Privacy Policy

Last updated: March 2026

This Privacy Policy describes how REWIND ("we", "us", or "our") collects, uses, and protects your personal information when you use the REWIND mobile application and related services (collectively, the "Service"). By creating an account or using the Service, you acknowledge that you have read and understood this policy.

We are committed to protecting your privacy and handling your data with transparency, integrity, and respect for your rights under applicable law, including the General Data Protection Regulation (GDPR) where applicable.

1. DATA CONTROLLER

The data controller responsible for your personal information is the REWIND team, reachable at privacy@rewindapp.it. We respond to all privacy-related inquiries within 5 business days.

2. INFORMATION WE COLLECT

We collect only the information necessary to provide and improve the Service. This includes:

Account information — your email address and username, provided at registration.
Photos — images you capture through the in-app camera. Photos are stored securely and are only accessible to you and the friends or groups you explicitly choose to share them with.
Location data (optional) — if you choose to enable location tagging, we store the street name and city associated with a photo. Location access is strictly opt-in and can be revoked at any time through your device settings. We do not collect precise GPS coordinates or continuous location data.
Technical and usage data — device type, operating system version, app version, and anonymised crash reports. This information is used solely to diagnose technical issues and maintain app stability. It is not used for profiling or advertising.
Push notification identifiers — a device token used to deliver in-app notifications (e.g., when your photos are ready to view). This identifier is not shared with third parties for marketing purposes.

We do not collect advertising identifiers, track your activity across third-party apps or websites, or build behavioural profiles for marketing or commercial purposes.

3. LEGAL BASIS FOR PROCESSING

We process your personal data on the following legal bases under the GDPR:

Contract performance — processing necessary to provide the Service you have signed up for, including account authentication, photo storage, and social features.
Legitimate interests — processing necessary for app stability, security, and abuse prevention, where such interests are not overridden by your rights.
Consent — for optional features such as location tagging and push notifications, which you may withdraw at any time.

4. HOW WE USE YOUR INFORMATION

Your information is used exclusively to operate and improve the Service:

Authenticating your account and maintaining its security.
Storing and delivering your photos to the people you choose to share them with.
Enabling social features including friend connections, group darkrooms, reactions, and comments.
Sending push notifications relevant to your activity (e.g., photo development, new comments).
Diagnosing technical issues and improving app performance and reliability.

We do not sell your data. We do not use your data for advertising. We do not share your personal information with third parties for their own commercial purposes.

5. DATA STORAGE AND SECURITY

Your data is stored on servers provided by Supabase, hosted on Amazon Web Services (AWS) infrastructure in the EU region (eu-west-1). All data is encrypted in transit using TLS and encrypted at rest using industry-standard AES-256 encryption.

Photo assets are processed via Cloudinary solely to apply image transformations, and are immediately transferred to and stored on Supabase infrastructure. No photos are retained on Cloudinary servers beyond the processing step.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. Access to personal data is restricted to authorised personnel only.

6. DATA RETENTION

We retain your personal data for as long as your account is active or as necessary to provide the Service. Specific retention periods apply to different types of data:

Unsaved photos are automatically and permanently deleted 30 days after they are developed, unless you explicitly save them to your archive.
Account data (email, username, profile information) is retained until you delete your account.
Upon account deletion, all associated data — including photos, profile information, friendships, comments, and reactions — is permanently and irreversibly deleted within 30 days.

7. YOUR RIGHTS

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

Right of access — you may request a copy of the personal data we hold about you.
Right to rectification — you may update your username and profile information directly within the app at any time.
Right to erasure — you may delete your account at any time from Settings → Delete Account. This permanently removes all your data.
Right to data portability — you may request a structured, machine-readable export of your personal data by contacting us at privacy@rewindapp.it.
Right to object — you may object to processing based on legitimate interests by contacting us directly.
Right to withdraw consent — where processing is based on consent (e.g., location tagging, push notifications), you may withdraw it at any time through your device settings without affecting the lawfulness of prior processing.

If you are located in the European Economic Area, you also have the right to lodge a complaint with your local supervisory authority. In Italy, this is the Garante per la protezione dei dati personali (www.gpdp.it).

8. THIRD-PARTY SERVICES

The Service relies on a limited number of carefully selected third-party providers to operate. These providers act as data processors under our instruction and are contractually bound to handle your data securely and in compliance with applicable law:

Supabase — database, authentication, and file storage infrastructure.
Cloudinary — photo processing and delivery.
OneSignal — push notification delivery. OneSignal receives your device push token solely for the purpose of delivering notifications.
Sentry — anonymised crash reporting and error monitoring.

We do not use advertising networks, tracking pixels, or any third-party analytics services that build profiles of your behaviour.

9. CHILDREN'S PRIVACY

The Service is not directed to individuals under the age of 14. We do not knowingly collect personal data from children under 14. If we become aware that a child under 14 has provided us with personal information, we will take prompt steps to delete such data. If you believe we may have inadvertently collected data from a minor, please contact us at privacy@rewindapp.it.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will notify you through the app or by email. The date at the top of this page indicates when the policy was last revised. Continued use of the Service following notification constitutes acceptance of the updated policy.

11. CONTACT

For any questions, requests, or concerns regarding this Privacy Policy or the handling of your personal data, please contact us at privacy@rewindapp.it. We aim to respond to all enquiries within 5 business days.