Privacy Policy
Last updated September 28, 2026
Attic is made by Stellandra. This policy describes what the app collects, why, and where it goes. It is written against what the app actually does, not against a template.
Your account
You do not need to sign up or sign in to use Attic. The first time you open the app, it creates an anonymous account for you automatically. We do not ask for a phone number or a password.
Signing in with Apple or Google (optional, from version 1.0.3). From version 1.0.3 you can choose to sign in with Apple or Google, so your collection, its photos and your unlock come with you to your next phone. Earlier versions of the app have no sign-in. If you sign in, our server stores only the sign-in identifier for your account; it does not store your email address or your name. The sign-in itself goes through Google's Firebase Authentication, which keeps its own sign-in record: the email address Apple or Google shares (with Apple, this can be a private relay address if you choose to hide your email) and, if you sign in with Google, the name and profile picture on your Google account. Apple's sign-in screen may also offer to share your name; the app does not keep it or send it to our server.
On our server, that account holds a random account ID, the device identifier described below, your device's time zone, and when the account was created. The app keeps the access token for this account in the keychain on your device.
Your photos
When you photograph an item, or choose a photo from your library, the app sends that photo to our server, which passes it to Google's Gemini API for one purpose: to identify the object and estimate its value. From version 1.0.4 an item can have up to 4 photos, taken from different angles; when you identify it, all of its photos are sent together, with the angle you picked for each extra photo (such as bottom, back or maker's marks). The photo sent for identification is not stored by that step, and we do not use your photos to train any model. How Google handles what it receives through its API is governed by Google's own terms.
For each identification, our server also keeps a short record against your account ID: which model was used, how large the request and the answer were, and what it cost. This record does not contain the photo or what was identified.
When you save an item, its photos are kept in private cloud storage under your account, whether or not you have the unlock or have signed in. This section describes the app from version 1.0.3; before version 1.0.4 each item had one photo.
- In our cloud storage, for everyone. Each saved photo is uploaded to private cloud storage we control, up to your account's limit. The limit counts items, not photos: 50 items without the unlock, 300 with it, plus 500 or 1,000 more for each extra-space pack you buy on top of the unlock. An item counts once its main photo is in cloud storage; its other photos do not count again. If your account is at its limit, a new item's photos stay on your phone and are not uploaded, and the app tells you so.
- On your phone. The app also keeps the photos it is showing you on your phone. The app does not save copies to your Photos library. Some pre-release test versions of 1.0.3 did; those copies are yours to keep or delete, and the reference to them kept with the item (an identifier from your Photos library, not the photo) is deleted with the item or your account.
- After a reinstall or on a new phone. If you signed in with Apple or Google, sign in with the same account and your photos come back from cloud storage. If you did not sign in, your account is tied to this phone, and deleting the app means you cannot get its photos back.
Who can see a backed-up photo. Only your account. The storage is private: nothing in it is public, and the app gets a photo back through a link our server creates for your account that stops working after 5 minutes. We do not look at your photos, use them for anything other than giving them back to you, or share them with anyone.
How long we keep it. As long as the item and your account exist. When you remove an item, its backed-up photos are deleted from cloud storage. When your account is deleted, every backed-up photo on it is deleted. Photos of items beyond your account's limit are not uploaded.
Your collection
What you save is stored on our server under your account: the item's name (ours, and any name you give it), its category, the details identified from its photos, which angle each extra photo shows, any notes, where you keep it, the estimated value, and any value you enter yourself. This is so your collection is still there next time you open the app, and so you can export it.
When you remove an item, it disappears from your collection and from your exports. On our server, the record is marked as removed rather than erased straight away; its backed-up photos, if it has any, are deleted from cloud storage.
The device identifier
The app generates a random identifier and stores it in the keychain on your device. Keychain entries can remain on a device even after the app is deleted. The identifier is used for two things:
- Recognising one anonymous account per device, so the free identifications cannot be claimed again by creating new anonymous accounts.
- Linking usage events (below) to the same install, including events sent before your anonymous account has been created.
It is not Apple's advertising identifier, it is not used to track you across other companies' apps or websites, and it is not shared with any third party.
Usage events
From version 1.0.2, the app sends a short record to our own server when certain things happen, so we can see where people get stuck and improve the app. There are nine of these events: the app was opened; a photo identification started, succeeded or failed; an item was saved; the unlock screen was shown; a purchase started, completed or failed. From version 1.0.3 there is a tenth: a photo could not be uploaded to cloud storage, which carries the error code and status the upload returned. From version 1.0.4 there are two more, twelve in all: the app could not set up your account when it started, and your collection could not be loaded.
Each event carries its name and time, the platform, app version and build number, the device identifier and, once your anonymous account exists, your account ID. Some events carry a few extra details: for example, whether a photo came from the camera or your library, what kind of error stopped an identification, whether you entered your own value (yes or no, not the value itself), or, when a purchase fails, the error code and message the purchase returned and how long that step took. The two events added in version 1.0.4 carry which step failed, what kind of failure it was (for example, no connection or no reply in time), the status and error code returned, and how long the attempt took. Events sent before your account exists keep only the event name, time, platform, app version and device identifier, except these two error events, which also keep those failure details and the build number.
Events never include your photos, item names, notes or anything else you type. They go only to our server. There is no third-party analytics SDK in the app.
Purchases
The unlock is bought through Apple's App Store. Apple handles the payment, and we never see your payment card details. The app uses RevenueCat to manage the purchase: the app gives RevenueCat your anonymous account ID, RevenueCat receives the purchase record from Apple, and our server asks RevenueCat whether your unlock is active and records the answer against your account.
Who else receives data
- Google (Gemini API): the photos of the item you are identifying, as described above.
- RevenueCat: your anonymous account ID and your purchase records, to handle purchases and restores.
- Apple: your payment, through the App Store.
- Google (Firebase Authentication): only if you sign in with Apple or Google (from version 1.0.3), the sign-in record described under “Your account”.
Our server and database run with a cloud hosting provider, which stores this data on our behalf. Backed-up photos are stored in private cloud storage provided by Cloudflare (R2), on our behalf.
What we do not do
We do not sell your data. We do not run ads. We do not use Apple's advertising identifier, and we do not track you across other companies' apps or websites. The app contains no third-party analytics, advertising or crash-reporting SDK.
How long we keep it
We have not set an automatic expiry. Your account, your collection and your usage events stay on our server until you ask us to delete them. After a deletion we keep only what is listed under “What we keep” below. Backed-up photos stay in cloud storage until you remove the item or your account is deleted. The photos kept inside the app stay on your phone until you remove the item or delete the app. If you signed in, from version 1.0.3 deleting your account also removes the Firebase Authentication sign-in record, unless the same sign-in is still active on another Stellandra app — see “What a deletion does not reach” below.
Deleting your data
From version 1.0.3, you can delete your data from inside the app, whether or not you have signed in: in Settings, under Account, tap “Delete account” (or “Delete my data” if you have not signed in). The app tells you what will be deleted and asks you to confirm twice; the deletion then happens straight away and covers everything listed under “What we delete” below. In earlier versions, or if you can no longer open the app, email support@stellandra.com to have the data linked to your install deleted from our server. You can also remove any item from inside the app, which also deletes its backed-up photos. Deleting the app removes the photos kept on your phone, but not the ones in cloud storage; to remove those, delete the items or your account.
What we need to find your data, if you email us. Our server does not store email addresses, so we cannot tell which account is yours from the address you write from. The only thing that lets us find it is a support reference that starts with ATT-. From version 1.0.3, the app shows this reference in Settings, under “Support reference”. Earlier versions show it in one place: on the unlock screen, when a purchase or a restore did not unlock the app. If you have one, copy it into your email exactly as shown. A reference that starts with ATT-anon- was made before your install had an account, and it cannot be used to find your data. Without a usable reference we cannot find your data, and we will tell you so rather than guess.
What we delete.
- Every item in your collection, including items you had already removed.
- Every photo backed up to cloud storage under your account.
- Your usage events, including those your device sent before your anonymous account was created.
- The records of your identifications described under “Your photos”.
- Any other records kept under your account ID.
- The personal details on your account: the device identifier, your time zone and, if you signed in, your Apple or Google sign-in identifier are erased, and the account is closed.
- From version 1.0.3, if you signed in, the Firebase Authentication sign-in record described under “Your account” — unless that same sign-in is still active on another Stellandra app, in which case it stays until you delete your account there too, since that app still needs it to sign you in.
- From version 1.0.3, if you signed in with Apple, we ask Apple to revoke that sign-in grant, so Attic no longer has access through your Apple ID.
What we keep, and why.
- The record of your unlock purchase (which product, which store, the purchase period and its status), and the purchase notifications RevenueCat sent our server about it. These contain your anonymous account ID. We keep them so that we can handle refunds and payment disputes.
- The closed account itself, holding only its random account ID and the dates it was created and closed, because the purchase record points to it.
- Error records from our server that were linked to your account. They stay, with that link removed.
What a deletion does not reach. Apple and RevenueCat keep their own records of your purchase; deleting your data from our server does not remove them. Our hosting provider's request logs may contain your account ID; they expire on the provider's own schedule. The device identifier in your phone's keychain is on your phone, not on our server. If you signed in, from version 1.0.3 deleting your account in the app also removes the sign-in record Firebase Authentication keeps (described under “Your account”) and, if you signed in with Apple, revokes that sign-in grant at Apple — unless the same sign-in is still active on another Stellandra app you have not yet deleted, in which case the Firebase record stays until you do. In earlier versions, or if that record was not removed automatically, email us to have it removed; with Apple, you can also stop using your Apple ID with Attic directly in your Apple ID settings.
How it is handled. A deletion from inside the app happens straight away. We handle each emailed request individually, and reply to your email once it is done.
Children
Attic is rated for general audiences and is not directed to children. We do not knowingly collect personal information from children under the age required by your local law.
Contact
Questions about this policy: support@stellandra.com