Privacy Policy

Summary

TagRoll needs no account. Your photos, tags and notes are stored on your device. A copy of your tags, notes and ratings is also included in your device's Google backup, encrypted with your screen lock (see below). TagRoll never sends your photos themselves off the device. Photos leave the app only when you select them, tap “Send” and hand them to an app you choose in the share sheet (mail, messages, an AI app and so on); from then on, that app's policy applies. The app never changes the contents of your photos. The only photos it removes are the ones you choose, by moving them to the Android trash, where they stay for 30 days. The app does not request any permission that could modify or delete them.

To improve the app we send usage statistics and diagnostics. They consist of counts, device characteristics and the install source category only; they never include photos, tag names, file names or notes. You can turn this off at any time in the app (see below).

In addition, the Google components used for photo analysis (Google ML Kit) and the map (Google Maps) send Google information such as the device model, the app version and component-specific identifiers. This cannot be turned off in the app (see below).

Information stored on your device

The following is stored in the app's private storage on your device:

• The tags, notes, ratings (stars) and saved search filters (folders) you create
• Data that identifies each photo or video (its ID in the device's media database, a hash computed from the file contents, the capture time and the pixel dimensions), used to re-link tags after photos or videos are moved or restored
• The capture location from the photo's EXIF data, and the place names derived from it. The capture location is used to place a pin on the map inside the app, and to add place names to photos using place data bundled with the app so you can search by place name. The location values themselves and the place names added to photos are handled only on this device (for what is sent to Google when the map is shown, see "Map (Google Maps)")
• Whether you have turned off usage statistics and diagnostics
• The category of the link you installed the app from (see “Install source” under “Usage statistics and diagnostics”)

Uninstalling the app deletes all of this from the device. However, a copy of your tags, notes, ratings, saved search filters and the data that identifies each photo is included in the Android device backup (Google backup). The backup is encrypted with your device's screen lock, and the key is not known to Google or to the developer. Nothing is included if the device has no screen lock or if device backup is turned off. When you reinstall the app or set up a new device, the app restores this copy automatically. The setting for usage statistics and diagnostics is included in the same backup. Photo locations are not included.

Android runs the backup when the device conditions are met (at least 24 hours since the last backup, the device is idle, and it is on Wi-Fi), so tags added after the last backup are not restored. Device-to-device transfer during a phone migration is also best effort. To keep your tags safe, export them from the “Manage tags” screen and import the file when needed.

Permissions the app requests

The app does not request any permission that allows writing to, deleting or moving your photos. When you move photos you selected on the review screen to the trash (a paid feature), it is not done through a permission: Android asks you to confirm each time, and only the photos you approve there are moved.

Usage statistics and diagnostics

To improve the app and find crashes, we send the information below. Sending is on by default and can be turned off at any time with the “Send crash reports and usage counts” switch on the app's “About this app” screen. Turning it off stops further sending, discards anything queued, and deletes the identifier stored on the device. On first launch, if you have not yet allowed photo access, the first screen has the same switch and nothing is sent until you tap “Get started”.

What is sent

• Usage statistics (PostHog): the kind and count of actions such as app start, photo scan completed (order of magnitude of the photo count), tagging performed (single or bulk), search performed (number of selected tags, whether words were typed in the search field, and whether the search ended with zero results; the words themselves and the number of results are not sent), tag deleted, bulk-tagging limit reached, paywall shown (which part of the app it was opened from) or purchase made, the capture-date calendar opened (whether from Collections or from Search), a photo opened from the memo list in the calendar (the memo text and the photo are not sent), the share sheet opened with “Send” for selected photos (the number of photos handed over; the app you send them to is not sent), and how far you got in the first-run guide, whether you picked your first tag from a suggested group or from the photos already looked through, and the order of magnitude of the number of photos you tagged (tag names and photos are not sent)
• Install source (PostHog): which Google Play link you installed the app from, sent as one of a few categories set by the developer, such as video, article or forum (“other” if none applies, “unknown” if the link carries no information). It is used to learn which introductions bring people to the app. It is sent once after installation, and once more if you clear the app's data. While the switch is off it is not sent; only the category is kept on the device and is sent when you turn the switch on. The link itself is not sent
• Diagnostics (Sentry): technical details when the app crashes or stops responding (where the error occurred, device model, OS version, app version), and, when the app handles an error and keeps running, only which part of the app it happened in and the type of error (the same kind of error is sent at most once each time the app starts)
• Common context: app version, OS name and version, device type, manufacturer and model, language and time zone, and a random identifier generated by the app for this device

What is never sent

• Your photos, their file names or paths
• Anything you typed: tag names, notes, folder names
• Photo capture locations and the place names derived from them. Estimating location from the connection's IP address is disabled
• Advertising identifiers, phone number, contacts or account information (none are collected)

Where it goes

Both providers act as processors on the developer's behalf and only under the developer's instructions; they do not use this data for their own purposes. Usage statistics are used only as aggregate numbers, never to track or target individual users.

Retention and deletion

Data sent to each service is lost once its retention period ends. The retention period is fixed by the plan each service is on and cannot be configured by this app. As of September 2026 it is one year for PostHog and 30 days for Sentry. PostHog states that data older than the retention period may be permanently deleted; Sentry states that data can no longer be accessed once the period ends. The per-device identifier is never shown in the app and is deleted from the device when you turn sending off, so there is no way to single out and delete one particular user's data.

Photo analysis (Google ML Kit)

Automatic labelling of photos and reading text in photos use Google's ML Kit. The analysis runs on your device; photos, the labels found and the text read are not sent.

For diagnostics and usage analytics of the component, ML Kit sends Google LLC (USA) device information (manufacturer, model, OS version), app information (package name, version), a per-installation identifier, processing times, error codes and similar data. Google states that it encrypts this in transit with HTTPS and does not share it with third parties. Photo analysis is a core feature of the app, so this cannot be turned off in the app.

Google's handling of this information is subject to the Google Privacy Policy.

Map (Google Maps)

The map screen is shown with Google Maps. When the map is shown, the area being viewed and the IP address of the connection are sent to Google LLC (USA) so that the map images can be loaded. When you look at places where you have many photos, that area will be around where the photos were taken. Photos, the capture location values, the place names attached to photos, tags and notes are not sent.

In addition, to maintain and improve Google services, the Google Maps component sends Google device information (OS version, model, manufacturer) and the component version, map interactions (panning and zooming), technical information when the component itself crashes, and a pseudonymous identifier generated by the component. These are sent only when you open the map screen and cannot be turned off in the app.

Google's handling of this information is subject to the Google Privacy Policy. The terms for the map are in the terms of service.

Purchases

If paid features are offered, purchases are processed through Google Play. The developer never receives payment details such as card numbers.

Differences in the iPhone version (iOS)

The iPhone version handles information under the same policy as the rest of this page. It differs from the Android version as follows.

• Photo access: The app asks for iOS photo access (all photos, or selected photos). It does not ask for location permission. Shooting locations are read from the values the photo library already holds
• Information stored on your device: In addition to the items above, the app stores each photo's iCloud Photos identifier, used to reattach your tags, memos, and ratings to the same photos when you move to a new iPhone
• Backup: The app's data, including tags, memos, and ratings, is included in your iPhone backup (iCloud Backup or a backup to your computer). Backups are made by Apple's system, and the developer never receives their contents
• Photos stored only in iCloud: The app downloads them from iCloud through the Photos system when you open a photo, and when "Download over Wi-Fi while charging" is on in "About this app". Downloaded photos stay on the device on the Photos side
• Send: When you tap "Send" on a photo, or select photos and videos in the photo list, search results or a smart folder and tap "Send" (up to 20 at a time), the app copies them to its temporary folder while the share sheet is open and deletes the copies when the sheet closes. The photos go to the app you choose in the share sheet
• Photo analysis: Labels and text recognition use Apple's Vision, built into iOS, instead of Google ML Kit. Analysis runs on the device, and the app sends neither photos nor analysis results
• Deleting photos: Photos you select on the review screen (a paid feature) are deleted only after you approve the confirmation iOS shows each time. They stay in Recently Deleted in the Photos app for 30 days, and you can recover them there. With iCloud Photos on, they are also deleted from your other devices
• Usage statistics and diagnostics: What is sent, what is not, and the switch are the same as in "Usage statistics and diagnostics" above, using the PostHog iOS SDK and the Sentry Cocoa SDK (both in the EU region). The install source is not sent. Also, while the switch is on, the PostHog iOS SDK fetches its settings from PostHog each time the app starts. This request sends only the app's identifier built into the app (the PostHog key) and the SDK's name and version, and carries nothing that identifies you or your device. It is received not by the EU-region servers but by the nearest Cloudflare location used by PostHog (as with any connection, your IP address reaches Cloudflare)
• Purchases: Handled by the App Store (Apple). The developer never receives your payment details

Third-party services

• PostHog Inc. (USA) — aggregated usage statistics (EU region)
• Functional Software, Inc. (Sentry, USA) — diagnostics (EU region)
• Cloudflare, Inc. (USA) — hosting of this website
• Google LLC (USA) — app distribution through Google Play, processing of purchases, showing the map with Google Maps, and photo analysis with Google ML Kit (the analysis runs on the device; only diagnostics are sent), and the Android device backup (encrypted with your screen lock; Google cannot read its contents)
• Apple Inc. (USA) — distribution of the iPhone version through the App Store, processing of purchases, the iPhone backup (iCloud Backup), and downloading photos from iCloud Photos

Apart from the above, user information is not provided to third parties, except where disclosure is required by law.

Access and correction requests

The developer holds no information that identifies an individual user, so there is no personal data subject to access, correction or suspension requests. All communication is encrypted (HTTPS). If anything is unclear, please use the contact form below.

Changes to this policy

Changes will be announced on this page. If the kinds of information sent or their purposes are extended, the app will also make this visible.

Contact

For questions about this policy, please use the contact form.