Privacy Policy

Last updated: October 15, 2026

Overview

Bosco ("we", "our", or "the app") is a camera app that lets you shoot film rolls and order physical prints, and lets you host or join shared photo events. It is operated by Nuthatch, LLC, Gaithersburg, Maryland. This policy covers the app and the Bosco event web app. We collect what we need to take, print, and deliver your photos and to run events, and we do not sell it or use it for advertising.

Information We Collect

Device Identifier

We use your device's vendor identifier to create an anonymous, device-linked identity. You do not need an account, a password, or an email address to shoot and order prints. The identifier is tied to your photos, orders, and events on our servers, so it is not anonymous to us.

Photos

Photos you capture are stored on your device, and the full-size photos are encrypted there. When you place a print order, your photos are uploaded to our servers for print fulfillment and are kept in long-term cloud storage (the archive) so you can reprint them. The archive has no expiration date and no fee.

Each full-size photo keeps its camera details: the phone's make and model, the lens, the exposure settings, and the date and time it was taken. It never records where it was taken. Anyone with the full-size photo can read them, including an event's organizers for the photos taken at their event.

When you take photos for an event, they are uploaded to the event as you take them. They are kept until you or the event's organizer delete them. Our staff review photos before they are printed. As a guest you can leave an event in the app at any time, and remove your photos from it as you leave, unless one of them is in an order still being printed.

Names, Email Address, and Phone Number

• Event organizers give us their name, an email address, and a phone number when they create an event. We use the email address to sign them in to the event web app and to send the event-ready email, notices that the address was changed, and order emails. We use the phone number only to help us verify an organizer who needs help with an event. Guests never see an organizer's email address or phone number. Other organizers of the same event can.
• Guests type a name when they join an event. It is kept with their membership of the event, and the event's organizers see it next to the guest's photos.
• Everyone who orders gives us a recipient name and shipping address. Orders placed on the web also record the buyer's email address so we can send order updates.
• If you report a problem with an event, we keep what you wrote.

Shipping Information

When you order prints, we collect the recipient name and shipping address. We use them to fulfill and deliver your order. Before payment, your street address is sent to Geocodio, a USPS-CASS-certified validation service, to confirm it resolves to a real, deliverable building. We do not send your name to Geocodio. The verified address is what we send to Prodigi for printing. We keep the name and address with the order record for 30 days after the order is complete, so we can help with a lost or damaged parcel. After that we blank the name and street address in our records. We keep the state and country, which sales tax and refunds need.

Payment Information

Payments are processed by Stripe. We do not store your credit card number or payment credentials. For event fees and web orders we pass your email address to Stripe so it can send a receipt. Stripe may collect information as described in its privacy policy.

Push Notifications

If you enable notifications, we store a device token to send you order updates, event reminders, and event notices. When an organizer shares a photo book, card, or set of prints with an event's guests, the notice names the organizer ("{name} shared a photo book from {event}"). That is the one place a guest sees an organizer's name. You can turn notifications off at any time in your device settings.

Technical Data

We collect basic technical information to keep Bosco running:

• Device model, operating system version, and app version
• Crash reports from your device, tied to your device identifier
• Photo upload diagnostics (per-photo success or failure, byte counts, and durations)
• Error logs, which can include order or event identifiers
• IP addresses, which our hosting provider and our rate limiting see on every request, and which we keep when we block repeated failed attempts to join an event

The Event Web App

Organizers sign in to the web app with a link we email to the event's contact address. The link works once and expires after 30 minutes. Signing in sets one cookie, which keeps you signed in for 24 hours and is needed for the web app to work. We do not use analytics, advertising, or tracking cookies, and the web app loads nothing from third parties. Anyone who can open the email at the contact address can sign in and see every photo of the event and the orders placed from it, so keep that mailbox secure.

How We Use Your Information

We use your information to:

• Process and fulfill print orders
• Run events: collect guests' photos for the organizer, and let organizers make and share products
• Deliver order and event notifications and emails
• Review photos before printing and enforce our content policy
• Monitor events and help organizers and guests with problems, provide support, and verify an organizer who needs help with an event
• Improve app stability and fix bugs

We do not:

• Sell your data to third parties
• Use your data for advertising
• Track your behavior for profiling
• Share your data with analytics companies

Who Can See Your Information

• Guests see an event's name and location. They see other guests' photos only in a product an organizer has shared, as watermarked copies with no name attached. They never see an organizer's email address or phone number
• Organizers and co-organizers see all of an event's photos, the names guests gave, and the event's contact details. Co-organizers can also change the contact email address and phone number
• Our staff can see orders, shipping addresses, event details, contact details, photos under review, and diagnostic data, as needed to review photos, fulfill orders, monitor events, and give support
• Our service providers see what they need to do their jobs, as described below

Third-Party Services

We use the following third-party services to operate:

• Stripe — payment processing. Receives your email address (for events and web orders), the amount, and the names of what you bought
• Prodigi — print fulfillment and shipping. Receives the recipient name, the shipping address, and time-limited links to the photos or files to print. It does not receive your email address or phone number
• Cloudflare — hosting, our database, and photo storage
• Amazon Web Services — long-term photo archiving, and sending our emails
• Geocodio — shipping address validation, as described above
• Apple — push notifications

These services receive only the data necessary to perform their function.

Data Storage and Security

• Photos are encrypted on your device, and are sent over encrypted connections (HTTPS)
• Your authentication token is stored in your device's Keychain
• Data stored with our hosting providers is encrypted at rest by those providers. We do not add our own encryption on top of stored photos, names, email addresses, phone numbers, or addresses
• Access to personal data is limited to staff who need it

No system is perfectly secure, and we cannot guarantee the security of your information.

Data Retention

• Photos from your orders are kept in the archive, with no expiration date, until you delete them
• Event photos are kept until you or the organizer delete them. We do not delete them automatically
• Event details, including the organizer's name, email address, and phone number, are kept for as long as the event exists. We remove an event that was never paid for after 48 hours
• Recipient name and street address on an order are blanked 30 days after the order is complete, or 30 days after it was canceled, rejected, or refunded without shipping. The state and country stay with the order
• Other order records, including amounts, tax, and tracking, are kept for customer support, tax, and legal compliance. We do not delete them automatically
• The email address of a web order is kept until you delete your data from the web app's Account page, so until then you can always sign in to the web app and see your orders
• Sign-in links and web sessions are removed about one to two days after they expire
• Error logs are removed after 48 hours
• Crash reports and upload diagnostics are kept without a fixed deletion date

Your Rights and Choices

You can delete the data associated with your device at any time using the "Delete my account & data" option in the app. This permanently removes:

• Your photos, your archive, your orders, and your device record
• Every event you organize, with the photos of everyone in it, even if it has co-organizers. Only the organizer who created an event can delete it, and it never passes to a co-organizer
• The device record of a co-organizer of those events whose only use of Bosco was those events. A co-organizer who has photos, orders or events of their own keeps their record, and loses only the event
• The photos you took for events you joined

It does not remove:

• Orders other people placed that contain your photos
• Crash reports and upload diagnostics
• Records already sent to our service providers

If you use the event web app, its Account page has "Delete my data". You confirm the request from your email, and a member of our staff reviews and approves it before anything is removed. It removes every event you are the contact for, with the photos of everyone in it, and the orders placed with your email address. This includes an event that has co-organizers: it never passes to one of them. A co-organizer whose only use of Bosco was those events has their device record removed too. It does not remove the data on your phone: use "Delete my account & data" in the app for that.

The Account page also lets you change the email address you sign in with. Your events and orders move to the new address once you confirm it from that mailbox, and we tell the old address that it changed.

Deletion is not available while you have a paid order still being produced or shipped. Try again after it ships.

To ask us to correct or tell you what we hold about you, or to delete anything the options above do not, email support@bosco-camera.app from the address we hold. If you live in a state with a privacy law, you may have additional rights, and you can use the same address to exercise them.

Data held by third-party processors: Once an order has been submitted for fulfillment or payment, certain records are retained by our processors under their own data retention policies, independent of Bosco. Deleting your data in Bosco does not remove records already sent to these services:

• Prodigi retains order and shipping records to fulfill, support, and account for completed print orders. See Prodigi's Privacy Policy for retention details and how to contact them with deletion requests.
• Stripe retains payment and transaction records as required by financial, tax, and anti-fraud regulations (typically seven years or more). See Stripe's Privacy Policy for details.
• Our hosting and email providers (Cloudflare and Amazon Web Services) may keep logs and records of their own under their own policies.

Children's Privacy

Bosco is not directed at children under 13. We do not knowingly collect personal information from children under 13. Organizers are responsible for having a parent's or guardian's permission before inviting anyone under 18 to an event.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes through the app.

Contact

If you have questions about this Privacy Policy, please contact us at support@bosco-camera.app.