Last updated 8 October 2026

Privacy Policy

Crowdroll is a shared camera for events. This page explains what we collect, why, and what you can do about it. It is written to be read rather than to be survived.

The service is operated by Roden Muscat, trading as Crowdroll (“we”, “us”), established in Malta. We are the data controller for everything described on this page. Full contact and registration details are at the bottom. If you have a question about anything here, email hello@crowdroll.cam.

What we collect

Your account. When you sign in with Apple we receive a stable identifier for you and, if you allow it, your name and email address. If you choose Apple’s Hide My Email option we only ever see the relay address, which is fine. We use it to contact you about your account, and, only if you ask us to, to send you occasional news and offers. That second use is off unless you turn it on, and there is a section about it below. You can set a display name, which is shown to other people on the same roll.

Your event activity. Which rolls you have joined, when you joined, and how many of your shots you have used. Hosts additionally have the details of the events they created: the title, the venue name if they entered one, the date, and the limits they set.

Photos, voice notes and video messages. Whatever you capture in the app is uploaded and stored so it can be shown to the others on that roll when it develops. Photos are visible to everyone on the roll. Voice notes and video messages are visible only to the hosts of that event. This is deliberate and is not something a guest can change.

Reactions and comments you leave on photos, along with who left them.

Notification tokens. If you allow notifications, we store the token Apple gives us so we can tell you when a roll develops or when an event needs your attention. Turning notifications off in iOS Settings stops this.

Develop-notification email. If you join a roll in your web browser instead of the app, you can leave an email address so we can tell you when the roll develops. We use the address to send that one email, and we delete it within thirty days of sending. If the roll never develops, the address is deleted along with the event. Leaving an address is optional, and the roll works the same without it.

Purchases. Paid event tiers are bought through Apple. We never see your card details. We receive a record from Apple that a purchase was made so the app knows which tier your event is on.

Support. If you email us, we get your message and whatever your mail program puts around it, and we keep it for as long as it takes to sort the problem out.

If you send a report from inside the app, we also receive technical details about the device you sent it from: the app version and build, that you are on iOS, your iOS version, your device model, your language setting, and a short extract of the app’s own recent activity log. That report is linked to your account, because a support request we cannot connect to an account is one we cannot act on. We use it to fix the problem you reported and for nothing else, and we delete these reports twelve months after they are resolved.

Marketing email

We would like to be able to tell you when something worth knowing happens: a new feature, a seasonal offer, a change in what things cost. We will only do that if you ask us to. The switch is in the app, under Profile → Settings, it is off until you turn it on, and we record the moment you did so that we can show we had your permission.

If you turn it on, expect a few emails a year rather than a few a month. Every one of them has an unsubscribe link at the bottom, and that link works without signing in or replying to anything. You can also turn the same switch off in the app, and some mail programs offer their own one-click unsubscribe button, which we honour identically. Whichever you use, we both clear the permission and add your address to a list that stops future campaigns even reaching the point of being sent.

Turning it off does not make you miss anything you need. Email about events you are hosting, meaning your codes, your dates and anything that has gone wrong, is not marketing, is not covered by this switch, and will keep arriving.

What we do not collect

We do not use third-party advertising or analytics SDKs. We do not build an advertising profile of you, we do not sell or rent your personal information, and we do not share your photos with anyone outside the event you put them in. There are no trackers on this website.

Photos are not scanned for faces or objects, and location is not read from your camera or attached to your uploads.

Who can see your photos

Only people who have joined the same roll. Access is enforced on the server, not just hidden in the app, so someone who is not a member of an event cannot read its photos even if they go looking.

Before a roll develops, nobody can see the photos at all, including you and including the host. This is the product working as intended rather than a security promise, but the effect is the same.

Anyone holding an event code can see a small public preview of that event on this website: the title, the venue, the date, and how many people and photos are on it. No photograph is ever shown on that page and no photograph is ever included in a link preview.

Why we are allowed to do this

If you are in the UK or the EEA, our lawful bases under the UK GDPR and the EU GDPR are: performing our contract with you, for everything needed to run an event you joined; our legitimate interests, for keeping the service secure and dealing with abuse; your consent, for push notifications and for marketing email, either of which you can withdraw at any time without affecting anything we did before you withdrew it; and legal obligation, where we have to keep records of purchases.

How long we keep it

How long photos, voice notes and video messages last depends on whether the event was paid for, and we would rather be exact about it than reassuring.

Free events. Sixty days after the event date the roll locks and nothing on it will load any more. Thirty days after that (ninety days after the event date) the files are permanently deleted, along with the reactions and comments on them. The lock comes first on purpose, so that there is a month in which a host who has left it too late can still buy the event and get everything back. Events created before October 2026 keep the longer terms they were created under: locked at ninety days, deleted at one hundred and twenty.

Paid events, and free events that bought the keep-forever add-on. These are not on a timer. They are kept while the event exists, which means until the host deletes the event, the host deletes their account, or you delete your own uploads. The reason we keep them rather than expiring them is that this is the thing being paid for.

One thing about paid events we would rather write down than let you discover. Twelve months after a photo is taken, we re-save it at up to 2560 pixels along its longest side, and the larger file we had before is not kept. That is around six and a half megapixels, which fills any screen you own and prints bigger than A4 at full quality, but it is not the file your camera produced. Nothing else changes: the photo stays where it is, at the same address, for as long as the event does. Voice notes and video messages are never re-encoded.

This applies to photos uploaded from 4 September 2026 onwards. Anything that was already on our servers before then keeps its original file, because keeping it is what we said we would do at the time it was uploaded. If you want a photo exactly as your camera made it, save it to your camera roll from inside the app. The original is there for the first year, and Save all on the roll does the whole event in one go.

Whichever kind of event it is, you can delete any photo, voice note or video message you took at any time, and deleting your account takes your uploads with it.

When you delete your account we remove your profile, your photos, your voice notes and video messages, your reactions and your comments, your notification tokens, and your unsubscribe record if you had one. Backups roll off on their own schedule and are fully replaced within 30 days.

There is one narrow exception. If your address ever bounced, or you reported one of our emails as spam, we keep a note of the address and that fact (not linked to your account, which by then does not exist) because it is the only thing that stops us mailing it again later. It is the smallest record that does that job and it is used for nothing else.

Records we have to keep for tax or accounting reasons, namely that a purchase happened and for how much, are kept for as long as the law requires, and are not linked to your photos.

Deleting your account

You can delete your account from inside the app, in Profile → Settings. It does not require emailing us and it is not reversible.

One thing to be aware of: if you hosted an event, deleting your account deletes that event and everyone else’s photos on it. The app warns you before it does this.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and object to processing based on legitimate interests. Email hello@crowdroll.cam and we will respond within one month.

If you are in the UK or the EEA and think we have got something wrong, you can complain to your local data protection authority. We would rather you told us first, but you do not have to.

Who we use to run the service

We keep this list short on purpose. Supabase hosts our database and stores uploaded media. Vercel hosts this website. Apple handles sign-in, push notifications and payments. RevenueCat reconciles purchase receipts. Resend delivers the email we send, and it sees the address and the message, as any mail carrier must, and nothing else.

Some of these are based in the United States. Where data leaves the UK or the EEA it is transferred under the European Commission’s Standard Contractual Clauses or an equivalent approved mechanism.

Children

Crowdroll is not for children under 13, and we do not knowingly collect anything from them. If you believe a child has an account, email us and we will remove it.

Changes

If we change this policy we will update the date at the top, and for anything significant we will tell you in the app before it takes effect.

Who we are