Effective 15 November 2026
Privacy policy.
Picture.Repair repairs photos. To do that, it has to send them to a server. This page says exactly what we collect, who else sees it, how long we keep it, and how to have it deleted.
The short version
- We receive only the photos Picture.Repair repairs: the ones you pick, and in auto mode the new ones that pass the checks on your iPhone.
- We don't know your name or email. Your account is an identifier from your App Store purchase.
- Photos waiting for processing are held on our servers for at most about 24 hours. Repaired photos are deleted from our servers after 7 days.
- We don't collect contacts, location or advertising IDs, and we don't track you.
Who we are
Picture.Repair is operated by Colin Gillingham ("we", "us"). Picture.Repair is the new name of the Candid app, previously Kamera, and uses the same App Store listing. Questions about this policy go to support@picture.repair.
What we collect
- Photos
- The photos you choose to repair, and the new photos auto mode sends. A photo is sent to our server so it can be repaired. If an uploaded photo is waiting for processing, we hold it until the job finishes: at most about 24 hours, and it is deleted as soon as the job finishes. Photos you repair by hand are processed right away and are not stored; only the result is.
- An account identifier
- Your account is keyed to the App Store app transaction ID from your Apple purchase of the app. It lets your credits follow you across devices. We also create a random account token and attach it to your purchases, so Apple's renewal notices reach the right account. Neither is your name, email address or Apple Account.
- Credits, plans and purchases
- Your credit balances (plan credits and extra credits), your plan and its renewal date, the plans and top-ups you buy (Apple's transaction records, which we verify), and a ledger of credits granted, spent and refunded. For subscriptions, Apple sends us renewal and cancellation notices so we can refill your plan each month and stop when it ends. Apple handles payment; we never see your card details.
- Your rules
- The text you write in the "Always repair" and "Never repair" settings. It is used only to decide which photos to repair.
- Job records
- For each photo Picture.Repair handles: whether it was repaired, skipped or failed, what was repaired (for example "leveled the horizon"), the result of the checks, what the repair cost us, and timestamps. Records include Apple's identifier for the photo in your library, so the same photo is never charged twice.
- On-device signals
- Two signals computed on your iPhone are sent with a photo: whether it is a screenshot, and Apple Vision's aesthetic score and utility flag (on iOS 18 and later). They help skip photos that don't need repair.
What we don't collect
- Photos that are skipped on your iPhone. Screenshots, small saved images, burst shots and the app's own copies never leave your phone.
- Contacts. Picture.Repair doesn't ask for them.
- Location. A repair applied as an edit stays on the same photo, with its date and location. A repair saved as a copy gets the original photo's date and location, copied on your device only. We never store location on our servers.
- Advertising identifiers. There are no ads in Picture.Repair.
- Tracking. We don't track you across apps or websites, and we don't sell or share your data for advertising.
Who processes your photos
Two companies process photos on our behalf, only to provide Picture.Repair:
- OpenAI
- Plans each repair, makes the edit (for any older queued photos, through its batch service), and runs the fidelity check that compares the repair with your original.
- Cloudflare
- Hosts our server, database and storage, converts photos to a standard format, and runs triage: the check that decides whether a photo is a camera moment, needs work, or matches your rules.
We use their API services, which do not train on API data by default. Their own terms and privacy policies govern how they handle data they process for us.
Crash and error reports
When Picture.Repair crashes, freezes, or hits an unexpected error while repairing a photo, it sends a report to Sentry, our error tracker, so we can find and fix the problem. A report contains technical details: the app version, device model, iOS version, and where in the code the problem happened. It never contains your photos, screenshots, your rules, your account identifier or your IP address. Reports are kept for up to 90 days.
How long we keep it
- Photos waiting to be repaired: held until processing finishes, at most about 24 hours, then deleted. Photos you repair by hand are not stored.
- Repaired photos: 7 days on our servers, so your iPhone can download them. Then they are deleted. The repaired photo in your library is yours and stays until you revert or delete it.
- Problem reports: when you tap "Something's wrong?", your words, your original and the repaired photo are sent so we can see what went wrong. The photos are kept 7 days to help us fix the problem, then deleted. Your words and our diagnosis are kept with the photo's job record.
- Job records, purchases, plan status and the credit ledger: kept while your account exists, for billing, refunds and support.
- Your rules: until you change or clear them.
Deleting your data
Deleting the app removes everything Picture.Repair stores on your iPhone. It does not delete your account on our server, because your credits live there.
To have your account and its records deleted, email support@picture.repair. Include an App Store receipt for Picture.Repair, Candid or Kamera, or anything else that helps us find your account. Deleting your account also deletes any unused credits. It does not cancel a subscription; cancel that in your Apple Account settings first. We may keep records we are required to keep by law.
Children
Picture.Repair is not directed at children under 13, and we don't knowingly collect data from them.
Changes
If this policy changes, we will update this page and its effective date.
Contact
Colin Gillingham, operator of Picture.Repair. support@picture.repair