Privacy Policy
Hollowfield Institute Last updated: 12 August 2026
Written in plain English on purpose. Where something is a legal term it's explained rather than left to do the work.
The short version
- The app works with no account. The field guide, the archive, the camera and
your record book need nothing from you.
- Your photographs stay on your phone unless you choose to enter one for
review.
- We never ask for your email address, and we don't have one.
- There is no advertising, no tracking, and no analytics.
What we collect, and only when
If you never sign in
Nothing leaves your device except when you make a photograph.
Your location, if you allow it. This shows the legends nearest you and tunes the daily bulletin. Requested only while the app is open, never in the background. Before anything is stored it is rounded to roughly a one-kilometre grid, so a saved location is a place, not an address. If you don't grant it, the app works with a national bulletin instead.
Your photograph, when you make an exposure. Sent to our server, then to two third parties (below), and returned to you. We do not keep the photograph. The finished image is stored on your device.
If you sign in
Sign in with Apple is optional, and only needed to enter work for review or to back other members' filings.
We ask Apple for your name and nothing else. We do not request your email. Apple gives us an anonymous identifier for your account; we store that, the name you choose to display, your rank, your badges, and the list of entries you've documented. That's what lets your record survive a new phone.
If you enter a photograph for review
A copy is uploaded so other members can see and back it. That copy:
- is screened by automated moderation before anyone can see it,
- is stored in a private bucket and served only through short-lived links,
- is deleted after 90 days,
- can be withdrawn by you at any time, which deletes it immediately.
Your own copy stays on your device throughout. Withdrawing or expiry never touches it.
Who else sees your photographs
Two services, for two specific jobs. Neither is given your name, your account, or your location.
Google (Gemini) generates the composited image. Your photograph is sent, the result comes back. Governed by Google's API terms.
Sightengine does automated content moderation. Every image is screened before generation and again before publication, to keep explicit content off a feed other people can see.
Supabase hosts our database, storage and server functions.
We don't sell data, and we don't share it with anyone else.
What we log
When an image is screened we record the outcome, along with your account identifier: which stage it was, whether it passed, and the category if it didn't. We keep this to check our own filters aren't wrongly rejecting ordinary photographs. The image itself is not stored in that log.
Your choices
Location. Turn it off in iOS Settings at any time. The app keeps working.
Withdraw a submission. Open it and choose withdraw. Removed immediately.
Delete your membership. In Settings. This deletes your profile, your submissions, your badges and your documented list. Photographs on your device are yours and are not affected; delete them in the app if you want them gone.
Use the app without an account. Always available.
Children
The app isn't directed at children. If you photograph other people, including children, only enter that photograph for review if everyone in it is happy for it to be public. The app asks you to confirm this each time.
If you believe a child's photograph has been shared without consent, contact us at the address below and we will remove it.
Purchases
Film purchases are handled by Apple. We never see your payment details. We receive confirmation that a purchase happened so we can credit your account.
Changes
If this policy changes materially we'll say so in the app before the change takes effect.
Contact
For anything about your data, a submission you want removed, or a report about another member's content.
One clarification
The Hollowfield Institute is fictional. The 1953 founding, its members and its archive are invented, and the app says so on first launch. This privacy policy is not fiction. It describes exactly what the software does.