Rolls exists to get you the photos of you from a night out — without anyone DMing files around. To do that honestly:
Face embeddings are biometric data — under the GDPR, special-category data (Article 9). We process them only with your explicit consent, asked plainly before first enrollment. You can withdraw that consent any time by deleting your face data in Settings. We never use face data for advertising, profiling, identification outside your crews, or training models. We never sell it.
| Data | What it is | Why |
|---|---|---|
| Account | An ID from Sign in with Apple, and (if Apple shares it) your name and email. Hide My Email works. | So you can sign in. |
| Profile | A display name and optional avatar you choose. | So friends see who sent a photo. |
| Face embeddings | 128 numbers. Never face images. | So friends’ phones can find you. Explicit consent only. |
| Crews & rolls | Which crews you’re in, names, dates, who created them. | Who is sharing with whom. |
| Delivered photos | Full-quality copies matched to you and approved, in a locker only you can read. | So you can view and save them. |
| Delivery records | A small note that photo X was sent by A to B at time T, kept even after the photo is gone. | So a photo you deleted is never re-delivered. |
| Invite links | Short random tokens. Revocable. | One-tap join; a leaked link can be shut off. |
| Consent timestamps | When you gave biometric consent and finished onboarding. | Proof we asked first. |
We do not have your camera roll, your contacts, your location, advertising identifiers, analytics or tracking SDKs, or data-broker relationships.
Access is enforced in the database (Postgres row-level security), not by the app being polite.
Nothing for advertising, marketing, or profit. To run the service:
That’s the list. We disclose data to authorities only if legally compelled. If Octave is acquired, this policy’s promises travel with the data, and we will notify you first.
In the app, in Settings:
Under the GDPR you also have access, rectification, portability, restriction, objection, withdrawal of consent, and the right to complain to a supervisory authority — for us, Persónuvernd (personuvernd.is), or your local authority. For anything Settings doesn’t cover, email privacy@rolls.social. We’ll respond within a month.
Legal bases: explicit consent for face embeddings (Art. 9(2)(a)); performance of contract for accounts, crews, and delivery (Art. 6(1)(b)); legitimate interest in service integrity for the delivery ledger (Art. 6(1)(f)).
Photos you scan may contain people who aren’t on Rolls. We don’t match them, and nothing about them ever leaves your phone. To work out who is in a photo, your phone measures every face it finds, including theirs, and compares those measurements against your crew’s. A measurement of someone who isn’t on Rolls exists only in memory, for the instant that comparison takes, and is then discarded: never uploaded, never stored, never ours. Rolls only ever moves a photo to a person who opted in twice: installed the app and enrolled.
You must be at least 13, and at least the age of digital consent where you live if it is higher.
In transit, TLS. At rest, access-controlled EU infrastructure with row-level security, delivered photos in a private per-recipient bucket. We assume the client can be hostile. If a breach ever affects your data we will notify you and the supervisory authority as the GDPR requires.
We’ll update the date above and tell you in the app before a change takes effect. If a change would expand what we do with your face data, we will ask for consent again. Silence is not consent.