email address and one-time verification codes when you create or use a Throwback Web account through Supabase. Throwback does not ask you to create a separate account for the current iOS app.
• Information you include when you contact us. Please do not send a password, sign-in code or full payment card number.

Photos and generated content

We handle the source photos you select and the edited or generated results needed to provide the feature you request. Section 3 explains which operations stay local and which require server or cloud processing.

Accounts and authentication

For Throwback Web, Supabase provides private browser sessions and email-code authentication. An eligible first AI Time Portrait can be created without entering an email address or creating a visible account. A necessary first-party identifier protects the private result and enforces the free allowance. Our web records include the status of AI generations, whether the account's successful free generation has been used, paid-generation usage and web subscription status. The browser stores the Supabase session needed to recognize your private journey. You may later verify an email to recover it on another device. A billing email supplied to Stripe is not proof of account ownership; verification is required before linking an existing account.

Purchases and subscriptions

Stripe processes Throwback Web payments. We receive identifiers, checkout and subscription status, plan and billing-state information needed to provide web access; we do not receive your full card number. Apple processes iOS App Store purchases, and RevenueCat processes the related product, receipt and entitlement information used by the iOS app. RevenueCat uses a generated anonymous app-user identifier; its SDK also sends the Apple device identifier for the app vendor, app and operating-system versions, device model and locale information with its service requests. Throwback does not attach those subscription identifiers or receipts to photographs sent to OpenAI. We do not receive full payment-card details for App Store purchases.

Technical information

When you use an online feature, our hosting and service providers may process ordinary network and request information such as IP address, browser or device type, operating-system or app version, request time, requested route and error information. This information is used to deliver, secure and troubleshoot the Services. The current iOS app does not include a separate third-party advertising, analytics or crash-reporting SDK. Apple may make diagnostics available according to your Apple device and App Store settings.

3. Photos and AI processing

Throwback Web: local browser tools

Photo Lab, Rolls, Retro Cards and Year Vault are designed to process photos locally in your browser where applicable. Those local tools use only the files or camera input you choose. Year Vault reads the selected files and available capture-date metadata; it does not scan your full photo library in the background. Working images may remain in browser memory for the current visit, and exports are saved where you direct your browser to save them. Using a local tool does not send the selected photo to OpenAI and does not use an AI-generation allowance.

Throwback Web: AI Time Portrait

AI Time Portrait is a separate, server-authorized feature. After you select a photo, give permission for AI processing and tap Create, the web app sends that photo to a Throwback server. The server validates, resizes and re-encodes it as a JPEG, which removes embedded metadata such as GPS and EXIF data, and then sends the normalized image and the chosen era instructions to OpenAI for image generation. The source photo is handled during the request and is not saved in Throwback's web result bucket or account database.

A successful web result is stored in a private Supabase storage bucket and is made available only to its owning private session or verified account through short-lived access links. The result-retention period is described in Section 7. Cancelling a request does not guarantee that OpenAI has not already received or processed the image.

Throwback iOS

Native editing, Rolls, Cards and the on-device library store operate on the iPhone or iPad. The app asks for camera or Photos access only when the related feature needs it, and you can change those permissions in iOS Settings. Creations saved to Throwback's native gallery are stored on the device using Apple's local data frameworks; saving to Photos writes a copy to the Apple photo library at your request or according to the app's auto-save preference.

In iOS version 1.0.1 and later, AI Time Portrait prepares the selected image as a JPEG and, only after your affirmative AI-processing consent, sends it over HTTPS to a Throwback server. The server validates the request and photograph, supplies the approved transformation instructions, and sends the image to OpenAI. The generated portrait returns through Throwback to the app. Section 3A explains the processing, temporary result storage and your consent choices.

Version 1.0 used a direct connection to OpenAI. That generation path has been disabled; users of that version need to update to restore AI Time Portrait. Local editing and saved creations do not require the AI-generation service.

3A. Face Data and AI Image Processing

What we process and why

When you choose a photograph from Photos or capture one with the camera for Time Portrait, it may contain your face or other people's faces. We treat those facial images as face data. With your affirmative AI-processing consent, Throwback sends the selected photograph through its server to OpenAI to create the AI Time Portrait transformation you request. The photograph's visible contents, including any faces and background details, are included; it is not anonymized by removing people's identities. We do not send your whole photo library. Throwback does not use face data for identification, authentication, advertising, marketing, tracking, profiling or sale.

What the iOS app sends and who receives it

The iOS app sends a resized, JPEG-encoded copy of your selected or captured photograph to Throwback's server with your chosen era, style, destination year and supported output shape. The server checks app authenticity and generation access, validates the photograph and forwards it with approved instructions to OpenAI's image-editing API. OpenAI returns the generated portrait to Throwback, which makes it available to the requesting app. The server also receives app-attestation data, operation identifiers and, when applicable, Apple-signed purchase information to prevent abuse and verify access. These security and purchase details are not attached to the photograph sent to OpenAI. The app does not send your whole photo library, name, email address, Apple account credentials or separately collected location with this request. Throwback's hosting provider receives the connecting device's network information; OpenAI receives the connection from Throwback's server. A photograph may itself reveal personal information; please choose only photographs you have permission to process.

Local detection and bundled demonstration artwork

Throwback does not perform facial recognition or biometric identification, identify or authenticate people by their faces, create face embeddings or biometric templates, or build facial profiles. In onboarding, Apple's on-device Vision framework can temporarily detect face-location rectangles to check whether a selected image contains a suitable face. Card layouts can also use local face-location rectangles to avoid cropping faces. These temporary rectangles are not sent to Throwback's server or OpenAI, saved as facial geometry or retained as a face database. The app does not extract facial landmarks from user photographs.

The animated onboarding demonstrations use predefined artwork and registration geometry bundled with the app. The local Metal animation of those assets does not collect, derive or upload face data from your photographs. Those static demonstration assets are separate from the photograph you choose for Time Portrait.

Storage, retention and deletion

For iOS Time Portrait, the Throwback server validates the uploaded JPEG, corrects its orientation and re-encodes it as a JPEG before sending it to OpenAI. This re-encoding removes embedded metadata such as EXIF and GPS tags; it does not remove faces, text or other information visible in the photograph. The source image is handled in memory during the request and is not written to our application database or photo-storage bucket.

The generated PNG is held in private Supabase storage temporarily so the app can recover the same result if delivery is interrupted, without requesting another generation. It is available for up to 15 minutes through access links that expire within five minutes. We attempt to delete this temporary copy when the app confirms completion or cancellation. Remaining copies are scheduled for cleanup after expiry; storage or maintenance failures can delay deletion. These temporary copies are not a native cloud gallery or backup.

Our native endpoint does not write source photographs, image data, transformation prompts, raw purchase proofs or API credentials to application logs. It retains app-attestation keys, security counters and allowance records to authenticate the installation and prevent abuse. Operation and replay-protection records are scheduled for removal after 90 days, expired challenge records after one day and keyed network-address rate-limit records after two days. Hosting providers may retain ordinary network and request diagnostics under their own policies. Expiry and scheduled cleanup do not guarantee immediate deletion from every provider system or backup.

Working source images, prepared upload images and unsaved results remain in app memory for the current workflow, including retries and Try Another Decade, and are released when that state is cleared or the app process ends. The AI network session does not use a persistent response cache. Cancelling cannot recall an image already received or processed by Throwback or OpenAI.

If you save a Time Portrait in Throwback, the app stores the original and generated images and their creation/era information in its local gallery. They remain until you delete that creation or remove the app's local data; there is no automatic expiry for saved iOS creations. Deleting a saved Time Portrait from the gallery also removes its linked local original/result record. Copies exported to Photos, Files, a share recipient or an Apple device backup are managed separately through those destinations and their retention controls. Withdrawing AI consent does not delete local creations.

Under OpenAI's published standard API policy, abuse-monitoring logs may include submitted content and generated responses and are retained for up to 30 days, unless longer retention is required by law or reasonably necessary to protect its services or others from harm. The image-editing endpoint does not retain application state. Suspected child sexual abuse material can be retained for manual review. We do not promise immediate deletion or zero provider retention. Under OpenAI's API policy, this content is not used to train its models unless the API customer opts in. See OpenAI's API data controls.

Processing and any provider-held data are on OpenAI's and its service providers' infrastructure, as well as the Throwback infrastructure described here. Information may be processed or stored outside your country; we do not promise a particular storage country. OpenAI's published Data Processing Addendum describes obligations concerning processing instructions, confidentiality, security, subprocessors and assistance with privacy requests.

Throwback Web also uses a server connection to OpenAI, but its account system and result-retention period differ from iOS. The web source, result-retention and account-deletion practices in Sections 3, 7 and 11 apply to web use.

Your consent and privacy choices

Before the first iOS AI photo transmission, Throwback presents a disclosure identifying the photograph, possible face content, the Throwback server, OpenAI and the generation purpose. Selecting a photo or granting camera/Photos access alone does not authorize AI processing. Choose Allow AI Processing to consent or Not Now to decline without transmitting a photograph. Your affirmative choice is saved on your device across app restarts and is separate from subscriptions and free-generation allowances. Premium users must also consent. Version 1.0.1 asks for consent again before using the new server path, even if you agreed to the earlier direct-to-OpenAI disclosure.

Open Settings in Throwback, then AI & Photo Processing, to review the disclosure, open this policy or withdraw consent. Withdrawal blocks future AI photo transmissions until you affirmatively consent again. It does not recall a request already sent to Throwback or OpenAI or automatically delete existing images. To request access, deletion or help with face data already processed, contact info@appstarfamily.net. We will review and, where applicable, coordinate the request with our providers, subject to their retention obligations and applicable law. We cannot promise immediate deletion of provider safety or legally required records. You do not need to send us another photograph to make a privacy request.

4. Cookies and similar technologies

Throwback Web currently uses only storage that is necessary to provide requested features, security and privacy controls. In particular:

• Authentication storage: Supabase stores a session in your browser so you can remain signed in and securely call account, generation and billing endpoints.
• Private-session security: a necessary first-party, HttpOnly cookie remembers the free allowance for up to one year. It cannot by itself open previous portraits. A separate, single-use cookie lasts up to 30 minutes when you choose to connect a private journey to a verified account. Clearing browser data or ending an unverified session can prevent recovery of its portraits or membership; verify your email to return on another device.
• Abuse prevention: the server uses short-lived keyed network-address hashes and request records to limit automated or excessive free generation. These rate-limit records are scheduled for deletion after 48 hours. We do not use device fingerprinting or advertising identifiers for this flow. Necessary identity and security storage is not optional analytics or advertising tracking.
• Consent storage: Throwback stores your privacy choice, the consent-system version and the time of the choice in local storage so the banner does not reappear on every visit.
• Temporary feature state: local photo workflows may use browser memory while you work. Closing or refreshing the page can clear unsaved work.
• Optional analytics: if you accept Analytics in Privacy choices, Google Analytics measures page visits and a small set of product events such as opening Studio, selecting a decade or completing a portrait. We do not send photos, photo names, email addresses, account or billing identifiers, sign-in codes or payment details to Google Analytics.

Google Analytics does not load or send data before you accept the optional Analytics category. Rejecting non-essential technology keeps it off. Advertising storage and personalization remain disabled. If additional optional categories are introduced, we will update the disclosure and consent version and ask before they initialize where consent is required.

You can reopen the controls at any time using Privacy choicesin the site footer. Clearing site data in your browser also removes the saved choice and may sign you out. Rejecting non-essential technology does not block local editing or any other feature that does not genuinely require it.

5. Service providers and sharing

We disclose information only as needed to operate the Services, at your direction, or where law permits or requires it. Current providers include:

• OpenAI for AI Time Portrait image generation on web and iOS.
• Supabase for web authentication, account records and private result storage, and for native Time Portrait security records and temporary result storage.
• Stripe for web checkout, subscriptions and the customer billing portal.
• Apple for iOS, camera and Photos permissions, App Store distribution and payment services and app-integrity verification.
• RevenueCat for iOS product offerings, purchase processing support and subscription entitlement status.
• Vercel for hosting and delivering throwback.now and its server routes.
• Google Analytics for optional, consent-based website and product measurement.

Providers process information under their own terms and our service arrangements. We may also disclose information to comply with law, respond to valid legal process, protect users or the Services, or in connection with a merger, financing, acquisition or sale of assets, subject to applicable privacy law.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use uploaded photos for targeted advertising.

6. Why we process information and our legal bases

We process information to:

• provide local editing, AI generation, saving and export features;
• authenticate web users and keep accounts private;
• administer the successful free-generation offer, paid allowances and platform-specific subscriptions;
• process payments and maintain transaction records;
• secure, maintain, troubleshoot and improve the Services;
• respond to support, privacy and legal requests; and
• comply with legal obligations and enforce our Terms of Use.

Where data-protection law requires a legal basis, we rely as appropriate on performance of our contract with you, your consent, compliance with legal obligations, and our legitimate interests in operating, securing and improving Throwback without overriding your rights. You may withdraw consent for future processing where consent is the basis, but withdrawal does not make earlier processing unlawful.

7. Retention

• Local web work: working photos used by local tools are held in browser memory for the visit and are not a Throwback cloud backup. Files you export remain wherever you save them.
• Web AI source photos: the normalized source is handled during the generation request and is not saved in our web account database or private result bucket. OpenAI's provider retention is governed by its applicable API data controls.
• Successful web AI results: private result objects are scheduled for removal 30 days after generation. Short-lived viewing links can expire sooner; expiration of a link is not itself deletion of the object. This cleanup depends on the scheduled maintenance infrastructure operating successfully.
• Failed or cancelled web generations: result objects, if any were created before failure or cancellation, are scheduled for cleanup after the operation and through maintenance. Status records may remain for accounting, security and troubleshooting.
• Web account and billing records: retained while needed to provide the account and subscription, administer generation allowances, prevent abuse, resolve disputes and meet legal, tax or accounting obligations. They are reviewed when a deletion request is processed.
• iOS AI processing: source images are processed during the request; temporary server results and security records follow the periods and cleanup limitations in Section 3A. Persistent installation and allowance records are retained while needed for authentication and abuse prevention and reviewed when we receive a privacy request. Removing the app or withdrawing AI consent does not itself delete server security records.
• iOS content: local creations and preferences remain on the device until you delete them, clear them through the app, or remove the app's local data. Copies saved to Photos are controlled separately through Apple's Photos app and services.

We do not promise a provider deletion period that the provider has not committed to us. When information is no longer required, we delete or de-identify it where reasonably practicable, subject to backups, security needs and legal obligations.

8. Security and international transfers

We use reasonable technical and organizational measures appropriate to the information and the Services, including account authorization, private web result storage, short-lived result links, input validation and keeping privileged web credentials on the server. No online or local system can be guaranteed completely secure.

Throwback and its providers may process information in countries other than the country where you live. Privacy laws may differ in those locations. Where applicable law requires safeguards for an international transfer, we take the steps required by that law, which may include contractual transfer protections. Providers describe their own transfer practices in the notices linked above. Contact us if you want more information about safeguards relevant to your information.

9. Your choices and privacy rights

Depending on where you live and subject to legal exceptions, you may have rights to access, correct, delete or receive a copy of personal information; object to or restrict processing; withdraw consent; and appeal or complain about a privacy decision. We may need to verify your identity before completing a request.

EEA, United Kingdom and similar jurisdictions

You may have GDPR rights including access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and the right to lodge a complaint with your local data protection authority. Where processing is based on consent, you may withdraw it for future processing.

California and other United States state laws

Applicable law may give you rights to know the categories and specific pieces of personal information collected, correct inaccuracies, delete information, obtain a portable copy, and opt out of sale, targeted advertising or certain sharing. You also have the right not to receive discriminatory treatment for exercising a privacy right. Throwback does not currently sell personal information or share it for cross-context behavioral advertising, so there is no such activity to opt out of at this time.

Controls available to everyone

You can choose which files to open, decline camera or Photos access, use local web tools without an account, avoid AI Time Portrait, manage browser site data, change privacy choices from the footer, sign out of a web account, manage subscriptions with the applicable payment platform, and delete locally saved content.

Send a rights request to info@appstarfamily.net. If we deny a request, you may ask us to reconsider and may contact the regulator available in your jurisdiction.

10. Children's privacy

Throwback is not directed to children under 13, and we do not knowingly collect personal information from children under 13. A user who has not reached the age of legal majority where they live should use Throwback only with permission and supervision from a parent or legal guardian. If you believe a child has provided personal information contrary to this section, contact us so we can review and take appropriate action.

11. Account and data deletion

Throwback Web: the current browser account panel does not include automated account deletion. Email info@appstarfamily.net from the address used for the web account and state that you want the account or associated data deleted. We will verify and process the request subject to legal exceptions and records we must retain.

Throwback iOS: the current iOS app does not require a Throwback account. Delete creations from the native gallery and manage copies saved to Photos through Apple's Photos controls. Deleting the app removes its local app container according to iOS behavior, but it does not cancel an App Store subscription or remove copies saved to Photos. App Store and RevenueCat transaction records are controlled by those services and applicable retention requirements.

12. Changes and contact

We may update this Privacy Policy when Throwback, its providers or legal requirements change. We will change the effective date above and provide additional notice where required. Material changes apply prospectively from the stated effective date.

For questions, requests or complaints about this policy or how Throwback handles information, email info@appstarfamily.net.