We process identifiers from your chosen sign-in provider (Kakao, Apple, Google or LINE), nickname and optional profile image, confirmation that you are at least 18, consent records, group and memory participation, photos, videos and sound in videos, capture times, reports and blocks. For search and summaries, we process descriptions, search terms, scene, object, activity, food and color classifications, visible text and place names derived from photos or representative video thumbnails. We do not infer or store identity, exact age or birth date, gender, emotions or other sensitive traits. For devices with notifications enabled, we store push tokens, operating system type and app language. Upload accounting uses the fixed account and group time zones, event times, media types, group or subscription scope and irreversible upload identifiers. Subscriptions use the store, product, subscription status, current billing period start and end, expiry, group assignment and store transaction identifiers needed for verification. After account deletion, identifiers needed to prevent reuse and handle payment disputes may be retained as irreversible hashes, without an account link, with minimal status and time information. We do not process card numbers or payment method details. If you choose location features, we store administrative area names, representative coordinates for each place, country codes, administrative levels and irreversible place keys to group media within a memory. Only with separate consent to photo location storage, coordinates reduced to three decimal places (about 100 m) are stored for each photo or video taken with the app camera. Raw GPS is not stored. For security, limited access logs contain request times, routes, response status and truncated IP network ranges rather than full IP addresses. App update checks may process operating system type, random tokens used to check update downloads, network, error and performance information. After agreement to the privacy notice, analytics use random identifiers not directly linked to accounts, app, device and operating system details, screen names and completion of key actions. Analytics exclude nicknames, photos, videos, sound, location, group and memory names, invite URLs and credentials.
We use this information to verify accounts and the 18-or-older eligibility requirement; share photos, videos and their sound; provide photo search, filters and memory summaries; arrange a memory’s photos by administrative area on maps and place timelines; move the map to a current location explicitly requested by the user; handle invites, records, user-enabled comment and new-photo notifications, support and reports; prevent abuse and secure the service; analyze feature use and improve the service; and measure app installations resulting from advertising.
Information is generally retained until account or content deletion. Account deletion removes account identifiers, profile, consent, participation, location-use confirmation, report and block records, as well as uploaded photos, videos, sound and derived search classifications and indexes. Irreversible upload hashes separated from content may remain to prevent deletion from restoring used uploads. On account deletion, their account link is removed or unnecessary records are deleted. Irreversible transaction hashes needed to prevent reuse and handle payment disputes may remain without an account link, with minimal status and time information, for as long as necessary. Analytics not linked to accounts are retained for at most one year from collection. Roll does not separately retain installation and launch information sent to Meta; Meta processes it under its data policy. Rotating database backups may retain pre-deletion data for up to 35 days, solely for recovery.
Amazon Web Services in Seoul stores media and service data. Video sound is stored as part of the video file. After upload, a low-resolution search JPEG thumbnail is sent to the Anthropic, PBC API for automatic classification. Original photos, original videos and video sound are not sent to Anthropic. Search reads labels already stored by Roll and does not send a new image each time you search. These requests do not use prompt caching. Anthropic does not train models on API content. Inputs and results are generally retained for up to 30 days before deletion. Requests flagged as policy violations or subject to legal retention requirements may be kept longer or reviewed by people. Maps use Apple Maps on iOS and Google Maps Platform on Android. They receive representative coordinates, separately consented approximate photo positions for memories you may view, and the visible map area. When you tap My location, the device’s location and map services may temporarily process your current location to move the map; it is not sent to or stored by Roll. Raw GPS is not sent to maps. Sign-in uses Kakao, Apple, Google or LINE authentication services. Subscription purchases and verification use Apple App Store, Google Play and platform billing features. Updates use Expo Application Services (EAS Update) from 650 Industries, Inc. User-enabled notifications pass through that company’s Expo Push Service and Apple APNs or Google FCM. Encrypted connections carry device tokens, notification text and identifiers used to open the relevant screen. Comment notifications may include the author’s name and part of the comment. Expo processes notification contents in memory and queues for delivery rather than storing them in a database. Staff debugging the service may see the contents. Subsequent processing follows Apple’s and Google’s notification policies. Feature analytics use PostHog Cloud from PostHog, Inc., without automatic click collection or session replay. Advertising attribution uses the Meta SDK from Meta Platforms, Inc. Meta receives installation, app launch, completed registration, group creation and SDK setup events for advertising measurement. Roll does not add photo, video or memory content, group names or membership, nicknames, sign-in details or purchase history to manual event fields.
For automatic photo classification used in search, filters and summaries, we outsource processing abroad on the contract-performance basis in Article 28-8(1)(3) of the Korean Personal Information Protection Act. External classification is limited to accounts that have accepted the current privacy notice; acceptance of an earlier version is not automatically converted into acceptance of the current version. A low-resolution JPEG derived from a GPS-free shared photo or representative video thumbnail, including people, scenes and visible text, is sent over an encrypted API connection to Anthropic, PBC (548 Market St, PMB 90375, San Francisco, CA 94104, United States; privacy contact: privacy@anthropic.com) after each media upload. API data is stored in the United States. Classification currently uses global routing and may run on infrastructure in the United States, Europe, Asia and Australia. Inference is not restricted to the United States. Safety review, support and incident response may also involve countries where Anthropic or its affiliates operate. These published regions do not identify every processing country. The current infrastructure and support subprocessor list and processing locations are available at https://trust.anthropic.com/subprocessors. Some infrastructure entries are marked Worldwide; we do not describe this as processing in a single country. The purpose is classification of scenes, objects, activities and text for search, filters and memory summaries. Requests do not use prompt caching. Anthropic generally retains inputs and results for up to 30 days before deletion. Inputs and outputs flagged as policy violations may be retained for up to two years; related trust and safety scores may be retained for up to seven years. Legal retention and other stated exceptions may apply. Roll stores only the required classifications in AWS Seoul. To decline this processing, do not share photos or videos in Roll, or delete your account. Every shared item is processed this way, so declining prevents using photo sharing. Apple Maps and Google Maps Platform may temporarily process representative coordinates, separately consented approximate photo positions, the visible map area, IP address and device and app details in their disclosed processing regions. If you tap My location, the platform map service may also temporarily process your current location to move the map; Roll does not receive or store it. EAS Update may process operating system type, random update-download tokens, IP addresses and update request error and performance information in the United States over encrypted connections. For enabled notifications, device tokens, app language, notification text and screen identifiers may be processed for delivery in the regions disclosed by Expo Push Service, Apple APNs and Google FCM. Disable notifications in device or app Settings. PostHog processes random analytics identifiers not directly linked to accounts, app, device and operating system information, screen names and key action completion in Virginia, United States for up to one year, over encrypted connections. PostHog IP-based location enrichment is disabled. For advertising attribution, Meta Platforms, Inc. (1 Meta Way, Menlo Park, California 94025, United States) processes installation, launch, completed registration and group creation events and times, device model, operating system, app version, language, time zone, IP address, SDK-generated random identifiers and advertising identifiers available under device settings and permissions in the United States and its other disclosed processing regions. The SDK’s advertising-identifier collection setting is enabled on Android. Starting with iOS app version 1.0.5, Roll requests App Tracking Transparency (ATT) permission after onboarding consent and starts Meta measurement only if you allow it. Declining does not affect app features. Earlier iOS versions do not show this permission request. Events are sent over encrypted connections on installation, launch, completed registration or group creation, to measure installations and registrations resulting from advertising and optimize advertising delivery, and retained under Meta’s data policy. Android users can delete or reset the advertising ID in device Settings without affecting app use. Each external service’s privacy policy describes its processing conditions and how to exercise rights.
The Meta SDK collects app installation, launch, completed registration, group creation and advertising-measurement setup events and their times to measure installations and registrations resulting from advertising and optimize advertising delivery. Meta Platforms, Inc. processes this information under its data policy; Roll does not retain it separately. Android users can delete or reset their advertising ID in device Settings to prevent its use for personalized advertising. Starting with iOS app version 1.0.5, Roll requests App Tracking Transparency (ATT) permission after onboarding consent and starts Meta measurement only if you allow it. Declining does not affect app features. Earlier iOS versions do not show this permission request. Deleting or resetting an Android advertising ID does not stop app event transmission. In-app screen navigation, photo activity and memory activity are not sent to Meta.
Shared photos are recreated to remove GPS metadata. Shared videos contain no location coordinates. Anthropic receives only low-resolution thumbnails of GPS-free shared copies, without individual photo coordinates or representative place coordinates. With location enabled, the app camera obtains a recent location from the operating system at capture time and converts it on the device into an administrative area name and representative coordinates to group media by place. With separate consent to photo location storage, the same location is reduced on the device to three decimal places (about 100 m) and sent as the photo’s approximate position. Raw GPS is discarded immediately after conversion and is not sent to or stored by Roll. If you explicitly add a place in the settings of a memory created without location, or move more than 5 km from the starting place while capturing, the same location may also update the memory’s representative place once. There is no tracking or background location collection. Location obtained on the map is used only to move the map and show your position, not for Roll server storage, updating memory places or generating movement routes.
You can delete photos, videos, memories and your account, and change marketing consent in the app. Deleting a video deletes its sound too. Contact us below to request access, correction, deletion or suspension of processing.
Data due for deletion is removed from the database immediately. Failed media storage deletions are retried through a durable queue until successful. Database backups rotate within 35 days and are used only for disaster recovery until then.
Privacy officer: 클로스핏 운영팀, support@rollphotos.com. Operator: 클로스핏, (06113) 서울특별시 강남구 강남대로128길 78, 301호 (논현동)
Contact us for access, correction, deletion, a copy of your information or review of a rights-request decision. Describe the request and your state or country of residence. Do not send identity documents unless we explain why verification is necessary. We verify requests proportionately and apply the rights and deadlines required by applicable law. We do not deny service merely because you exercise a privacy right. Roll does not change native app SDK behavior in response to browser Do Not Track signals. This does not waive any applicable statutory opt-out right. The effective date appears at the top. Material changes are announced in the app or a notice page; expanded consent-required processing requires consent before that processing.
The public intimate-image removal process collects the contact email, electronic signature, authority to act, content-location details, non-consent statement and handling records, even without a Roll account. These are used to locate content, review and respond to the request, and document removal and duplicate checks. They are independent of membership records and retained during review and for 365 days after resolution, then deleted. No image attachment is requested. A private status code is stored only as a hash. Recovery backups may retain deleted data for up to 35 days.