PicLoomPrivacy policy
Updated October 27, 2026
Your photos and choices
Photo review and visual recognition run on your device. The app reads the photos you allow through iOS and records their Photos identifiers and your keep or delete choices. Original photos stay in the system photo library.
Adding photos to albums
When you swipe a photo up or save a trip as an album, PicLoom adds the photos to an album in your Photos library, creating a new album only when you ask. It only adds: nothing is removed from your library, edited or uploaded.
Recommended, What's inside, blurry and duplicates
Finding blurry photos, duplicates, the largest items and what a photo shows (people, scenery, cats, dogs, food, documents) runs on this device with Apple's built-in recognition; on iOS 27, Apple's on-device model may take a second look at a photo it is unsure of. PicLoom reads small thumbnails that Photos already keeps on the device and the file size of local videos; it does not download originals from iCloud. Only a few scores per item are kept, in this app, plus the last date printed on a ticket or receipt, never its text. Your answers to questions like “Is this a cat?” stay in this app too. Nothing is uploaded. Photos you set aside go to To Delete like any other choice, and iOS asks before anything is removed.
Sharing photos and videos
Sharing from the viewer sends only the selected media’s current edit through the iOS share sheet, without app text or links. Capture dates and location metadata may remain. Photos may download the item from iCloud under your download settings. Temporary copies are removed after sharing; interrupted copies expire. This sharing does not earn review rewards or keepsake progress.
Local storage and widgets
Review choices, statistics, preferences, journal entries, drafts, photo clues and previews are stored locally. Only explicitly saved entries supply entry summaries and selected previews to Home Screen widgets. An account is not required.
Pictures kept with your journal
Saving an entry keeps compressed copies of its chosen pictures in this app. Videos and Live Photos keep still covers without sound or motion. These copies remain after original photos are deleted or access is changed. They use local storage and are included in device backups when enabled. Deleting the app removes its local copies.
Footprints and keepsakes
Your keepsakes, earned dates, saved entry dates and completed share dates stay on this device. Sharing a keepsake is always your choice.
Footprints map
The Footprints map reads the location saved with your photos and videos on this device, and matches it to cities using a city list and province and state boundaries built into the app (GeoNames, geonames.org; geoBoundaries, geoboundaries.org; both CC BY 4.0). The globe is Apple Maps satellite imagery, so imagery for the area you are viewing is loaded from Apple Maps; when you are offline, a built-in globe (NASA Blue Marble) is shown instead. Your photos and your list of places are not sent. Only when you tap "See this place now" is that one photo's location sent to Apple to look for street imagery.
Invitations and allowance sync
When you are signed in to iCloud, review allowance and reward records sync to your private iCloud database. Invitations use public codes and confirmations linked to an opaque iCloud identity. These records contain no photos, journal text, names, email addresses or local photo identifiers. One account can confirm one invitation. No advertising ID, device fingerprint or automatic clipboard reading is used.
Gifts and your iCloud account
When gifts are enabled, accepting one uses a CloudKit identity proof and a trusted service hosted on Cloudflare. The service keeps an opaque account identifier, gift amount, dates, note and issuance record in CloudKit; it receives no photos, journal content or photo identifiers. Signed receipts also sync to your private iCloud database. The operator sees gift status, not your Apple identity. Authentication proofs are cleared within seven days; gift records are kept for permanent restoration. Connection data is used to deliver and protect the service, not for advertising.
Deleting gift data
In Invitations & Gifts, you can confirm a request to delete gift credits, receipts and account links. Processing cannot be undone. Permanent reviews already used remain deducted, including from future permanent grants. Spent-code markers prevent reuse; a minimal account marker prevents old receipts from returning. Private receipts and device caches are cleaned when devices reconnect. Photos, stories, invitation records and Pro purchases are kept.
Places
A place clue is looked up only when you ask for it from a selected photo. PicLoom sends that photo's location rounded to about 1 km (0.01° of latitude and longitude) to Apple geocoding and keeps the returned place name as an editable clue. Photos are not uploaded and your current location is not requested. PicLoom does not request or show weather.
Journal cards
Card layout happens on this device. A journal card includes the text and selected photos or video covers shown in its preview. It leaves the app only when you choose a system share destination or save it to Photos. Context notes and photo identifiers are not printed. Sharing a journal page as images or a video does not upload it to a PicLoom service. Sending it as a letter uploads an encrypted copy, as described below. Neither earns review rewards. If you added an activity stamp or card, it is printed below the text.
Journal pages, reminders and time capsules
Personal journal pages, auto pages and videos are laid out on this device from your photos, places and occasions; this layout process does not upload their content. Sending a letter and writing in a shared journal are separate choices, described below. Journal reminders (a new page, last year’s page, a month recap, a time capsule opening) are notifications scheduled on this device. You can turn off new-page, last-year and recap reminders in Settings; a time capsule always reminds you on the day you chose. Also add to Calendar opens the system event sheet: PicLoom cannot read your calendar, and the event holds only a title, the date and a link to the page, not its words, photos or place.
Letters and pen pals
When you send a journal page as a letter, its pictures, words and your sign-off are encrypted on your device before they are uploaded to PicLoom's letter service, hosted on Cloudflare. The key that opens a letter is only in its link (after the # sign), which is never sent to the service, so we cannot read your letters. Pictures are re-encoded without location data. The service keeps the encrypted letter, its size and its dates (sent, expires, opens) until it expires or you take it back; letters with no time limit stay until you take them back. Anyone who has the link can open the letter. A letter that opens on a set date keeps half of its key on the service until that date. When a recipient opens your letter in the app, an encrypted "opened" note is sent back to you. Pen-pal requests and confirmations travel through the same service as encrypted messages in mailboxes with random names, deleted after seven days. IP addresses are used only for rate limiting through a daily-changing hash and are not stored. If you report a letter, the email you send includes its link, so only then can the developer read that letter. Letters sent straight to a pen pal go into a mailbox with a random name that only the two of you can work out; the service can see that this mailbox received a letter, but not who you are or what it says. Your list of sent and received letters syncs through your private iCloud database, with titles, notes and sign-offs in encrypted fields.
Writing together
A shared journal is shared through iCloud between the people invited. The photos and words each person adds are stored in the creator's iCloud and visible to everyone in the journal; photos are re-encoded without location data. The invitation link travels inside an encrypted letter. PicLoom's own service does not store shared journals.
Tap Devices Together
When you tap two devices together to start a journal for two, PicLoom uses Local Network and Nearby Interaction to find the other device and measure how close it is. Over an encrypted local connection the two devices exchange only your sign-off, a short-lived distance token, a one-way hash of your iCloud account (so two devices on the same Apple Account can tell, never the account itself) and the invitation to the new journal. Nothing is sent to PicLoom's service and location is not used.
Activity from Apple Health
With your permission, PicLoom reads from Apple Health on this device only workout type, duration, distance and active energy, your step count and your activity rings. It does not read heart rate, routes or location, sleep or other health records, never writes to Health and never uses health data for advertising. Health data stays on this device: it is not synced to iCloud or sent to PicLoom. Add to this page saves an activity stamp or card with your entry, and the activity phrases above the keyboard place short words such as a workout or your steps into your text. Both appear in shared cards. Pages with health content are excluded from device backups. Change access in Health at any time; removing the activity keeps your text.
Your controls
You can change photo access in iOS Settings. Removing photos from the library requires a separate confirmation through iOS. Health access is managed in the Health app: your profile → Apps → PicLoom.
Purchases, reminders and diagnostics
Apple processes Pro purchases and restores through your App Store account. Daily reminders are optional and scheduled on this device. Paywall views, quota blocks, share previews and claimed rewards are counted locally. Copying version details includes only the version and software Build ID, stays on this device and expires after ten minutes. Email drafts also include device model, system version and app language. Diagnostic reports can be previewed before sharing; local activity counts are optional and off by default. Reports exclude developer and source metadata. The Build ID identifies a software package, not you or your device. No automatic diagnostic uploads, advertising or tracking SDKs are included. Settings checks the App Store for a newer version, sending only the app's store ID and your region.
Backups and saved entries
Journal entries, drafts, moods, photo clues and review records are local app data included in device backups when enabled. Entries and drafts with added activity from Apple Health are excluded from device backups. This is not live sync. Drafts are kept separately from saved entries; failed saves can be retried. Available previous versions can be restored.
Across your devices
With iCloud Sync on (Settings → iCloud Sync), your journal pages, drafts, the still copies a page keeps of its photos, pictures placed on pages and letters to yourself are stored in your private iCloud database, so your iPhone, iPad and Mac show the same. Photos are matched through their iCloud Photos identifiers; your photo library itself is not uploaded. Pages with activity from Apple Health stay on the device that wrote them. PicLoom cannot read this data. What you keep or delete while reviewing stays on each device. You can turn sync off at any time.
This website and support
Cloudflare hosts this site and processes connection data, such as IP addresses, to deliver and protect it. We add no advertising trackers or analytics scripts. Your language preference and first automatic language choice are stored in your browser. Interactive examples use public media and fictional journal entries; they do not access or upload your photos or send them to AI. If you contact support, we use the information you choose to send to respond to your request.
Invitation and gift pages
Invitation pages read a code from the link query; gift pages read it from the fragment. They do not store codes or send claim or attribution requests. They write to the clipboard only when you choose Copy. The gift service may include a private issuer note that the developer can remove separately. Temporary identity proofs are scheduled for deletion within seven days, subject to the service operating normally.