photo pop

Privacy Policy

Effective October 6, 2026

photo pop is a puzzle game made by Nevermind Software, LLC (“we”), 67 West St, Suite 401, Brooklyn, NY 11222, United States. This policy says what the app (and its App Clip, for playing a board a friend sent) collects, why, who else sees it, and what it does not do.

1. What the app collects, and why

Your photos (on your phone, unless you share a board)

photo pop is played with your own photos, so the app asks iOS for access to your photo library; iOS lets you share all of your photos or only the ones you pick. If you pick some, the app plays those, and offers to let you choose more or to allow all of them in iOS Settings. If you do not allow access, the app explains that the game needs your photos and offers to open Settings. The app reads pictures to build boards from them, and reads a little about each picture to decide which ones to use and in what order: when it was taken, its size and shape, whether you marked it a favourite, whether it is a portrait or HDR, whether a place is attached to it (not where), whether it was taken on this phone, and whether it is a screenshot, a panorama, or part of a burst. It also notices when a picture it uses is edited or deleted, so that a level you have not seen yet can follow the change. All of this happens on your phone. The app sends a picture to us only when you share a board, and then only that level’s photograph (see “Boards you share”, below); otherwise it never sends a picture, a thumbnail, or anything from a picture to us or to anyone else, and only you can, by sharing one. (If a picture is kept in iCloud Photos, iOS may download it from Apple to your phone for the app; that is between your phone and Apple.)

The app never saves a copy of a photo on your phone. (To share a board it draws one smaller copy of that level’s photograph to send, and does not keep it.) It keeps what it madefrom your pictures, so a level stays the same level and can be played without the picture being read again: for each level, the grid of colored tiles the picture was turned into (a small table of which of a few colors each tile is), those colors, the puzzle’s settings, and a list of moves that proves the level can be won. It also keeps which of your pictures each level was made from, and which it has picked for the levels ahead (the identifier Photos gives a picture on this phone and, where Photos has one, its iCloud identifier, so the same levels can find their pictures again on a phone restored from a backup), and when you first saw each level. All of this is stored on your phone, is part of your device backups if you make them, and is not sent anywhere by the app, except for a level you share as a board (below). The app also keeps images of the tile grids it drew for the level list, in the phone’s cache, which is not backed up.

When the app shows you one of your pictures — when you finish its level, and on that level’s bubble afterwards — it reads it from Photos at that moment and does not save a copy.

You can revoke access at any time in iOS Settings › Privacy & Security › Photos. Since the game is played with your photos, the app then explains that it needs them and offers to open Settings; nothing else changes. What the app made from your pictures stays on your phone until you delete the app. Revoking access does not take down a board you have already shared; stopping sharing does (below).

Sharing a photo

When you finish a level, Share offers two things: “this photo” and “this board”. “This photo” shares the level’s photograph as an image. The app draws that image afresh on your phone, without the details a photo file carries inside it (such as where and when it was taken), and hands it to iOS’s share sheet. Where it goes from there is your choice, and the image never comes to us: all we learn is what the analytics events below record, that a photograph was shared and which kind of app you chose (for example Messages).

Boards you share

“This board” lets a friend play the exact level you just cleared, and see your photo when they win. It is the one thing in the app that sends a photograph to us, and it only happens when you tap send.

What goes to our server. When you share a board, the app sends:

• the level’s photograph, cropped as the win screen shows it, at most 1,600 pixels on its longer side, as a JPEG. It is drawn afresh, so it carries none of the details a photo file keeps inside it: no location, no date, no camera;
• the board: the grid of which color each tile is, the colors, and the level’s settings and deal, which is what lets your friend play exactly the same game;
• the moves that prove the board can be won;
• the level’s number and difficulty, and the app’s version;
• your tag (up to three letters, digits or emoji, which you pick), your time on the level, and the taps of your run, which let any phone that shows the leaderboard check that the time was really played;
• a random player id and a secret the app made up on your phone. There is no account: the id is not your name, your email, your Apple ID or any advertising identifier. The secret proves later requests come from the same phone, so only you can change or delete what you shared; our server keeps a scrambled copy of it (a hash), not the secret itself.

Our server then gives the app a link, and iOS’s share sheet sends the link wherever you choose. The link’s preview shows the board, not the photo.

Who can see it. Anyone who has the link. There is no feed, no search and no list of boards: nobody finds a board unless someone gives them its link, but anyone you send it to can pass it on, and anyone who has it can play the board. The app shows your photo to a player when they clear the board; people who have the link can see the board, your tag, your time and the leaderboard. As with any picture you send, someone who sees your photo can take a screenshot of it, and stopping sharing cannot undo that. Opening the link in a web browser shows a page on our website that says how to play it; that page never shows the photograph.

Why. Only to run the feature: to let the people you send the link to play the board and see the photo, and to keep its leaderboard. We do not use shared photos for anything else: not for advertising, not in our analytics, and we do not sell them or give them to anyone except as this policy says.

How long.A shared board, its photo and its leaderboard stay on our server until you stop sharing it, or until 90 days after anyone last opened it, whichever comes first; then they are deleted. The exception is a board or a time that someone has reported: it is kept, hidden, until we have reviewed it (and may be kept longer where the law requires, as “Illegal content” below says), and otherwise goes as described here. Sharing the same level again uses the same board and link (while the board is being reviewed, it makes a new one). We may also remove a board sooner (see reports, below).

How to delete it.Open the level you shared, tap Share, “this board”, and “stop sharing”: the board, its photo and every time posted to it are deleted from our server, and the link then says the board is gone. If someone has reported the board or a time on it, stopping sharing hides it from everyone at once, but what was reported is kept, hidden, until we have reviewed it (and may be kept longer where the law requires, as “Illegal content” below says); otherwise it is deleted as described. If you no longer have the app, or cannot get to the level, email support@nevermind.llc with the link and we will delete it. Deleting the app on your phone does not delete a board you shared, since it is on our server; stop sharing first, or email us.

Reports.Anyone who opens a board can report it (for its photo) or report a name on its leaderboard, and hide a player’s times from their own phone. A report hides that board or name from the person who reported it at once. When three reports of the same board or name have come from three different players in three different places, it is hidden from everyone until we look at it; we then either remove it for good or put it back. We may also remove any board or time that breaks our terms of service, and stop a player id from sharing. A report sends us what was reported, the reason, anything the reporter chose to write, and the reporter’s random player id, and we keep reports for as long as we need them to deal with abuse.

Illegal content.Shared photos must not contain anything illegal. If we become aware of child sexual abuse material, United States law requires us to report it to the National Center for Missing & Exploited Children (NCMEC), which may pass the report to law enforcement, and to preserve the material and what we hold about it (such as the board, the player id and the times) for as long as the law requires, instead of simply deleting it. We may also disclose a shared board, and what we hold with it, to the authorities when the law requires it.

Playing a friend’s board

When a friend sends you a link to a board, you can play it in the app or, without the app, in its App Clip: a small instant version of the game that iOS opens from the link without installing anything. Either way, the app fetches the board, the photograph and the leaderboard from our server, and keeps them on your phone so you can play the board again.

When you clear the board, the app asks you for a tag the first time, then sends our server your tag, your time, the taps of your run (so other phones can check the time), whether you used any help (the app offers power-ups on a shared board; the App Clip does not), the app’s version, and a random player id and secret made up on your phone, as above. Your tag and time then appear on that board’s leaderboard, which everyone with the link sees. Your times are deleted with the board (when its sender stops sharing it, or 90 days after it was last opened), except a time someone has reported, which is kept, hidden, until we have reviewed it; to have yours removed sooner, email us the link and your tag. If you report a board or a name, the report is sent as described above.

The App Clip shows no ads, sells nothing, and never asks to track you (an App Clip cannot). It uses the same analytics as the app (PostHog, below), under its own random identifier. iOS removes an App Clip, and what it kept on your phone, after a while unused. If you install photo pop after playing in the App Clip, the full app takes over the clip’s player id, tag and boards, through a container the two share on your phone (not through us), so your times stay yours.

Our server

Shared boards, their photos, leaderboards, tags, player ids and reports are stored by Convex, a database and hosting service, which runs our server (the same one that hosts our website) and processes this data on our behalf in the United States under its own privacy policy. Like any server, ours sees the IP address each request comes from. It uses it only to limit how many requests one address can make, and never stores the address itself: it counts requests under a salted one-way hash of the address (for an IPv6 address, of the network it belongs to), kept apart from boards, times, tags and player ids and deleted within two days of that address’s last request. The one exception is a report: when someone reports a board or a name, the server also keeps a salted one-way hash of their IP address with the report, so that three reports must come from three different places before anything is hidden, and the hash is deleted with the report.

How the game is played (analytics)

We use PostHog, an analytics service, to record events about the game: the app being installed, opened, updated or put away; a level being started, won, lost or left, how long it took, how many tries, and how the blasters were juggled; the game’s tips coming up and going away; a continue or a power-up being used; a photograph being shared (and which kind of app it went to); a board being shared (its level and difficulty, and which kind of app the link went to), a shared board being opened, played, won or lost, a time being posted, a board or name being reported, a board no longer being shared, and the App Clip offering the full app and that offer being tapped; the shop being opened; an ad being shown, watched to the end, or failing to load; a purchase being made, cancelled, failing or restored (which product, the price and, for tokens, the App Store’s transaction number); your answer to iOS’s tracking question; and AppsFlyer (below) being started. A level’s events carry the puzzle’s settings — its size in tiles, how many colors, how the bank is dealt — and no picture, no part of one, and nothing that could tell which picture it was. The events about shared boards carry nothing of the photograph, not the board’s link, and not your player id or tag.

These events carry an identifier that the app makes up the first time it runs. It is random, and it is not your name, your Apple ID, or any advertising identifier. PostHog keeps a few facts with it, updated as you play: the highest level you have reached, your token balance, whether you bought no ads, your answer to the tracking question, and whether AppsFlyer is on.

The events also carry what PostHog’s software collects by default: the app’s version, the iOS version, the device model, the screen size, the language, the time zone, and whether the phone is on Wi-Fi or cellular. PostHog also receives the IP address each event comes from, uses it to estimate an approximate location (the country, and roughly the region and city), and then discards the address rather than storing it with the event. We use all of this to see whether people are playing, where they stop, and which levels play harder than intended, never to identify anyone. PostHog processes it on our behalf in the United States under its own privacy policy.

Purchases

Tokens, and the purchase that removes ads, are bought through Apple’s in-app purchase system. Apple handles the payment; we never see your card, your name or your Apple ID. To deliver what you bought, restore no ads on another device, and protect against fraud, the app uses RevenueCat, a purchase validation service, which receives the App Store’s record of each purchase (the product, the price, the time, and Apple’s transaction identifier), an anonymous identifier the app makes up for this purpose, the identifier iOS gives our apps on your phone, your device’s advertising identifier only if you allow tracking, basic device information, and your IP address. RevenueCat processes this on our behalf in the United States under its own privacy policy, and passes each purchase, with its price, to AppsFlyer (see “Advertising and attribution”, below). The anonymous identifiers (the purchase one, the analytics one and AppsFlyer’s) are linked to each other so we can match a purchase to the play and the ad that led to it; none is linked to your name, email or Apple ID.

Advertising

The app shows ads from Google AdMob: a full-screen ad before some levels (none before level 15), and an ad you can choose to watch in the shop to earn tokens. Google’s advertising software collects what it needs to show, count and protect ads and to keep itself working: identifiers for your device (including, only if you allow tracking, your device’s advertising identifier), your IP address and an approximate location worked out from it, device and app information, which ads were shown and how you interacted with them, and diagnostic data such as crash and performance reports from its own software. Google may share some of it with the advertising companies that buy ads through it, under Google’s rules. Google uses this data under its own privacy policy and explains how it uses data from apps that show its ads at policies.google.com/technologies/partner-sites.

In the European Economic Area, the United Kingdom and Switzerland, Google’s consent message comes up before any ad is requested, and you choose there what Google may use your data for, such as personalising ads; the game plays the same either way. (Google’s consent software works out roughly where you are, from your IP address, to know which rules apply.) To change that choice later, tap Privacy choices in the app’s Settings, under About; it is there wherever Google’s rules call for it. Where a US state privacy law applies and the app’s Settings show Privacy choices, Google’s form there lets you opt out (see your choices and rights, below).

After you clear your first level (or the first time you open the shop, or before the first Google ad that plays before a level, if one of those comes sooner), the app shows a short note about it and then iOS asks you, once, whether the app may track your activity across other companies’ apps and websites. Say no and the ads still show, chosen without that, and our ads are measured only in Apple’s private ways (below); say yes and your device’s advertising identifier may be used by Google to choose ads, and by AppsFlyer and the ad platforms below to match your install and purchases to the ad that brought you. You can change your answer at any time in iOS Settings › Privacy & Security › Tracking.

Ads also use Apple’s SKAdNetwork, which lets an advertiser learn that an ad led to an app being installed without learning who installed it.

You can turn off the ads that play before levels with a one-time purchase in the shop; the ad in the shop stays, as something you choose.

Advertising and attribution

We advertise photo pop on TikTok, through TikTok for Business, and in the App Store, through Apple Ads. To know whether those ads work, we use AppsFlyer, a mobile measurement service, which tells us which ad, if any, brought each player to the game. It runs in the app, never in the App Clip.

What is shared. When you install and play photo pop, the following may be shared with AppsFlyer and, through it, with the ad platform that showed you one of our ads:

• that the app was installed and opened, and when;
• the levels you reach (the first time you clear level 3, and level 10);
• your purchases: which product and its price and currency (passed to AppsFlyer by RevenueCat, above), and that you made your first one;
• device information such as the device model, the iOS version, the language, your IP address, and the identifier iOS gives our apps on your phone (IDFV), with the anonymous purchase identifier above and an identifier AppsFlyer makes up for this install;
• your device’s advertising identifier (IDFA), only if you allow tracking when iOS asks;
• what Apple’s own private measurement reports: SKAdNetwork, which tells an advertiser that an ad led to an install (and roughly what happened next) without saying who, and AdServices, which says whether an install came from an Apple Ads search ad.

No photo, no part of one, no tile grid and no board is ever sent to an ad partner, and neither is anything that could tell which picture a level was made from, your tag, or your shared boards’ links.

AppsFlyer processes this for us under its own privacy policy. TikTok and Apple use what reaches them to measure our ads and, where you have allowed it, to show ads, under their own privacy policies (TikTok, Apple Ads).

Your choices. Turn tracking off for photo pop (or for every app) in iOS Settings › Privacy & Security › Tracking: the advertising identifier is then not shared, and our ads are measured only through Apple’s private SKAdNetwork and AdServices. To limit Apple’s personalised ads, use iOS Settings › Privacy & Security › Apple Advertising; to change what TikTok shows you, use your TikTok account’s settings. You can also email support@nevermind.llc to ask us to stop sharing your information with ad partners (see your choices and rights, below).

If you write to us

If you email us, we have your email address and what you write, and use them only to answer you.

Data kept on your phone

Your progress, your tokens and power-ups and their history, your settings, any unfinished level, your best times, which tips you have seen, what the app counts to space out its ads, the photo levels it has made (described above), your tag, and the boards you have shared or been sent are stored on your phone. They are part of your device backups if you make them. Of all this, we see only what the analytics events above carry, such as how far you have got and your token balance, and what you send us by sharing a board or posting a time. Deleting the app deletes it from your phone, with one exception: your random player id and its secret are kept in the phone’s keychain, which iOS may keep after the app is deleted, so that reinstalling the app keeps your shared boards and times yours.

Sounds, haptics, and the way the game’s icon leans as you tilt the phone all happen on the phone; nothing about them is recorded or sent.

2. What we do not do

• We do not sell your data for money, and we give it to no one except as this policy describes.
• We do not let anyone track you across other companies’ apps or websites unless you allow it when iOS asks, and then only so that Google can choose ads and so that AppsFlyer, TikTok and Apple Ads can match your install and purchases to our ads.
• We do not collect your precise location, contacts, calendar, microphone or camera; the app never asks for them. (Google and PostHog estimate an approximate location from your IP address, as described above.)
• We use no analytics service other than PostHog, no ad network in the app other than Google AdMob, no attribution service other than AppsFlyer (for our own ads on TikTok and Apple Ads), and no crash-reporting service of our own.
• We do not put shared photos in a public feed, a search or a gallery, use them to advertise, or use them for anything but the board they were shared with. No photo, tile grid or board ever goes to an ad partner.

3. Who else sees data

Only the services named above — Apple (the App Store, and iCloud if you use it), RevenueCat (purchases), PostHog (analytics), Google (advertising in the app), AppsFlyer (attribution), TikTok for Business and Apple Ads (our own ads, through AppsFlyer and Apple’s measurement), and Convex (our server, for shared boards), each as described above — and whoever you choose to send a shared image or a board’s link to (and anyone they pass the link on to). Everyone who has the link to a board you have played sees your tag and time on its leaderboard. Apple also gives us statistics about downloads and sales, and crash reports from people who have chosen to share them with app developers. Everything the app sends to these services travels encrypted. We may also disclose data if the law requires it, or to a successor if the company or the game changes hands, under this policy.

4. How long we keep it

Analytics events are kept for as long as they help us improve the game, and then deleted. Purchase records are kept for as long as needed to honour purchases and for accounting. Emails are kept for as long as the conversation needs. A shared board, its photo and its leaderboard are kept until the sender stops sharing it or 90 days after it was last opened, or until we remove it, except that a board or time someone has reported is kept, hidden, until we have reviewed it; your player id and tag are kept while the feature needs them to keep your boards and times yours, and reports for as long as we need them to deal with abuse. Anything the law requires us to preserve (see “Illegal content” above) is kept for as long as it requires. Google keeps what its software collects, and AppsFlyer, TikTok and Apple what they receive for measuring our ads, under their own policies. Data on your phone stays until you delete it.

5. Your choices and rights

• To delete the data on your phone: delete the app. Copies in your device backups go when those backups do.
• To stop the app reading your photos: iOS Settings › Privacy & Security › Photos (the game needs them to be played).
• To stop ads being chosen using your activity in other companies’ apps and websites, and your advertising identifier being shared to measure our ads: iOS Settings › Privacy & Security › Tracking.
• To change what you chose in Google’s consent message: Privacy choices in the app’s Settings, under About (shown wherever Google’s rules call for it).
• To turn off the ads before levels: buy no ads in the shop.
• To take down a board you shared: “stop sharing” on it in the app, or email us its link. To have a time you posted removed: email us the board’s link and your tag.
• To ask what we hold, or to have it corrected or deleted: email us. None of it is tied to your name, email or Apple ID, so we can only find yours if you help us point to it — for example, roughly when you played and on which model of iPhone, or the link to a board you shared or played. We will delete what we can match, except purchase records we must keep for accounting and anything the law requires us to preserve, and tell you if we cannot match anything.

If you are in the European Economic Area, the United Kingdom or Switzerland: Nevermind Software, LLC is responsible for your data. Our basis for analytics is our legitimate interest in understanding and improving the game; for purchases, performing the purchase you asked for and keeping the records the law requires; for ads, the choice you make in Google’s consent message, and where no consent is needed, our legitimate interest in paying for a free game with ads; for measuring our own ads, our legitimate interest in knowing which ads work, and for sharing your advertising identifier to do it, the permission you give when iOS asks; for reading your photos on your phone, your permission, which you can withdraw as above; for a board you share and a time you post, providing the feature you asked for, which you can end by stopping sharing or asking us to delete them; for keeping reports and acting on them, our legitimate interest in keeping shared boards safe; and for preserving and reporting illegal content, the law. If a photo you share shows other people, make sure they are happy for it to be shared. You have the rights to access, correct, delete and port what we hold about you, to object to or restrict its processing, to withdraw a consent at any time, and to complain to your data protection authority. Your data is processed in the United States, where the law may protect it differently from the law where you live.

If you live in a US state with a privacy law: you can ask to know, correct or delete what we hold, as above. We do not sell data for money, but some of these laws count letting an ad network use information from an app to choose ads as “selling” or “sharing” personal information, or as “targeted advertising”. In particular, sharing device identifiers and in-app events (installs, opens, levels reached and purchases) with AppsFlyer, TikTok and Apple Ads to measure and target our ads may be considered “sharing” for cross-context behavioral advertising under California law. To opt out, say no when iOS asks, or turn tracking off at any time in iOS Settings › Privacy & Security › Tracking, and email support@nevermind.llcwith the subject “Do Not Sell or Share My Personal Information”. We honor opt-out preference signals where we are able to detect them. If the app’s Settings show you Privacy choices, under About, Google’s form there lets you opt out of Google’s use as well.

6. Children

photo pop is a general-audience game. It is not directed at children under 13, and we do not knowingly collect personal information from them. Parents can block in-app purchases with Screen Time. If you believe a child under 13 has used the app and something should be deleted, email us and we will delete what we can match; for a shared board, send its link and we will delete the board and its photo. Shared photos must not include anything illegal; illegal material involving children is reported to the authorities as described under “Illegal content” above.

7. Changes to this policy

If this policy changes, the new version goes up at the same address with a new date, and a meaningful change will be noted in the app’s release notes.

8. Contact

Questions about this policy or the app? Get in touch.