Film Buddy Privacy Policy

Version 1.0 — Effective July 9, 2026

Official online copy: https://filmbuddyapp.com/privacy

This Privacy Policy explains how Film Buddy LLC ("Film Buddy," "we," "us," or "our") handles information in the Film Buddy macOS application and information you choose to send for support. The Website and support data section of the official online copy separately describes the public website's audited hosting, forms, storage technologies, and service providers.

The short version

Film Buddy is a local-first photo application. The app does not transmit your imported photographs, RAW files, metadata, edits, recipes, ratings, exports, or usage activity to Film Buddy servers. Core image processing and storage occur on your Mac. The app has no Film Buddy account system, advertising, behavioral tracking, third-party analytics, cloud image processing, or automatic crash-log uploader.

Optional camera tethering may communicate directly with a supported camera over USB or your local IP network through a bundled camera SDK. This is local device communication, not an upload to a Film Buddy service. A proprietary camera SDK may perform operations that Film Buddy cannot independently inspect; the app does not configure an external Film Buddy endpoint for it.

If you choose a command that opens separate camera companion software, that software runs independently and is governed by its provider's own terms and privacy practices.

Film Buddy receives diagnostics, photographs, sidecars, or other attachments only when you deliberately export them and send them through a separate support channel.

Information the app handles locally

To provide the features you request, Film Buddy may read, generate, and store the following on your Mac:

• photographs and camera RAW or TIFF files you select, drop, or capture into a tether folder;
• source filenames and absolute paths, file size and modification date, file type, orientation and other decode metadata, and local file fingerprints;
• roll and session names, local image and job identifiers, frame numbers, ratings, color labels, favorites, and trash state;
• develop recipes, crops, rotations, film-base samples, color measurements, conversion and calibration data, approvals, and export history;
• generated previews, decoded or normalized working files, histograms, analysis files, and regenerable render caches;
• app preferences, cache-location choices, performance information, and local event or system logs; and
• for optional tethering, a camera model, connection type, SDK device identifier, command state, and capture destination. For a camera connected by local IP, the SDK identifier may be derived from the camera's MAC address.

These are operational identifiers used inside your local library. Film Buddy does not use them as advertising identifiers or to track you across apps or websites.

The app does not request access to Contacts, Calendars, Location Services, the microphone, or the Mac's webcam. Tethered-camera access is separate from webcam access. Film Buddy uses the files, folders, and connected camera you choose for the requested import, edit, export, cache, diagnostics, or tether operation.

Local storage and security

The default library location is:

~/Library/Application Support/Film Buddy/FilmBuddyLibrary

You can choose a different location for regenerable cache files. Originals may remain at the external paths you selected because Film Buddy currently references originals instead of copying them into the library.

Catalogs, recipes, logs, previews, decoded files, exports, and sidecars are ordinary local files and are not encrypted by Film Buddy. Their protection depends on macOS file permissions and security features you enable, such as device login security and disk encryption. No storage or transmission method can be guaranteed completely secure.

Diagnostics and support

Film Buddy writes local event logs and uses Apple's local unified logging and performance-signpost systems. Log entries can include image identifiers, filenames, absolute file paths, export activity, settings hashes, timing data, and error messages.

From Preferences, you can create a diagnostics ZIP in a location you choose. The ZIP contains the app's local logs and a text file with the generation time, app version, macOS version, and Mac chip model. Creating the ZIP does not send it anywhere. Review it before sharing because filenames and paths can reveal a Mac account name, folder layout, project names, or other personal information.

If you contact support, we may receive your contact details, message, and any files you voluntarily attach. We use that information to respond, troubleshoot, protect the service, and keep an appropriate support record. Support messages are retained for 30 days after receipt. Diagnostic archives and other technical attachments are retained for 90 days after receipt, then deleted or de-identified unless a longer period is required to resolve the matter, protect legal rights, or comply with law.

Providing support information is optional. Without a usable reply address and enough detail to understand the problem, we may be unable to respond or resolve it.

Support processing is mapped as follows:

• Contact details and communications come directly from you; they are used to respond and administer the support relationship under contract or pre-contract steps and our legitimate interest in reliable support. They are available to authorized Film Buddy personnel and Google Workspace and its subprocessors, and retained for 30 days after receipt.
• Technical attachments and diagnostics come directly from files you choose to send; they are used to reproduce, secure, and fix the reported issue under contract and our legitimate interest in product security and reliability. They are available to the same authorized recipients and retained for 90 days after receipt.
• Support processing may occur in the United States and other countries where Google Workspace and its disclosed subprocessors operate. Where a legally recognized transfer safeguard is required, Google Workspace's applicable data-processing terms and Standard Contractual Clauses, or another legally recognized transfer mechanism, apply.

Do not send photographs, diagnostics, or sidecars that you are not authorized to share. Remove sensitive files or information that support does not need.

Exports and sidecars

Film Buddy does not intentionally copy source EXIF, IPTC, or GPS metadata into the exported TIFF or JPEG. Every export contains output information such as an ICC color profile, and no software can promise that a file contains no metadata of any kind.

Optional export sidecars are enabled by default and are named after the full export filename with .filmbuddy.json appended. A sidecar can contain the local image ID, a source-file hash, absolute source and export paths, recipe and render settings, crop and analysis values, output details, and export history. Sharing a sidecar can therefore reveal a Mac username, folder layout, edit history, and a persistent fingerprint of the source file. Disable the sidecar option before export, or inspect and redact the JSON, when you do not want to share that information.

How we use information

Local information is used only on your Mac to perform the app functions you request, maintain your library and preferences, render previews and exports, verify outputs, communicate with a local camera, and diagnose local errors. Film Buddy does not receive or control that local information.

If you voluntarily contact us, we process the information we receive to:

• perform our contract with you or take steps you request before a contract, including providing support;
• pursue our legitimate interests in securing, debugging, and improving Film Buddy without overriding your rights; and
• comply with legal obligations or establish, exercise, or defend legal claims.

We do not use automated decision-making that produces legal or similarly significant effects about you. Film Buddy's deterministic image-analysis tools do not perform face recognition or biometric identification. Local approval and calibration records are not transmitted for model training.

Disclosure, sale, sharing, and tracking

The app does not automatically disclose local library content to us, data brokers, advertisers, or analytics providers. We do not sell personal information, share it for cross-context behavioral advertising, or track app users across third-party apps or websites.

Local processing may involve Apple operating-system frameworks and bundled decode or camera components identified in Third-Party Notices. They operate as part of the local app workflow. The support providers named above are required to protect support information consistently with this policy and applicable law.

Apple may independently process App Store purchases, downloads, crash reports, or app analytics under your device and App Store settings. Apple controls that processing; consult Apple's privacy information and your device settings. We will update this policy if we enable receipt of Apple-provided diagnostic or analytics reports.

We may disclose support information if reasonably necessary to comply with law, protect rights or safety, investigate abuse, complete a corporate transaction subject to appropriate safeguards, or work with a provider that helps us deliver support, including the providers identified in the support-processing section above.

Retention and deletion on your Mac

Local library data remains until you remove it. Moving a frame to Film Buddy's Trash marks it as trashed but does not erase it. Removing a frame from the library deletes Film Buddy's catalog rows, recipes, analysis, previews, and cache for that frame while preserving the referenced original. Clearing the cache deletes regenerable previews and decoded masters. For film negatives it also deletes saved develop-recipe rows and recipe sidecars, negative analysis, film-base and manual-base defaults, and resets every film-negative frame to Import. White balance, crop, Convert, and saved edits for those negatives must then be redone. It does not delete referenced originals or external exports.

Regenerable preview and decode caches may also be evicted automatically when configured memory, disk, or cache budgets require it. Other source-of-truth catalog data remains until you remove it or delete the library, subject to the destructive Clear Cache behavior described above.

Exports, sidecars, diagnostics ZIPs, macOS unified logs, preferences, and files outside the library must be removed separately. Uninstalling the app may leave Application Support data and preferences behind. See the bundled Local Data & Diagnostics Guide for exact locations and deletion steps.

Because we cannot access your local library, a privacy request sent to us cannot retrieve or erase data that never left your Mac. You control that data with the app, Finder, your backups, and macOS account tools.

Your privacy rights

Depending on where you live and whether we hold information you voluntarily sent, you may have rights to request access, correction, deletion, restriction, portability, or an objection; to withdraw consent where consent is the basis; and to complain to your local data-protection authority. California residents may also have rights to know, correct, or delete covered information and to be free from discrimination for exercising privacy rights. We do not sell or share covered personal information for behavioral advertising.

Submit a request to hello@filmbuddyapp.com. We may need proportionate information to verify the request. These rights can be limited by applicable law. If we do not hold information about you, we will say so.

International support transfers use the countries and mechanism identified in the support-processing section above.

Children

Film Buddy is a general-audience creative tool and is not directed to children under 13. The app does not send local image content to us. We do not knowingly collect personal information online from children under 13. If we learn that a child submitted personal information through support or the website, we will delete it and may ask a parent or guardian to contact us.

Changes to this policy

We may update this policy to reflect a changed app, website, law, or service provider. We will change the effective date, publish the current version on the Film Buddy privacy page, and provide additional notice when required. Material changes will not retroactively reduce your rights without a valid legal basis.

Contact

• Controller: Film Buddy LLC
• Privacy: hello@filmbuddyapp.com
• Support: hello@filmbuddyapp.com
• Website: https://filmbuddyapp.com

---

Website and support data

This section covers information that Film Buddy LLC receives through https://filmbuddyapp.com, the early-access waitlist, beta accounts, beta downloads, and support. It is separate from the app data described above: Film Buddy cannot see a local Film Buddy library, photographs, recipes, or exports unless you deliberately send material through a separate support channel.

The current invitation-only beta is offered and targeted only in the United States. It is not offered or targeted to users in the European Union or United Kingdom.

Website delivery and request logs

The website is a Next.js site deployed on Vercel. Production server functions are configured for Vercel's iad1 region. GoDaddy provides authoritative DNS, and the deployed site uses a Let's Encrypt TLS certificate. When a browser requests a page or asset, Vercel and the site's delivery infrastructure necessarily receive request information such as the IP address, date and time, requested URL, response status, referrer when supplied, and browser or device headers. Film Buddy uses this information to deliver the site, maintain availability, diagnose errors, and protect the site from abuse. The EU/UK legal basis is Film Buddy's legitimate interest in operating and securing the website.

Vercel is the hosting, deployment, edge-delivery, and request-log provider; GoDaddy is the DNS provider. The current Vercel Hobby plan retains runtime logs for one hour. Vercel retains build logs with their deployments indefinitely; Film Buddy has not configured a separate log drain or backup archive. Vercel's primary processing facilities are in the United States, while Vercel and its subprocessors may process data in the United States and other countries where they operate. Where an international transfer safeguard is required, Vercel's applicable terms provide the EU Standard Contractual Clauses and UK transfer terms. See Vercel's runtime-log retention documentation and Data Processing Addendum.

Early-access waitlist

The early-access form asks for name, email address, scanning workflow, source format, approximate monthly roll volume, an optional note, and an affirmative choice to receive early-access updates. The submission also records its time, the page referrer when the browser supplies one, browser user-agent string, and an internal status. A hidden anti-spam field may be evaluated and discarded.

The waitlist endpoint requires same-origin browser submissions, limits request size, and applies a best-effort bound of five attempts per ten minutes on each running server instance. For that bound, it holds only an HMAC-SHA256 digest of the forwarded IP address in ephemeral process memory for the remainder of the ten-minute window; this code does not persist the raw IP or send that digest to the Google Sheet. Because Vercel may run multiple instances, the bound is not a global rate-limit guarantee. Normal hosting request logs remain governed by the separate Vercel disclosure above.

The production website sends accepted submissions from Vercel through a private Google Apps Script endpoint into the Film Buddy Waitlist Google Sheet. That linkage was operationally verified from accepted submissions originating at filmbuddyapp.com. Film Buddy uses an operational submission to manage early access, understand whether the beta fits the requested workflow, and send the updates requested. The EU/UK legal bases are consent for requested email updates and Film Buddy's legitimate interest in administering the beta. You may withdraw from updates at any time by emailing hello@filmbuddyapp.com.

Waitlist records are retained until 12 months after the person's last interaction with Film Buddy or the end of the beta, whichever is later, unless the person requests earlier deletion where applicable. Google is the Apps Script and Sheets provider. Google may store or process data in the United States and other countries where Google or its subprocessors maintain facilities. Google's applicable Cloud Data Processing Addendum provides the EU Standard Contractual Clauses and other legally recognized transfer mechanisms where required.

Beta accounts, access codes, and downloads

Supabase provides authentication, database, and private build storage for the beta portal from a primary project region in U.S. West (us-west-2). Account records include an email address, optional name, Supabase user identifier, account and update timestamps, role, beta status, and beta approval metadata. Supabase handles password credentials and authentication email flows and may retain authentication-session IP address and user-agent information in its Auth systems. Supabase Auth sends account-confirmation and password-reset messages through Resend SMTP, operated by Plus Five Five, Inc. The verified filmbuddyapp.com sending domain uses Resend's North Virginia (us-east-1) region. Resend stores account data, email metadata, logs, and API records in the United States and documents a 30-day email-data retention period for standard plans. Open and click tracking are disabled for the domain. Film Buddy has not configured Resend receiving, templates, or webhooks. Resend's Data Processing Addendum, Privacy Policy, and region documentation describe its processing, subprocessors, and applicable transfer safeguards.

Account creation requires an access code issued through Film Buddy's admin console. Film Buddy stores only a SHA-256 hash of the code, never the plaintext, along with an optional admin label, optional lowercased intended-email restriction, optional expiration, creation time and administrator identifier, and any use or revocation time and user or administrator identifier. The signup action hashes the submitted code before sending it to Supabase. The signup trigger uses the hash to redeem the code atomically, then removes that hash from the Auth user's general metadata in the same transaction. It does not record an IP address or browser or device data for the access-code check. The plaintext is shown once to the generating administrator and is not recoverable from the admin page after refresh.

The portal records allowed and denied download attempts with the user identifier, event type and time, IP address, browser user-agent string, and limited details such as a denial reason. It includes the build identifier when a candidate build has been identified. Before an allowed download, it also records affirmative App EULA acceptance, including the EULA version and effective date and checksum; the user and build identifiers; the build version, filename, storage path, byte size, and SHA-256 checksum; the timestamp and transaction identifier; the Storage object and version identifiers; the IP address; and the browser user-agent string. The app file remains in a private Supabase Storage bucket and an approved account receives a short-lived signed download URL only while those immutable object identifiers still match.

Film Buddy uses account, entitlement, EULA-acceptance, and download records to authenticate users, administer and secure beta access, deliver requested builds, document the applicable agreement, investigate abuse, and maintain an appropriate release record. The EU/UK legal bases are contract or steps taken at the user's request before contract, compliance with legal obligations where applicable, and Film Buddy's legitimate interests in access control, software security, and agreement records.

Account and entitlement records are retained while the account is active. After an account-deletion request, ordinary residual account information is deleted within 30 days, except for security, agreement, or legally required records governed by a longer period. Access-code records are retained for 12 months after the code is used, expires, or is revoked. EULA-acceptance and download-event records are retained for three years after the associated beta download or account closure, whichever is later. Supabase is the authentication, database, and storage provider. The Film Buddy project and its database are hosted in AWS U.S. West (Oregon), us-west-2. Supabase and its infrastructure and support subprocessors may also process limited service data in the United States and other countries where they operate. Where required, Supabase's Data Processing Addendum provides the EU Standard Contractual Clauses, UK transfer terms, and other applicable lawful transfer mechanisms.

Support and privacy requests

The public website does not currently provide a support upload or contact form. Domain mail records route the support mailbox through Google. If you email Film Buddy, we receive the reply address, message, email-routing metadata, and anything you choose to attach. Do not send photographs, diagnostics, sidecars, credentials, or other sensitive material unless it is necessary and you are authorized to share it. Creating a diagnostics ZIP in Film Buddy does not upload it.

Support messages are retained for 30 days after receipt; diagnostics and technical attachments are retained for 90 days after receipt. Google Workspace and its subprocessors provide the support mailbox. Processing occurs in the United States and other countries where Google Workspace and its disclosed subprocessors operate. Transfers use Google Workspace's applicable data-processing terms and Standard Contractual Clauses, or another legally recognized transfer mechanism.

Film Buddy cannot retrieve, correct, or erase a Film Buddy library that never left a user's Mac. A request can cover only the website, account, waitlist, download, EULA, or support information Film Buddy and its providers actually hold.

Audited website provider inventory

Payments, analytics, advertising, and embedded services

The audited launch code does not contain a checkout or payment processor. It does not load third-party analytics, advertising, chat, CAPTCHA, remote browser fonts, maps, videos, or social-media embeds. It does not use behavioral profiling or automated decision-making that produces legal or similarly significant effects.

Film Buddy does not sell personal information, share it for cross-context behavioral advertising, or use website data for targeted advertising. The site does not respond differently to browser Do Not Track signals because it does not perform the nonessential tracking those signals are intended to control. The same is true for legally recognized opt-out preference signals in the current no-sale, no-share configuration. If that configuration changes, Film Buddy must update this notice and implement any required choice before the new technology loads.

Cookies and browser storage

The public marketing and legal pages do not set nonessential cookies or local storage in the audited launch code. A clean signed-out audit of the homepage, login, and signup routes found no cookies, local storage, session storage, IndexedDB, Cache Storage, or service worker. Supabase authentication uses strictly necessary session and verification cookies on authentication and account flows. They keep a user signed in, complete email-link flows, rotate sessions, and protect gated routes. See the Cookie and storage notice for the current inventory and controls. No consent banner is shown while only strictly necessary technology is used.

Recipients, international transfers, and security

Website information is available only to authorized Film Buddy personnel and the providers identified above for the stated purposes. It may also be disclosed when reasonably necessary to comply with law, protect rights or safety, investigate abuse, or complete a business transaction subject to appropriate safeguards.

Film Buddy uses access controls, private build storage, short-lived download links, encrypted transport, server-side authorization checks, and provider security controls appropriate to the website's current role. No system can be guaranteed completely secure. The countries, retention periods, and transfer mechanisms still shown as double-brace release markers must be approved before production publication.

Rights and requests

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive covered personal information; object to processing; withdraw consent where consent is the basis; and appeal a denied request or complain to a data-protection authority. Film Buddy accepts privacy requests from any user without requiring a California eligibility determination. The business has not represented that it meets California statutory threshold tests, and it does not sell or share covered information for behavioral advertising.

Email hello@filmbuddyapp.com with enough detail to identify the relevant account, waitlist entry, download, or support record. Film Buddy may request proportionate verification and will explain any lawful limitation or appeal route that applies. Withdrawing early-access email consent does not affect processing already performed lawfully and does not require deleting a security or agreement record that must be retained on another legal basis.

General audience and policy changes

The website and beta portal are general-audience services and are not directed to children under 13. Film Buddy does not knowingly collect online personal information from children under 13. If it learns that a child submitted personal information, it will delete it and may ask a parent or guardian to contact Film Buddy.

Material changes to website practices will be reflected here with a revised version and effective date, and additional notice or renewed agreement will be provided when required.