Privacy policy

Last updated: September 30, 2026

Throwable is a shared photo album app where photos stay hidden until a reveal date. This page explains what data we process, why, and what your rights are.

Who is responsible for your data

Throwable is published by Luke Montgomery, 1 allée de Charlary, 31180 Rouffiac-Tolosan, France. For any question about your data: contact@throwable.app.

The data we process

Your account: email address (or your Apple or Google ID if you sign in with them), display name, @username, bio, profile and cover photos, app language. A guest account has no email until it is converted.
What you post: photos, videos, captions, comments, reactions, votes, tags, completed challenges, letters.
Your connections: albums you belong to, friends, friend requests, dismissed suggestions, blocked people, private messages.
Your contacts, only if you allow it: to find your friends, the app computes an encrypted fingerprint (SHA-256) of phone numbers and email addresses on your phone, and only those fingerprints are compared with Throwable accounts. Neither your contacts nor their fingerprints are stored. You can also turn off “Find me via my contacts” in the settings.
Your town, only if you allow it (Throwable+): your phone’s location is used to find the town and weather printed on the photo. Only the town name and the weather are stored, never your exact location.
“On site only” albums: when you open the camera of such an album, your phone’s location is sent once to check that you are inside the area its creator chose. It is never stored: only a 45-minute permission to take photos is kept.
Notifications: if you accept notifications, we store your phone’s notification token (Apple or Google) to send them to you. It is deleted when you sign out. You can turn notifications off in the app settings.
Your reports: the reported content, the reason and the details you write.
Technical data: connection and error logs kept by our host to run and secure the service.

Throwable shows no ads, does not sell your data and uses no advertising trackers.

Why we use it

To provide the service: create your albums, hide then reveal photos to members, manage your friends, messages, the daily mission and town challenges, and suggest friends. Legal basis: performance of the contract (our terms of use).
To send you notifications (new photos, messages, friends, an album revealing soon, the daily mission, your town’s podium). Legal basis: your consent, which you can withdraw at any time.
To keep the service safe and moderate it: handle reports, remove prohibited content, suspend accounts that break the rules, meet legal obligations. Legal basis: our legitimate interest and legal obligations.

Who can see your content

In a private album, only its members see the photos and captions, and only after the reveal. Even the author of a photo can’t see it before.
A public album, including town challenges, is visible to every Throwable user after its reveal, photos and captions included.
Daily mission photos are visible to your friends who played that day, after 8 pm.
A photo you are tagged in only appears on your profile if you accept the tag.
Your name, @username and profile and cover photos are visible to people you share an album with, your friends, people you are suggested to, and everyone if you have posted a public album.
Throwable moderators can see content that has been reported, in order to handle it.

Our service providers

Supabase hosts the database, accounts and files (photos, videos) in the European Union (Ireland).
Apple and Google, if you choose to sign in with them, and to deliver notifications (Apple Push Notification service, Firebase Cloud Messaging).
Open-Meteo and Photon (Komoot) receive approximate coordinates to find the weather and the town, only if you use that option.
Netlify hosts this website.

How long we keep it

Your account and content are kept as long as your account exists.
When you delete a photo or an album, it disappears from the app immediately; the files are then erased from our servers within 30 days.
When you delete your account (Profile → Settings → Delete my account), your profile, photos, videos, captions, comments, friends and messages are erased. Albums you created are handed over to another member, or deleted if you were alone.
The history of sent notifications is kept for 30 days.
Reports are kept for one year after they are handled.

Your rights

You can access, correct or delete your data, object to its processing or request a copy by writing to contact@throwable.app. Most of these actions can also be done directly in the app. You can lodge a complaint with the CNIL, the French data protection authority (cnil.fr), or with your local authority.

Minimum age

Throwable is for people aged 15 and over.

Changes

If this policy changes significantly, we will let you know in the app.