What happens to your photos?

Updated September 26, 2026. This page describes the current Cheese beta operated by Hostmaid, LLC. The website and browser exchange use Netlify; the online photo relay uses DigitalOcean. Both providers process network information to deliver and protect their services.

Optional accounts

Where Apple or Google sign-in is enabled, we store the provider’s account identifier, available name and verified email, including an Apple private relay address when supplied. We use this information for your account, not advertising. Provider tokens needed to disconnect your account are encrypted in our database. Account deletion attempts provider revocation before removing the account; if the provider is unavailable, retry deletion or contact support. Matching email addresses do not automatically merge accounts. Adding a verified phone number to a social account is optional.

We record the accepted Terms of Use version and timestamp, and Privacy Policy acknowledgement separately from verification-text consent. These records remain with your account until deletion.

No account is required to exchange photos. Where phone sign-in is available, we store your phone number, optional name and contact email, internal account ID and verification consent to provide your account. Twilio processes your phone number and verification metadata to deliver and check sign-in codes. We do not store the SMS code, and verification consent does not subscribe you to marketing.

Verification requests expire after ten minutes. Expired requests and sessions are cleaned up on service startup and at least once per minute while it runs. Sessions expire after 30 days. Abuse-prevention records use keyed hashes and expire within a day. Account profiles remain until deletion. Native session tokens use device-only secure storage; browser account sessions are held in memory.

Contact email is optional and unverified; it cannot be used for sign-in or account recovery. We record consent when you save these profile details and do not use them for marketing.

Use Account → Delete account to remove your active account profile and revoke its sessions and pending verification requests. This does not delete your locally saved photos; use Delete saved photos for those. Backup copies and provider records may persist under their retention obligations; contact us for deletion assistance. An account does not back up or synchronize your photo collection.

Photos and storage

The camera is used for an accepted photo request. Received photos are stored in My moments on your device (browser storage on the web and app files on iPhone). They remain until deleted or app/site data is removed. There is no cloud photo library.

Version 1.1 and the updated browser exchange encrypt photos on the sending device with AES-256-GCM before transfer. The recipient decrypts them; the relay receives ciphertext and public keys, not the private decryption keys. Compare the complete verification code on both devices before approval. Older app versions use the older transfer protocol and do not have this end-to-end protection. Transfer photos are kept in server memory until acknowledgement, cancellation, expiry, or server restart. Sent transfers expire after two minutes if they are not acknowledged. The photographer’s temporary copies are removed after delivery acknowledgement or the two-minute sender deadline. If iOS suspends the app, cleanup resumes when it runs again. Native sender capture protection is enabled during the sender session; browsers cannot prevent screenshots, and no app can prevent another camera photographing the screen. Exported copies are outside Cheese’s storage controls.

Nearby connections

The iPhone implementation uses local-network and Bluetooth capabilities for nearby exchange. It is still undergoing physical-device validation. Location coordinates are not collected by the current app.

Technical data

The current relay uses connection IP addresses for short-term rate limits. Your device stores a random installation identifier, locally blocked installation identifiers, walkthrough preferences, settings, received photos, and, in the browser, active session credentials. The application does not include advertising or analytics tracking. A website or service host may process connection information to deliver and protect its service.

Pairing and safety

Both participants compare a session number and the requester approves the photographer. Installation identifiers are shared with the paired device to support local blocking. They do not verify a person’s identity; reinstalling or changing devices can bypass a block. Safety reports are composed and sent through your email app to our support address. Do not include sensitive photos in reports.

Support and your choices

If you email support, we receive your email address and the information you include. Contact us for privacy or deletion requests. Delete received photos in Settings; remove exported copies separately. You may revoke camera and nearby-network permissions in device settings.

Contact

Hostmaid, LLC
5935 South Blvd, Charlotte, NC 28217-4123, United States
ben@capuletcleaning.com