Privacy Policy
Last updated: September 25, 2026
The short version
- melled is a private photo app for close friends. Nothing you post is public. A photo is visible only to you and the members of the album you share it to.
- We collect what the app needs to work: your account, your photos and what you add to them, and a few technical details about your device.
- To make album covers, we send album photos and members' profile pictures to Google's Gemini API. Names are never sent.
- We don't show ads, we don't track you across other apps, and we don't sell your data.
- You can delete your account in the app at any time. Erasure starts right away.
- Questions or requests go to privacy@melled.app.
Who we are
melled is published by Paul Planchon, an individual based in France. He is the data controller for the personal data described in this policy. In this policy, "we" and "us" mean Paul Planchon.
For anything about your personal data, write to privacy@melled.app.
What we collect
Account
- Your display name, profile picture and your five favorite emojis. You provide these.
- If you sign up with email: your email address and your password. We store the password only as an argon2id hash, never in readable form.
- If you use Sign in with Apple: the stable account identifier Apple gives us. We ask Apple for your name to prefill your display name. We don't store the email address Apple shares.
We don't ask for your phone number, your contacts or your birthday.
Friends and albums
- Who you're friends with, your invite links and whether each invite was used.
- The albums you create or join and who their members are.
Photos and what you add to them
- The photos you send, their capture date and an optional title.
- An optional place. It comes from the photo's own metadata for photos picked from your library, from your approximate current location for photos taken with the in-app camera, or from a place you pick or search for. You can see and edit it.
- The people you tag on a photo.
- Emoji reactions.
- Everything you put on an album's board: photos, stickers, short text notes, place names and cutouts. A cutout is made on your iPhone with Apple's Vision framework. Only the resulting image is uploaded.
We strip location metadata (EXIF and GPS data) from the image files we store. The only location we keep for a photo is the place field described above.
Device and technical data
The app and our servers collect these automatically.
- A random device identifier the app creates and keeps in your iPhone's Keychain. It is not Apple's advertising identifier.
- Your push notification token, so we can send you notifications.
- Your sessions. A session stays signed in for up to 90 days of inactivity.
- Crash and error reports: the error, the app version, the device model and the iOS version.
- Product analytics: which features get used, linked to an internal user ID rather than your name or email.
- Server logs: the request method, path and status code. Our app logs don't store your IP address. Our hosting provider may process IP addresses to run and secure its network.
Reports and messages
These come from you or from other users.
- Reports you send about content or people, and reports other people send about you.
- Emails you send to support or privacy, and our replies.
What stays on your iPhone
- The home screen widget keeps a copy of recent photos from your friends in the app's shared storage on your device, so it can display them. It is removed when you sign out or delete the app.
- Live presence, such as the other members' cursors on a board, is sent in real time and never stored.
What other people see
- Your friends and the members of albums you're in see your display name, profile picture and favorite emojis.
- Album members see the photos shared to that album, their titles, places, tags and reactions, and the album's board. They can see photo places on a map.
- Someone who opens one of your invite links sees your display name and profile picture before accepting it. Each link works once.
Files are served at long random addresses that can't be guessed. Nothing is listed or searchable.
How we use your data and why
The GDPR requires us to name a legal basis for each use.
| What we do | Legal basis |
|---|
| Create and run your account, sign you in, keep your sessions | Contract: providing the service you signed up for |
| Share your photos and board content with the members of your albums, show places on the map, send notifications, fill the widget | Contract |
| Generate album covers and photo descriptions with AI (see below) | Contract |
| Use your camera, photo library and location | Your permission, given through iOS |
| Keep the service secure, prevent abuse, handle reports, suspend accounts that break the rules | Legitimate interest in keeping melled safe, and legal obligation where the law requires it |
| Fix crashes and errors | Legitimate interest in a working app |
| Understand which features are used, to improve the app | Legitimate interest in improving the app. You can object at any time |
| Answer your emails and requests | Contract, or legal obligation for privacy requests |
| Respond to lawful requests from authorities | Legal obligation |
We don't use your data for advertising. We don't build profiles to target you. We don't sell your data or share it with data brokers.
AI album covers
melled can make a cover for each album: a collage illustration with no text in it, which can show the album's members. Here's how it works.
- Photos published to the album, and the profile pictures of its members, are sent to Google's Gemini API. The profile pictures let the model recognize who appears in the photos, so the cover can depict them.
- The model writes a short description of each photo and generates the cover image.
- Names are not sent. Only images and the instructions for the model are.
- Members can choose which photos are used for a cover.
- We store the generated descriptions and covers with the album. Album members see them.
- We may route the same kind of request through OpenRouter, which forwards it to the model provider.
This involves faces and likeness. We use it only to make the cover for that album. We don't build face templates, we don't run a biometric identification system, and we never use it to identify anyone outside the album.
We use Google's paid Gemini API. Under Google's terms for the paid service, Google doesn't use this data to train its models. Google may keep inputs and outputs for a limited period to detect abuse, as its terms describe.
The legal basis is contract. Covers are a core part of what albums are in melled. If you don't want your photos used, you can leave them out of a cover or not post them to that album. For any other concern, write to privacy@melled.app.
Who we share data with
We share data with the service providers below, only as far as each needs it to do its job for us. Each one is bound by a data processing agreement or equivalent terms that require it to protect your data at least as well as we do, and to use it only on our instructions.
| Provider | What for | Where |
|---|
| Railway | Hosting the app's servers and database | EU or United States |
| Cloudflare R2 | Storing photos and other files | United States and other countries |
| Google (Gemini API) | Generating album covers and photo descriptions | United States |
| OpenRouter | Possible alternative route to the AI model provider | United States |
| Sentry | Crash and error reports, with no personal data sent by default | United States |
| PostHog | Product analytics | European Union |
| Expo | Delivering push notifications to Apple | United States |
| Apple | Push notifications (APNs), Sign in with Apple, maps and address search | United States |
Other melled users see what you share with them, as described above.
We may also disclose data if the law requires it, for example to answer a valid request from a court or the police, or to report child sexual abuse material to the authorities.
International transfers
Some of these providers are in the United States or process data there. When personal data leaves the European Economic Area, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or on the European Commission's standard contractual clauses. You can ask us for more detail at privacy@melled.app.
How long we keep data
| Data | How long |
|---|
| Account data | Until you delete your account |
| Photos and their files | Until the sender or an album member deletes the photo, or the sender deletes their account. Files are removed from storage within about a day |
| Board content, reactions, tags | Until removed, or until the account that created them is deleted |
| AI descriptions and covers | As long as the album exists. Covers made from your photos are deleted with your account |
| Sessions | Deleted after 90 days without use, when you sign out, or when you delete your account |
| Push tokens | Until you sign out, the token stops working, or you delete your account |
| Reports | As long as needed to handle the report and prevent repeat abuse, then no more than 12 months after it's closed, unless a legal claim needs them |
| Crash reports | Up to 90 days |
| Product analytics | Up to 12 months |
| Backups and server logs | Up to 30 days |
Deleting your account
Go to Settings → account management → delete account.
Deletion takes effect immediately and you can no longer sign in. We then erase your data in the background, usually within minutes. This covers your profile, profile picture, sessions, push tokens, friendships, invites, album memberships, the photos you sent and their files, your reactions, your board content, covers made from your photos, and your login identifiers.
Copies can remain in backups and logs for up to 30 days before they are overwritten.
A single photo can be deleted for everyone by its sender or by any album member who received it.
Your rights
Under the GDPR you have the right to:
- Access the data we hold about you and get a copy.
- Rectify it. You can change most of it in the app, including your name, profile picture, favorite emojis and photo places.
- Erase it, by deleting your account or asking us.
- Port it: get the data you gave us in a common machine-readable format.
- Object to uses based on legitimate interest, such as product analytics.
- Restrict how we use it while a complaint is being checked.
- Withdraw permissions for the camera, photos, location or notifications at any time in iOS Settings → melled. The app keeps working, minus the feature that needed it.
- Set instructions for what happens to your data after your death, as French law allows.
To use any of these rights, write to privacy@melled.app from the email linked to your account, or tell us how to identify your account. We answer within one month. We may ask you to confirm your identity first.
If you think we got something wrong, you can complain to the French data protection authority, the CNIL, at cnil.fr, or to the authority in the EU country where you live.
Children
melled is for people 18 and older. We don't knowingly collect data from anyone younger. If we learn that an account belongs to a minor, we delete it. If you think this is the case, write to support@melled.app.
Security
- Connections between the app and our servers are encrypted.
- Passwords are stored as argon2id hashes.
- Sign-in tokens expire: access tokens after 15 minutes, refresh tokens after 90 days without use.
- Stored files sit at random addresses that can't be guessed, and are only handed to the people allowed to see them.
No system is perfectly secure. If we learn of a breach that puts your data at risk, we will notify the CNIL and, where required, you.
Changes to this policy
When we change this policy, we update the date at the top. For important changes, we will let you know before they apply.
Contact
See also our Terms of Use and Community Guidelines.
