Privacy Policy

1. Who We Are
 
Last Updated: 28 July 2026.

Bunched is a product of Family Bunch LTD (Company No. SC897732), a company registered in Scotland, United Kingdom. We act as the data controller for all personal data processed through the Bunched app and website.
 
Email: [email protected]
Support: [email protected]
Website: bunched.app

Your Privacy Comes First
 
When using Bunched, your family's memories belong to you, and only you.
 
Every bunch is private by default and invite-only. That means only the people you choose can view the photos, videos, and memories you share. There are no public profiles, no followers, and no strangers browsing your content.
 
We don't use your photos or videos to train AI models. We don't analyse your memories for advertising, and we don't sell your personal content to third parties.
 
Your memories are protected with encryption and shared only with the people you invite, giving you complete control over who can access your family's moments.
 
Simply put, your memories stay within your bunch, exactly where they belong.

2. What Data We Collect
 
2.1 Account Data
 
When you create an account, we collect:

• Email address - provided directly or via Google or Apple sign-in

• Display name - provided directly or from your Google or Apple profile

• Profile photo URL - from your Google or Apple profile, if available

• Authentication method - email, Google, or Apple
   

2.2 Photos and Media
 
When you upload content, we store, but cannot view:
 

• Image files - original plus resized versions (thumbnail 165×165 and preview 640×640 in WebP format)

• Captions - any text added to a photo

• Date taken - extracted from EXIF metadata or file date as fallback

• People tags - names and coordinates if tagging is used

• Uploader identity - your user ID and display name
   

EXIF data is processed locally on your device only to organise content. Raw EXIF data such as GPS or camera details are not stored on our servers.
 
2.3 Subscription and Billing Data
 
If you subscribe to Bunched+ (Bunched Plus), we receive from Apple or Google:
 

• Purchase token or transaction receipt

• Subscription status

• Product type and billing cycle

• Expiry date
   

We do not store card details, bank information, or billing addresses. Payments are handled entirely by Apple or Google.
 
2.4 Device and Technical Data
 

• Platform - iOS, Android, or web

• Push notification tokens - used to deliver notifications
   

We do not collect device model, OS version, IP address, advertising identifiers, or precise location.
 
2.5 Analytics Data
 
We use Firebase Analytics to improve the app. This includes:
 

• App events - such as sign-up, uploads, and interactions

• User properties - platform, subscription tier, usage patterns

• Automatic events - session activity and engagement
   

We do not use advertising identifiers or cross-app tracking.
 
2.6 Crash Reports
 
We use Firebase Crashlytics to identify and fix issues.
 

• Crash traces and error messages

• Anonymised user ID
   

No personal content is collected.
 
2.7 Notification Preferences
 

• Activity notifications

• Reminder settings

• Timestamp of permission prompts
   

3. How We Use Your Data
 
We use your email address, display name, and authentication method to authenticate your identity and maintain your account. This processing is necessary for the performance of a contract under Article 6(1)(b) of the UK GDPR.
 
We use your photos, captions, date taken, and people tags to store and display your content within your spaces. This processing is also necessary for the performance of a contract under Article 6(1)(b).
 
We use your push notification tokens and notification preferences to send you notifications about activity in your spaces. This is based on your consent under Article 6(1)(a).
 
We use your subscription status, purchase token, and billing cycle to manage your subscription and provide access to premium features. This is necessary for the performance of a contract under Article 6(1)(b).
 
We use analytics events and crash reports to improve the app and fix bugs. This is based on our legitimate interests under Article 6(1)(f).
 
If you opt in, we use your push notification tokens and reminder timestamps to send weekly reminders. This is based on your consent under Article 6(1)(a).
 
4. Device Permissions
 
Bunched requests certain device permissions to enable key features. All permissions are optional and are requested at the point they are needed.
 
We request access to your camera so you can take photos directly within the app and share them to a space. This permission is requested when you choose to take a photo.
 
We request access to your photo library (read access) so you can select existing images from your device to upload. This is requested when you open your photo library.
 
We request access to your photo library (write access) so you can save photos from a space back to your device. This is requested when you download a photo.
 
We request permission to send notifications so we can alert you when there is activity in your spaces, such as new uploads, comments, reactions, or join requests. This is requested during onboarding or in your settings.
 
You can change or revoke any permission at any time through your device settings. If you deny a permission, only the related feature will be affected and the rest of the app will continue to function normally.
 
5. Third-Party Services
 
We use a number of trusted third-party services to operate Bunched. Each service processes data only as required to perform its specific function.
 
We use Firebase Authentication, provided by Google LLC, to manage user sign-in and identity. This involves processing your email address, display name, and authentication tokens.
 
We use Cloud Firestore, also provided by Google LLC, as our database for storing account data, spaces, photo metadata, and notifications. This includes the structured data described earlier in this policy.
 
We use Firebase Storage to host uploaded photos and resized image versions. This involves storing your photo files.

We use Firebase Cloud Messaging (FCM) to deliver push notifications to your device. This requires processing push notification tokens and notification payload data such as space name, user name, and event type.
 
We use Firebase Analytics to understand how the app is used and improve performance. This includes app events and user properties, but does not include your personal content.
 
We use Firebase Crashlytics to detect and fix technical issues. This involves collecting crash traces and anonymised user identifiers.
We use the Firebase Resize Images extension to generate thumbnail and preview versions of uploaded photos. This processes original images on our servers.
 
We offer optional sign-in through Google Sign-In, which processes your Google profile information such as email, name, and profile photo.
 
We also offer Sign in with Apple, which processes your Apple ID information such as email and name. This information may be hidden or relayed depending on your Apple settings.
 
We use Apple App Store and Google Play Billing to process subscription payments. These services provide us with purchase tokens and receipts, but we do not receive or store any card or payment details.
 
We do not use advertising networks, data brokers, tracking pixels, or any third-party analytics tools beyond Firebase Analytics.

6. Data Sharing

We do not sell or trade your data.

Your content is only visible to people you share it with. Data may be shared only when:
 

• Required for service providers listed above

• Required by law or regulation

• Necessary for safety or legal protection
   

7. International Data Transfers

Data may be processed in the UK, EEA, United States, or other regions used by Google.
Protections include:
 

• Standard Contractual Clauses (SCCs)

• Google and Apple compliance frameworks
   

8. Data Retention
 
We retain your account data, including your email address, display name, and profile photo, until you delete your account.

We retain your photos and captions until you or the relevant space owner deletes them, or until you delete your account. Deleting your account will also delete any spaces you own and their associated content.
 
Push notification tokens are updated regularly and are removed when you sign out, delete your account, or after repeated delivery failures.
 
We retain your subscription data until you delete your account.
 
Analytics data collected through Firebase is retained for up to 14 months, after which it is automatically deleted.
Crash reports collected through Firebase Crashlytics are retained for up to 90 days.
 
We retain your notification history until you delete your account.

9. Your Rights

You have the right to:
 

• Access your data

• Correct your data

• Delete your data

• Restrict processing

• Request data portability

• Object to processing

• Withdraw consent
   

To exercise your rights, contact: [email protected]

You can also contact the UK Information Commissioner’s Office:
Website: ico.org.uk
Phone: 0303 123 1113

10. Children’s Privacy

You must be at least 16 years old to create an account.

We do not knowingly collect data from children under this age. If this occurs, we will delete the account upon request.
Content involving children is private and only visible to invited users.

11. Cookies and Local Storage

We use only essential storage:
 

• Authentication tokens

• Upload queue support
   

We do not use tracking or advertising cookies.

12. Changes to This Policy

We may update this policy from time to time.

If significant changes are made, we will notify you via the app or email. Continued use means acceptance of the updated policy.

13. Contact

Privacy: [email protected]
Support: [email protected]