Privacy Policy

Proof is built to do one thing: lay your photographs out as a contact sheet so you can look at them, mark them up, and print the proof. It does that on your device. It has no accounts, it does not build a profile of you, and it never sends your photographs, your marks, or your notes to us or to anyone else.

This policy explains what that means in practice: what stays on your device, what lives in your own iCloud, the one anonymous count the app keeps and how to turn it off, and the few places Apple handles data on your behalf.

In this policy, "we," "us," and "Proof" refer to Straylight Orbital LLC / Mark Strayer, the developer of the Proof app. "You" means the person using the app.

The short version

• Your photographs never leave your device through Proof. The app reads the folders you point it at and writes its sidecar files beside your originals. We don't operate servers that receive your images, and we never see them.
• Your marks and notes are stored on your device and, if iCloud is on for Proof, in your own iCloud account so they follow you between your devices. We cannot read that container.
• Proof keeps an anonymous tally of which parts of the app get used. It is a list of event names with fixed labels. No file names, no notes, no photos. You can turn it off in Settings → Usage data.
• We don't use advertising or tracking SDKs, we don't track you across other apps or sites, and we don't sell or share personal information, because we don't collect it.

Your photographs

You open a roll by choosing a folder through the system file picker. Proof reads the RAW and JPEG files in that folder to lay out the sheet, decodes previews for display, and keeps a cache of those previews on your device so a roll opens quickly the next time. That cache stays on the device and you can clear it in Settings.

When you mark up a roll, Proof writes small files next to your originals: a .proof sidecar that identifies the roll, XMP sidecars carrying your pick and reject decisions so Lightroom and Capture One can read them, and, when you export, _notes-suffixed reference JPEGs. These are your files, in your folders, under your control. Proof never modifies an original.

If you save an exported contact sheet or print to your photo library, iOS asks for add-only permission. Proof uses that permission only to save the image you asked it to save. It does not read your photo library.

Marks, notes and iCloud

Your wax-pencil marks and notes are stored on your device as plain files. If iCloud is enabled for Proof, the app also keeps a copy in the app's iCloud container so the same marks appear on your other devices. That container is part of your personal iCloud account. It is not transmitted to us, and we have no ability to read, access, or recover it. Apple's handling of your iCloud data is governed by Apple's Privacy Policy. You can turn iCloud off for Proof at any time in iOS Settings.

Usage data

Proof keeps a small, anonymous tally of which parts of the app get used, so we know what to improve. This is the complete list of what it can send. If something is not here, Proof does not send it.

How it works. Proof counts events: a roll was opened, the loupe was used, an export finished. Each event is a name plus a few labels, and every label is chosen from a short list written into the app. There is no field through which a file name, a folder, a note, a stroke or any other text of yours could travel. The tally goes to TelemetryDeck, a privacy-focused analytics service based in Germany. It sees a one-way hash of a device identifier plus the app and iOS version, which is enough to count devices, not to name one.

Turning it off. Open Settings in Proof, find Usage data, and choose Off. The choice is remembered. Off means off: the analytics code is replaced with one that does nothing.

What is attached to every event

• Device class: iPad, iPhone or foldable.
• Pencil capable: whether the device can take an Apple Pencil. Not whether you own one.
• Subscription state: free trial, subscribed, lapsed, or never subscribed. No purchase details, receipts or Apple Account information; purchases are handled entirely by Apple.
• App version and iOS version.

The events

Milestones, sent once per device the first time each happens and never again: the first roll opened, the first time the loupe is switched on, the first pinch-zoom of a contact sheet, the first roll closed, the first pencil stroke on a photo, the first successful export. They carry no other information.

A roll was opened. How it was opened (the Files picker), whether it succeeded, how many photos it holds as a range (1 to 12, 13 to 24, 25 to 40, 41 or more), and the camera's model name taken from the first photo, such as X-T5 or EOS R5, with the maker's name removed and reduced to letters, digits, spaces and hyphens. That model name is the only piece of photo metadata Proof ever sends. Location, serial numbers, artist and owner fields and dates are never read for it. If the open fails, a fixed reason code: no permission, not found, unreadable, other. A cancelled open sends nothing.

An export finished. Which kind: pick and reject flags, marked reference images, marks saved beside the photos, marks saved to iCloud, the share sheet, or the camera roll. Whether it succeeded, a fixed reason code if it failed, and how many frames as a range (1, 2 to 10, 11 to 40, 41 or more). For the share sheet, success means the files were handed to iOS; Proof does not learn where they went.

A print was sent. Whether the paper was postcard size or larger, and whether it printed, was cancelled, or failed. Never the printer's name.

A toolbar control was used. Which control, sent once per control per session: the five pencils, the width tray, the eraser and its mode tray, the hand, the verdict stamp and its tray, the filter, the black-and-white treatment, the loupe and its tray, loupe zoom, full resolution, the theme bulb, settings, roll actions, print and share, close roll, back to sheet, hide and show bar, and the bar's grip. Alongside it, whether the touch came from a finger, an Apple Pencil or a pointer, and which screen it was on: the sheet, a photo, or the landing page. A session ends after 30 minutes in the background.

Purchases

Proof is sold as a yearly subscription through the App Store. The transaction is handled entirely by Apple through the App Store and StoreKit. Apple processes your payment and manages your subscription record; we receive aggregate sales information from Apple, but we do not receive your name, payment card, or billing address. Apple's collection and use of that information is governed by Apple's Privacy Policy. What happens when a subscription lapses is described in our terms of use.

Diagnostics

If you opt in through your device settings, Apple may share anonymized, aggregate crash and usage diagnostics with us to help improve the app. This information is not tied to your identity and is governed by Apple's Privacy Policy. You can turn this off at any time in iOS Settings under Privacy & Security → Analytics & Improvements.

What we don't do

• We don't require an account, email address, or login.
• We don't use third-party advertising or tracking SDKs.
• We don't run any AI or machine-learning analysis on your photographs, on the device or anywhere else.
• We don't sell, rent, or share personal information, because we don't collect it.
• We don't track you across other apps or websites.

Children's privacy

Proof is not directed at children under 13, and we do not knowingly collect personal information from children. Because the app does not collect personal information from anyone, this poses no specific risk, but if you believe a child has provided information through the app in a way we should know about, contact us at the address below.

Your rights

Depending on where you live, you may have rights under laws such as the GDPR (Europe) or the CCPA (California), including the right to access, correct, or delete personal information a company holds about you. Because Proof does not collect or store your personal information, we have nothing to retrieve, correct, or delete on our end. Files in your folders and data in your iCloud account are managed by you. Anonymous usage counts cannot be traced back to you, so they cannot be retrieved for you either.

If you have questions about your rights in relation to Proof, contact us using the details below.

Changes to this policy

If we change how Proof handles data, we'll update this policy and revise the "Last updated" date above. Significant changes will be reflected here before they take effect in a new version of the app.

Contact

If you have any questions about this policy or about privacy in Proof, reach us at:

admin@straylightorbital.com
Straylight Orbital LLC
Rockford, Michigan, USA

This policy is governed by the laws of the State of Michigan, USA, without regard to its conflict-of-law provisions.