Privacy Policy

Effective Date: October 16, 2026

Cachepics LLC, a Wisconsin limited liability company

This Privacy Policy explains how Cachepics LLC (“we,” “us,” or “our”) collects, uses, discloses, retains, and protects information when you download, access, or use the cache•shots mobile application (the “App”), visit pages we control used in connection with the App, communicate with us, or otherwise use our photo-capture, event-album, printing, fulfillment, digital-negative, and related services (collectively, the “Services”).

Please read this Privacy Policy carefully. If you do not agree with it, do not use the App or Services. This Privacy Policy should be read together with the Terms of Service and Mobile Application End User License Agreement. It does not govern third-party websites, applications, or services that we do not control, even if accessible through the App.

1. Quick Summary

• The App is a live-capture “disposable camera” app. We arrange printing and delivery of physical 4 × 6 prints, and eligible digital negatives become available after delivery is confirmed.
• The App does not currently import photographs from your device photo library, collect precise geolocation through a location feature, or provide push notifications. On iOS, the App may ask for notification permission solely to show a count on the App icon. It does not send push notifications.
• Payment checkout is hosted by Stripe. We do not receive or store your full payment-card number.
• Photographs are stored in private cloud storage, screened against known child sexual abuse material when uploaded and for other prohibited content before printing, and sent to a print-fulfillment provider only when needed to produce an order.
• We do not use, or authorize our service providers to use, photographs to train artificial-intelligence or machine-learning models.
• Promotional use of eligible solo-roll photographs is opt-in, off by default, may occur only after we confirm or reasonably determine that the applicable prints have been delivered, and does not apply to event photographs.

2. Scope and Roles

This Privacy Policy applies to information we process as a business or controller. Some service providers process personal information on our behalf, while certain providers, including payment networks, financial institutions, shipping carriers, app stores, and governmental authorities, may independently determine how they process information for their own purposes. Their privacy notices govern that independent processing.

The App and Services are intended for users in the United States who are at least 18 years old. Physical fulfillment is currently available only for eligible United States shipping addresses.

3. Information We Collect

3.1 Information You Provide

3.2 Information Collected Automatically

• Usage and service records, including event and roll records, timestamps, feature interactions, order status, and operational records needed to provide the Services.
• Device and technical information, which may include device type, operating-system and App version, browser type, language, network information, crash data, diagnostic information, and server logs.
• IP addresses and related approximate location information generated through ordinary internet communications and maintained by infrastructure, hosting, content-screening, payment, or security providers. We do not derive precise location from IP addresses and the App does not currently collect precise geolocation through a location feature.
• Security and audit information, including authentication attempts, administrative actions, account changes, fraud signals, content-safety records, and internal identifiers.

3.3 Information We Do Not Intentionally Collect

• Precise geolocation through an App location feature.
• Contacts or address-book information.
• Photographs from your device photo library.
• Full payment-card numbers or card security codes on our systems.
• Protected health information for purposes of providing a regulated health service.

Photographs may incidentally reveal sensitive characteristics or information. Do not submit information that is unnecessary for the Services. We process submitted photographs to provide the Services, conduct safety screening, fulfill orders, and comply with law.

4. How We Use Information

• Provide, operate, maintain, personalize, and improve the App and Services, including account creation, authentication, rolls, events, printing, shipping, digital-negative access, customer support, refunds, and reprints.
• Process transactions, calculate applicable taxes, detect fraud, reconcile payments, and maintain financial and order records.
• Screen photographs, handles, and event names for prohibited or unlawful content; prevent abuse; enforce the Terms; investigate incidents; and protect users, us, providers, and the public.
• Send service, security, account, order, delivery, policy, and support communications. These transactional communications are necessary to provide the Services.
• Maintain, troubleshoot, test, secure, analyze, and improve the App, infrastructure, workflows, user experience, and business operations.
• Comply with legal obligations; respond to valid legal process; preserve records; make required reports; establish, exercise, or defend legal claims; and enforce agreements.
• Use eligible solo-roll photographs for promotion, subject to the Terms of Service, only when you have affirmatively enabled the promotional-use setting and after we confirm or reasonably determine that the applicable prints have been delivered.
• Create aggregated or deidentified information and use it for lawful operational, security, analytical, and service-improvement purposes. We will maintain deidentified information in deidentified form and will not attempt to reidentify it except as permitted by law.

5. How We Disclose Information

We disclose personal information only as reasonably necessary for the purposes described below, at your direction, with your consent, or as otherwise permitted or required by law.

Some recipients, such as financial institutions, payment-method providers, shipping carriers, and authorities, may act as independent controllers for aspects of their processing. We do not control their independent practices.

6. Photographs, Events, and Promotional Use

6.1 Private Storage and Printing

Photographs are stored in private storage and are not publicly accessible through the App. Eligible solo-roll photographs may, however, be used for promotion if you opt in as described in Section 6.4. We provide photographs to our screening and fulfillment providers only as needed for the purposes described in this Privacy Policy. Print providers may receive print-resolution photographs through time-limited access mechanisms.

6.2 Screening and Withheld Photographs

Photographs are screened using automated tools: Microsoft PhotoDNA compares image hashes against known child sexual abuse material when a photograph is uploaded, and Google Cloud Vision SafeSearch screens for other prohibited content before printing. A photograph that has not been screened is not printed. If a photograph is flagged or otherwise prohibited, we may withhold it from printing, display a placeholder in the gallery, provide an applicable replacement shot, account credit, or refund, review related records, restrict or suspend an account, preserve information, and make reports as required by law.

6.3 Event Photographs

When you participate in an event, photographs you capture become part of the event roll, and the event host receives physical prints of participants’ photographs. After the host confirms delivery of the event’s prints, the host, rather than an individual participant, may access the event’s digital negatives. We cannot control how the event host uses or shares physical prints or digital negatives after receiving them. Do not capture or submit a photograph to an event unless you understand and accept that sharing arrangement and have the rights and permissions required by the Terms.

6.4 Promotional Use

Promotional use is opt-in and disabled by default. If you enable the promotional-use setting, only otherwise eligible photographs from solo rolls captured while the setting is enabled may be considered for promotion after we confirm or reasonably determine that the applicable prints have been delivered. Event photographs are never used for promotion. We maintain records of opt-in and opt-out choices and promotional uses. You may opt out at any time, which stops new promotional use, but materials already published may remain as described in the Terms of Service.

6.5 Our Use of Photographs for Model Training

We do not use, or authorize our service providers to use, your photographs to train artificial-intelligence or machine-learning models. Our use of automated image-analysis services for safety screening is not authorization to use your photographs for model training.

7. Child Safety and Legally Required Reporting

We have zero tolerance for child sexual abuse material (“CSAM”). If we identify or obtain actual knowledge of apparent CSAM or related facts or circumstances, we may preserve relevant content and records, suspend or terminate accounts, restrict access, and report to NCMEC and/or law enforcement as required by applicable law, including 18 U.S.C. § 2258A. Legal preservation and reporting obligations may require us and our providers to retain records after account closure or despite a deletion request.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining security, complying with legal, tax, accounting, reporting, and preservation obligations, resolving disputes, processing refunds or reprints, and enforcing agreements. Retention depends on the type of information, the context in which it was collected, and applicable legal requirements.

8.1 Active and Inactive Accounts

We generally retain account information while an account remains active. If an account is inactive for an extended period, currently six months, we may schedule the account and associated data for deletion, provided that we will not delete the account or associated digital negatives before the applicable availability period described in Section 8.2 has expired. We will send notice to the email address associated with the account at least 30 days before deletion. Signing in again during the warning period cancels scheduled deletion. Accounts subject to a legal hold or safety preservation are not deleted while the hold applies.

8.2 Digital Negatives

Digital negatives are available for a limited period after you confirm delivery of your prints, currently six months. After that period, stored image files may be permanently deleted. Users who confirmed delivery while our placeholder Terms of Service and Privacy Policy stated a 12-month period will retain a 12-month availability period for the digital negatives associated with those confirmed deliveries. For an event, if the host never confirms delivery of the event’s prints, the event’s digital negatives are deleted 12 months after the event ends. For a roll, if you never confirm delivery, its digital negatives are deleted 12 months after it ships. You should save any photograph you wish to keep before the applicable availability period ends. Deletion of digital files does not affect physical prints.

8.3 Orders and Provider Retention

We may retain order records without image files for customer service, disputes, fraud prevention, taxes, accounting, warranties, and compliance. We keep only the state and ZIP code of your shipping address with your order record. The full address is passed to our print provider to ship your order and is not kept in our database, except briefly while an order is waiting to be sent to our print provider. Prodigi and its providers may retain production files for the time reasonably necessary for production, quality control, reprints, and support, and retain order, shipping, support, log, and financial records for their applicable business and legal retention periods. Stripe, Supabase, and other providers may retain information as required to deliver their services, satisfy legal obligations, resolve disputes, or complete ordinary backup-deletion cycles.

8.4 Account Deletion and Information That Survives

You may delete your account as described in Section 9. When you delete your account, we delete your account profile, your handle, your rolls, and the associated digital negatives, except as described below and except for information we retain as permitted or required by law.

• Order and consent records. We retain a minimal order record, which includes only the state and ZIP code of the shipping address, for tax, refund, accounting, and dispute purposes, and retain your promotional-use consent record.
• Handles. Because handles are printed on physical prints, your handle is permanently retired when your account is deleted and cannot be claimed or reused by any other user. Once set, a handle can only be changed by us. A handle that is replaced is permanently retired in the same way.
• Photographs contributed to another user’s event. Photographs you captured for another user’s event remain part of that host’s event album and prints, but our records no longer associate those photographs with you. Where your handle was printed into a bordered print, it remains on the host’s copy and in the host’s digital negatives until those negatives expire under Section 8.2.
• Hosts and events. When a host deletes their account, the host’s events are deleted in the same way as the host’s own rolls. Orders already in production at the time of deletion will still be produced and shipped.
• If you delete your account while an order is in production or in transit, we close your account immediately and complete the deletion 30 days after the order ships (and no later than 90 days after your request), so a lost or damaged shipment can still be reprinted.

Deletion is subject to the legal-hold and safety-preservation exceptions described in Sections 7 and 8 and to the provider backup-deletion cycles described in Section 8.3.

9. Your Choices

• Account information. You may review and update available profile information through the App.
• Account deletion. You may initiate account deletion within the App. You may also contact support@cacheshots.com for assistance. Deleting your account will permanently delete the digital negatives and other personal information associated with your account, except for information we retain as required or permitted by law for legal compliance, safety, security, fraud prevention, dispute resolution, financial recordkeeping, or other purposes described in this Privacy Policy. You should save any photograph you wish to keep before requesting deletion. Certain information survives account deletion as described in Section 8.4, including a minimal order record, your promotional-use consent record, your retired handle, and photographs you contributed to another user’s event. Delayed deletion for an order in production or in transit is described in Section 8.4. We will inform you if additional time is required to complete the deletion process.
• Promotional use. You may enable or disable promotional use in your account settings. It is off by default.
• Communications. You may unsubscribe from nonessential marketing messages using the link provided or by contacting us. You cannot opt out of necessary transactional, account, security, policy, order, or support communications while using the Services.
• Device permissions. You may manage camera and other App permissions through your device settings. Disabling a required permission may prevent the App or a feature from functioning.
• No location controls currently needed. On iOS, notification permission is used only for the App icon badge and can be turned off in device settings. The App does not currently collect precise geolocation through a location feature or send push notifications.
• Do Not Track and opt-out signals. Because we do not engage in cross-context behavioral advertising or sell personal information, browser “Do Not Track” settings and universal opt-out signals do not change our current practices. We will recognize legally required opt-out preference signals if our practices change in a manner that makes them applicable.

10. U.S. State Privacy Rights

Depending on your state of residence and subject to applicable thresholds, definitions, and exceptions, you may have rights to confirm whether we process your personal information; access it; correct inaccuracies; delete it; obtain a portable copy; obtain information about categories of information and recipients; opt out of sales, targeted advertising, or certain profiling; limit or withdraw consent for certain sensitive-information processing; and appeal a decision on a privacy request.

We do not sell personal information, share personal information for cross-context behavioral advertising, process personal information for targeted advertising, or profile users in furtherance of decisions producing legal or similarly significant effects. We do not offer financial incentives for personal information.

10.1 Submitting a Request

Submit a request by emailing support@cacheshots.com with “Privacy Request” in the subject line or through any request mechanism made available in the App. Describe the right you wish to exercise and provide information reasonably necessary to identify your account and verify your request. We will use information provided for verification only to process the request. You may use an authorized agent where applicable, but we may require proof of authorization and verification of your identity. We will not discriminate against you for exercising a privacy right.

10.2 Appeals

If we deny a request, you may appeal by emailing support@cacheshots.com with “Privacy Appeal” in the subject line and explaining why you believe the decision should be reconsidered. We will respond within the period required by applicable law and, where required, provide information about contacting the appropriate regulator or attorney general.

10.3 California Disclosures

California residents may have rights under the California Consumer Privacy Act, as amended. The categories we collect or may collect, and may have collected during the preceding 12 months, generally include identifiers; customer records; commercial information; internet or other electronic network activity; photographs and other user content; approximate location inferred from IP address; and inferences or safety classifications generated to operate and protect the Services. We collect, use, retain, and disclose these categories for the business purposes described in this Privacy Policy. We do not knowingly sell or share the personal information of consumers under 16 and do not use or disclose sensitive personal information for purposes requiring a right to limit under California law. We do not disclose personal information to third parties for their own direct marketing within the meaning of California’s Shine the Light law.

11. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. Measures may include, as appropriate to the relevant systems and information, private cloud storage, encrypted connections, server-side handling of secrets, access controls, role-based administrative permissions, email one-time-passcode authentication for administrative access, audit logging of administrative actions, monitoring, backups, and vendor security controls. Payment-card information is processed through Stripe-hosted checkout rather than our systems.

No security measure, transmission method, or storage system is completely secure. We cannot guarantee absolute security. You are responsible for protecting access to your email account and device and for promptly notifying us if you suspect unauthorized account access.

12. Children

The App and Services are intended only for individuals 18 years of age or older and are not directed to children. We do not knowingly collect personal information directly from children. If you believe a child has provided personal information to us, contact support@cacheshots.com. We may request information necessary to investigate and take appropriate action. This section does not limit our child-safety screening, preservation, or reporting obligations.

13. International Processing

We currently serve United States customers, and primary App data at rest is hosted in the United States. We nonetheless use providers with group companies, personnel, infrastructure, subprocessors, or contractual entities in other countries. Supabase’s contracting entity is in Singapore, although our App data is configured for United States hosting. Prodigi is a United Kingdom company and may use group companies, technology providers, production partners, fulfillment partners, and logistics providers in the United States and other countries. Stripe and other providers may process information globally as needed to provide services. Accordingly, personal information may be transferred to or accessed from jurisdictions outside your state or country, subject to applicable safeguards.

14. Third-Party Services and External Links

Your use of Apple, Google Play, Stripe-hosted checkout, payment methods, carrier services, or third-party websites or services may be governed by those parties’ separate terms and privacy notices. We are not responsible for the privacy practices of unaffiliated third parties acting independently. Review their notices before providing information directly to them.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Effective Date” identifies the current version. If we make a material change, we will provide notice as required by law, which may include email or an in-App notice. If applicable law requires affirmative consent for a materially different use or disclosure, we will request that consent before applying the change to previously collected information.

16. Contact Us

Cachepics LLC

Address: Cogency Global, 100 Wilburn Road, Suite 100, Sun Prairie, WI 53590

Email: support@cacheshots.com

Website: https://cacheshots.com

For privacy requests, include “Privacy Request” or “Privacy Appeal,” as applicable, in the email subject line.