Last updated 26 October 2026. This policy covers the Shutterlings online game: the Android and iPhone apps and the Shutterlings service they talk to. Questions go to support@shutterlings.com. Please also read the Terms of Service and the Community Rules.
Shutterlings is a photography game made by a small independent developer: GP Develop, 421 W Riverside Ave, Ste 381, Spokane, WA 99201-0402, USA. We run the service ourselves on Render, in the United States (Oregon). We do not sell your information. The game can show an optional ad you choose to watch, described under Ads.
You can play as a guest. The app then makes a key on your phone, inside its protected key store (Android's key store, or the iPhone's Secure Enclave). The private half never leaves the phone. We keep the public half, a number made from it, and when it was made or retired.
You can also sign in with Google. Google's sign-in token carries your account identifier, your email address, your name and your picture. We keep only the account identifier and the name of the issuer, and discard the rest.
On iPhone you can also use Sign in with Apple. Apple tells us a random identifier for you, and may share an email address, which we do not keep. So that we can end your Sign in with Apple when you delete your account, as Apple requires, we also keep a token Apple gives us, encrypted, until then. If you stop using Sign in with Apple with Shutterlings, or delete your Apple account, Apple tells us, and we end your sessions or delete your account.
Anyone with a Google account may sign in. While the game is in testing, Google sign-in may be limited to invited testers. We can shut an account out, and we do so for abuse. If we shut an account out, we keep its Google identifier, to keep it out. If you were invited to test the game, we keep the record of that invitation with your Google identifier until your account is deleted; then we remove your identifier from it.
When you photograph something and choose to use it, the photo is sent to us, with an optional short note and the name you want. The app does not look for or cover faces or text in it first.
To check the photo and to name and describe the Shutterling, we send it to Anthropic, a company that provides AI models. Anthropic receives the photo (made smaller), your note and the name you asked for. We send the text that comes back to Anthropic again to check it is suitable. We cut the subject out of the photo on our own server. Anthropic processes this for us under its terms for business customers.
A photo that fails the check is not kept by us, but it has already been sent to Anthropic. We count how many of your photos were refused each day, to limit retries. The check is set to refuse real people as the main subject. It also refuses photos where a real person's face, a license plate, an ID or contact details can be seen. This is not a face filter and it does not promise to remove personal details, so do not photograph things you do not want seen.
We keep the photo, the cut-out, smaller copies for display, the Shutterling's details and your note until you delete your account. Each photo makes two takes of a Shutterling; the take you did not choose is deleted seven days after you choose.
For each request to Anthropic we also record which model answered and how much it used, so we can watch costs. That record is not linked to your account.
Each photo is Public or Private. You always see your own. Other players see a Public photo of a Shutterling you chose. For a Private photo, or one that is hidden, blocked or removed, they see a picture of its type instead.
Shutterlings with Public photos are met by other players on their Photo Walks. You never meet your own. Other players are not told who made a Shutterling. A Shutterling's name and details stay visible to the players who have it even when its photo is Private. Guests' photos are always Private.
While the game is in testing, it runs on a separate test service. When the full game opens, the creations of testers who linked Google move to it: they come back to your album there, Public or Private as you left them, and Public ones we choose may be met by other players on their walks. Guests' creations do not move.
Making a photo Private stops it being offered to other players. Players who already have that Shutterling keep it.
We keep your album on our service: your Shutterlings, their levels and moves, your Film and other in-game currency, items and frames, your progress, the Shutterlings you have seen and met, your battles and their results, and your time zone, which sets when your daily Snaps reset. We count your creation attempts each day, to keep within daily limits.
You can buy Snaps, frames and the Shutterlings Plus subscription in the app. Google Play or the App Store takes your payment. We never see your card or other payment details.
To give you what you bought, restore it on a new phone and handle refunds, we keep the store's transaction numbers, the product, the dates and the state of each purchase (bought, renewed, cancelled, refunded). The app also gives the store a code made from your account, which is not your account number and says nothing about you, so a purchase stays with the account that made it. Google and Apple tell us when a purchase is renewed, cancelled or refunded. We keep purchase records while your account exists and erase them with it, except where the law requires us to keep a record of a payment. Where it does, we keep only what it requires.
Shutterlings has optional rewarded ads: you can watch one ad a day to get one Snap. Ads are served by Google AdMob. We ask only for non-personalized ads. We do not use your phone's advertising ID, and the app does not ask for it. Google may still process some device and usage data to serve and measure ads and to prevent fraud; see [how Google uses data from partner sites and apps](https://policies.google.com/technologies/partner-sites). Where the law requires it, such as in the European Economic Area and the United Kingdom, the app shows a consent prompt first. When you finish an ad, Google tells our server so we can give you the Snap; that message carries a code for the ad and a code tied to your account, not your name or email. You never have to watch an ad.
If you play live battles against other players, we keep your ladder rating, your wins, losses and draws, the team you saved for them, and a record of each finished match: who played, who won, why it ended and the ratings before and after. Your opponent sees your three Shutterlings (their names, types and Public photos) and your rating, never your account or sign-in.
If you press SEND FEEDBACK, we receive what you write and, if you leave "Attach screenshot" on, a picture of the screen you were on. The app adds its version, your phone's operating system and model, a short start-up support code and up to the last 200 lines of the app's own log.
If the app hits an error it did not expect, it sends us a crash report by itself: the kind of error, where in the app it happened, and the same app details and log lines. It sends at most three each time the app runs, and keeps at most five waiting on the phone when it cannot send them.
Before anything is sent, the app removes sign-in tokens, keys, email addresses and account numbers from the log and texts, and our server checks again. We use feedback and crash reports only to find and fix problems. Each is deleted 180 days after it arrives, or sooner if you delete your account.
So that we notice problems quickly, our service posts short alerts to a private Discord channel that only the developer reads. An alert says that a report was made (its reason, what was reported and a short Shutterling number), that a daily creation limit was reached, or that the service started. For feedback it carries the app version, the phone model and the first 200 characters of your note, after the cleaning above; for a crash, the kind of error and where it happened. Alerts never carry your account number, sign-in or photos.
When you hide a Shutterling or block a player, we record who hid or blocked what, and when. When you report a Shutterling, we record the report, its reason, any comment you write, and a copy of what you reported, so a person can review it. A report also hides the Shutterling from you.
If we suspend an account for breaking the Community Rules, we record when the suspension ends and our reason. While it lasts, that player's Shutterlings may be kept out of other players' walks.
If an account is deleted, the reports and blocks other players made about its Shutterlings are kept for 180 days, for safety, without either player's account: only which Shutterling, what was reported and why, and when.
To slow down repeated attempts to sign in, delete an account or send feedback, we count attempts by the IP address each request comes from. We store a keyed one-way hash of that address with the count, not the address itself, and not linked to your account. Our hosting provider also keeps its own logs of requests, including their addresses, for a limited time. We do not use addresses to find where you are.
The app asks for access to the camera, and uses the internet. It does not read your photo library, contacts or location. The only advertising code in it is Google's AdMob, used for the optional rewarded ad. It contains no analytics or third-party crash reporting code: crash reports go only to us. It also checks whether the phone is online.
The phone keeps your sign-in, the guest key, pictures it has downloaded, your settings, and up to five crash reports waiting to be sent.
We share your information with no one else, unless the law requires it.
You can delete your account in the app, from the Account page, even if we have shut it out or suspended it. How to do it, and what to do if you no longer have the app: Delete your account. The Account page also shows your account code; quote it if you write to us. If you ask us by email to delete your account, we delete it 14 days after your request unless the account is used in that time. When you delete it in the app, your sessions end at once. Within 30 days we erase your album, your photos and their copies, your Shutterlings, your sessions, your reports, hides and blocks, your feedback and crash reports with their screenshots, your ladder place and saved team, any suspension, your sign-in records, the link between you and any invitation, and the records of your creations.
Players who already have one of your Shutterlings keep it. They see a picture of its type instead of your photo, and a name you chose becomes a plain name. Your Shutterlings leave every Photo Walk. Finished live matches stay as history without your account.
If you join a guest album to a Google account and choose to keep only one album, the other is kept for 30 days and then erased, with its feedback.
A guest account that has not been used for 180 days is deleted in the same way, because nobody can open it without the phone that made it.
We back up our database once a day, encrypted. Most backup copies are deleted after seven days, and every backup or recovery copy that holds your account is deleted within 90 days of your request at most. Our host also keeps its own short-term database backups. If we ever restore a backup, we first erase again every account deleted since it was made. For that we keep a list of deleted account numbers, with when and how each was deleted. Account numbers are random and say nothing about you.
We keep the hashed sign-in addresses, the list of deleted account numbers, and the Google identifiers of accounts we have shut out for as long as the service runs, because they are needed to keep it safe.
Sessions last at most 90 days.
While Shutterlings is in testing, we may reset the test service. If we do, albums on it may be erased.
Shutterlings is for players aged 13 and over. It is not made for children under 13, and we do not knowingly collect their information. If you believe a child under 13 is using it, write to support@shutterlings.com, with the account code from its Account page if you can, and we will delete the account once we can tell which it is.
Everything travels encrypted. Backups are encrypted. Only the service and its operator can reach the data, and only to run the game. No system is perfectly safe. If a breach affects your data, we will tell you as the law requires.
You can delete your account in the app at any time. For any other question about the data we hold on your account, write to support@shutterlings.com with your account code. Depending on where you live, the law may give you rights over your data, such as to see it, correct it, object to how we use it, or complain to a data protection authority. Your data is stored in the United States.
When we change this policy we post it at this address and update the date at the top. Please check back from time to time.