Privacy
What Roll keeps, and who can see it.
Last updated 13 August 2026 · Auf Deutsch lesen
Roll is a shared camera for one occasion. A film is private, the photos in it are sealed until it develops, and nothing in Roll is public. This page says what that means in data terms.
Who is responsible
- Controller
- [Legal name], [street, postal code, city], Germany
- Contact
- [contact email]
What Roll stores
- Your account. Hosts sign in with Apple; Roll receives an identifier and, if you allow it, a name. Guests get an anonymous session and no account at all.
- A display name. The name you type when you join a film, so the roll can say who took which frame.
- The film. Its name, occasion, shooting window, reveal time, frame budget, guest limit and prompt list.
- Photos. The frames you shoot, their dimensions, when they were taken, which prompt they answered, and who took them.
- A device token, if you allow notifications, so Roll can tell you the roll developed.
- Purchases. Apple's transaction identifier, the product, the App Store environment and the time — enough to know a film was paid for and to give the room back if the payment is refunded.
Roll has no advertising, no third-party analytics or tracking SDKs, no profiling, and no data is sold or shared for marketing.
The launch list
If you submit Notify me on onroll.app, Roll stores that address and the moment you gave it. The page says we will email you once when Roll launches: that is consent (Art. 6(1)(a) GDPR), and writing once is all the address is for: no newsletter, no profiling, and it is never passed on. The list is not connected to any Roll account. Write to [contact email] and your address is removed; it is removed in any case once the launch email has been sent.
Who can see your photos
- A film is reachable only with its invite code or link.
- Before a film develops, you see your own frames and nobody else's. That includes the host: the rule is enforced in the database, not in the app.
- The host decides when a film develops, and can develop it earlier than the time announced. Sealed means nobody sees the roll before that moment — not that the moment is fixed.
- After it develops, everyone in the film sees the roll — unless the host set the film to host-only access.
- Photo files are stored privately and delivered through links that expire within the hour.
Why Roll is allowed to store it
To run the film you asked to be part of (Art. 6(1)(b) GDPR — performance of a contract), and to keep films private and within their limits (Art. 6(1)(f) GDPR — our legitimate interest in a working, abuse-free product). Notifications are sent only if you allow them, and you can withdraw that in iOS Settings at any time.
How long it stays
- A film and its photos are kept for 12 months after the film develops, then deleted.
- A host can delete a film at any time. Deleting a film erases its photos, for everyone, immediately.
- You can delete your account in the app, under Account. That erases the films you host for everyone in them, and the frames you shot in other people's films.
- Purchase records are kept as long as tax and accounting law requires, even after the film is gone. What is left of one is the transaction, not you: the buyer and the film are detached when either is deleted.
Who processes it for us
- Supabase — database, authentication and private file storage for Roll's backend, in [project region].
- Apple — the App Store handles payments, and Apple's push service delivers the develop notification.
Where a processor works outside the EU, the transfer is covered by the European Commission's standard contractual clauses.
Payments
Roll never sees your payment details. In-app purchases are made through Apple, which is the seller for those transactions and handles billing, invoices, tax and refunds. Roll receives only the transaction identifier and what was bought.
Your rights
You can ask for access to your data, a copy of it, correction, erasure, or restriction of processing, and you can object to processing based on legitimate interest. Write to [contact email] and we will answer within a month. You can also complain to a supervisory authority; in Germany that is the data protection authority of your state.
Children
Roll is not directed at children under 13, and we do not knowingly collect their data.
Changes
If this page changes in a way that affects you, the new version is published here with a new date before it takes effect.