Privacy Policy

Last updated: 4 August 2026

This policy explains what information InsidePics collects, why we collect it, and what we do with it. InsidePics is operated by INSP Limited Liability Company ("INSP", "we", "us"). It applies to the InsidePics mobile applications and to insidepics.com.

The short version

• Your photos and videos are encrypted on your device before they are uploaded. We store ciphertext and cannot decrypt it.
• We do not sell personal information, and we do not use your library for advertising or to train machine learning models.
• We collect the minimum needed to run an account: an identifier to sign you in, and the encrypted data you choose to store.
• Access to your device's photos and contacts is optional, permission-gated, and only requested when you use a feature that needs it.

Information we collect

Account information

To create an account we collect an email address, and — depending on how you sign in — either a password (stored only as a cryptographic hash), a one-time code, or an identifier from a third-party sign-in provider you choose to use. If you set a display name or profile image, we store those too.

Your photos and videos

Content you add to InsidePics is encrypted on your device before it leaves it. We store the resulting encrypted files, along with the technical metadata needed to sync and display your library — for example file size, media type, timestamps, and which album an item belongs to. We cannot read the contents of your photos and videos.

Encryption keys

We store your public key, and an encrypted copy of your private key together with an encrypted recovery copy. The encrypted copies are encrypted on your device before upload. We hold them so that you can restore access on a new device; we cannot decrypt them.

Contacts

If you choose to grant contacts access, InsidePics reads names and phone numbers from your device address book so you can find people you already know. We do not read contact photos, addresses, or notes.

To find which of your contacts already use InsidePics, phone numbers are normalized and sent to our servers to be checked against registered accounts. Numbers that do not match a registered account may be retained in an index so that we can tell you if that person later joins. You can decline contacts access entirely and still use every other part of the app, and you can revoke it at any time in your device settings.

Photo library access

Importing photos and videos requires access to your device's photo library or camera roll. This access is used solely to let you select items to import. Selected items are encrypted on your device before upload.

Technical and diagnostic data

Our servers record standard operational information such as IP address, timestamps, and error events. We use this to keep the service running, investigate faults, and prevent abuse.

How we use information

• To create and maintain your account and authenticate you.
• To store, sync and deliver your encrypted library.
• To deliver sharing — routing encrypted content and keys to the people you have chosen to share with.
• To respond to your support requests.
• To keep the service secure and reliable, including detecting and preventing abuse.
• To comply with legal obligations.

What we do not do

• We do not sell personal information.
• We do not scan, index or analyze the contents of your photos and videos. The encryption design means we are not able to.
• We do not use your content to train machine learning or AI models.
• We do not show third-party advertising in the app.

Sharing and disclosure

We share information only in these circumstances:

• With people you choose. When you share a photo, video or album, the recipient gains access to that content.
• With infrastructure providers. We use Cloudflare, Inc. for hosting, storage and content delivery. They process data on our behalf under contract.
• Where the law requires it. We may disclose information in response to a valid legal request. Because your content is encrypted with keys we do not hold, we cannot produce decrypted photos or videos in response to such a request.
• In a business transfer. If the business is sold or reorganized, information may transfer as part of that transaction, subject to this policy.

Retention

We keep your account information and encrypted content for as long as your account is active. When you delete an item it is removed from your library and deleted from our storage, subject to short-lived backups. When you delete your account, we delete your account information and encrypted content.

Security

Content is encrypted on your device using an elliptic curve keypair (Curve25519) before upload, and transport to our servers is protected with TLS. Your private key is protected by secure storage on your device. No system is perfectly secure, but the design goal is that a compromise of our servers does not expose the contents of your library.

Because we cannot decrypt your data, we also cannot recover it for you if you lose your credentials and your recovery information. Please keep them safe.

Your rights and choices

You can access and update your account information in the app, delete individual items or albums, revoke sharing you have granted, and delete your account. Depending on where you live, you may also have rights to request a copy of your personal information, to have it corrected or erased, or to object to certain processing. To exercise any of these, email [email protected].

Children

InsidePics is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

International transfers

Our infrastructure providers operate globally, so your information may be processed in countries other than the one you live in. We rely on appropriate safeguards for such transfers.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the date at the top of this page, and we will provide additional notice for material changes.

Contact us

Questions about this policy or about your information can be sent to [email protected], or addressed to INSP Limited Liability Company at that address.