Privacy
Last updated 26 September 2026. Nostalgo is published by Horse Hill LLC.
Nostalgo exists so that a family's old photographs survive. That only works if the photographs stay the family's. This page says what the app stores, why, who else sees any of it, and how to delete it.
Summary
- Your photos are yours. We do not sell them, license them, or show them to anyone you did not share them with.
- We do not train AI models on your photos.
- The AI features send a photo to a third-party AI processor only after you allow it in the app. We only use AI processors that do not train their models on what we send.
- Restoration, repair, faces and short videos run on our own servers. Faces are off until you turn them on.
- There is no advertising in Nostalgo. This website sets no cookies and runs no analytics or tracking scripts.
- You can delete your account in the app. Everything in it goes, and so do your entries on this website.
What we store and why
| What | Why |
|---|---|
| Your email address | It is how you sign in. There are no passwords. |
| Your name and profile picture, if you give them | So your family sees who sent or shared a photo. |
| Your phone's language | To write our emails and the AI assistant's replies in your language. |
| The photos you scan or pick from your library, and the backs of prints | They are the product. We keep the original, the restored and re-imagined versions you make, short videos you make, and small previews. |
| The date, camera and location saved inside a photo you pick from your library | To date the photo and name the place it was taken. |
| What you write: captions, dates, places, tags, names of people, comments, reactions and notes | So you can find a photo again and your family can read it. |
| Albums, shares, sends, groups, and the email addresses you share or send to | To work out who may see what, and to invite the people you chose. |
| Your conversations with the AI assistant about a photo | So the conversation carries on where it left off. They are deleted with the photo. |
| Guesses the assistant makes about a photo's date, place or occasion | To offer them to you. Nothing is filled in unless you accept it. |
| Face data, only if you turn faces on (see below) | To suggest who is in your other photos. |
| Your settings, and when you allowed the AI features | So the app behaves the way you set it. |
| How much you used the AI features each day | To keep each account, and everyone together, within a daily allowance. |
| Reports you make and people you block | To review reports and to keep blocked people away from you. |
| Technical logs: when a request came in, from which network address, the app version, and errors | To keep the service running and secure, and to fix what breaks. |
| On this website: your email, and the optional name and note, if you join the beta list | To invite you to the beta. |
| On this website: the name, email and text of a family story you send | To read it, and to ask you before anything is published. |
| With a form on this website: a scrambled form of your network address, never the address itself | To stop the forms being abused. |
Photos you scan are not written into your phone's photo library unless you ask for that. We never upload your address book or your whole photo library.
AI features and third-party AI processors
Some features use AI models run by a third-party AI processor: the assistant you talk to about a photo, Re-imagine, the help with a short video's motion, "Feeling nostalgic", and the automatic guesses of a photo's date, place and occasion. Before any of them is used for the first time, the app asks you and says what is sent. Until you allow it, these features are off and our servers send nothing of yours to an AI processor. You can change your answer at any time in the app's settings.
When they are on, this is what goes to the AI processor:
- The assistant: what you type, the photo as scanned and the version you are looking at, and the photo's date, place, caption, tags and the text on its back.
- Re-imagine: the photo and the words you add. The result is a new picture, labelled Re-imagined, saved beside the original and never over it.
- Feeling nostalgic: what you type, and small previews of photos from your phone that match it (at most 40, chosen on your phone) with those of your Nostalgo photos. The previews are not stored.
- Date, place and occasion guesses: the photo and the back of the print, with its caption, tags and the text on its back.
The AI processor handles this only to give the answer. We only use AI processors that do not train their models on what we send. Face data is never sent to an AI processor, and the assistant is told never to identify anyone from their face.
What runs on our own servers
Restoration (straightening, colour and fading, damage repair), faces, and short videos are made by software and open models running on servers in our own cloud account. No photo is sent to another company for these, so they do not depend on your answer about the AI features.
Faces
Faces are off until you turn them on in the app's settings. When they are on, our servers find the faces in your photos and keep, for each one, where it is in the photo, a small crop of it, and a list of numbers that describes it. These are used only to suggest who is in your other photos, from the people you have already named, within your own account. They are never shared with anyone, never used across accounts, and never sent to an AI processor. Turn faces off and every face, crop and description is deleted.
Contacts
When you name a person, you can pick them from your phone's contacts. The app opens your phone's own contact picker and takes only the name of the contact you pick, with your phone's reference to that contact so the same person is not added twice. Nothing else from your contacts is read or uploaded.
Places and maps
When you search for a place, when the assistant guesses one, or when a photo from your library carries a location, the place text or the coordinates go to a mapping service of our cloud provider to find the place and its name. The photo itself is not sent.
Content checks
Comments, notes and captions are checked automatically before they are posted, and photos are checked when you send them to other people. The checks run with a moderation service inside our cloud provider; nothing is sent to another company for them. Anything flagged is held back, and the app tells you so.
Reports and blocking
You can report a photo, a note, a comment or a person in the app. The report stores who reported what, the reason you chose and anything you wrote. What you reported is hidden from you at once, and we review every report within 24 hours. When you block someone, they disappear from your feed, cannot send to you, and their comments and reactions are hidden from you. You can unblock them in the app's settings.
Sharing and sending
A photo or album is private until you share it or send it. The people you choose see what you shared or sent, in the versions you chose, and nothing else. If you invite someone by email, we send them one email saying what is waiting. You can unshare at any time.
Sign in with Apple and Google
- Sign in with Apple: Apple gives us an identifier for you that stays the same, your email address (or the private relay address Apple makes if you choose to hide yours), and your name the first time, if you share it.
- Google: Google gives us an identifier for you that stays the same, your email address and whether it is verified, and your name.
- Email: we send you a link and a 6-digit code. Both work once and expire after 15 minutes.
We never receive your Apple or Google password.
Where your data is stored
Photos and records are stored in the United States, with our cloud provider, in an account controlled by Horse Hill LLC. They are encrypted when stored and when they travel to your devices. The web version of the app keeps your sign-in in your browser's local storage. This website keeps only your light or dark choice in your browser.
Deleting your account
Delete your account in the app under Menu, Account, Delete account. It deletes, at once and for good: your photos and every version and video of them, albums, captions, tags, the people you named, faces, your conversations with the assistant, the guesses about your photos, the sends and shares you made and received, your comments and reactions anywhere, your groups and group memberships, your settings, your sessions, and your entries on this website with the same email address (the beta list and any story you sent). The photo files are erased from storage within a day.
What remains: a record that an account was deleted and when, with no email and no name, and the cost of AI work done that day with nothing that links it to you. Our database backups are kept for 7 days, so a deleted account is gone from them within 7 days, and technical logs that mention it roll off within 30 days.
How long we keep data
Photos, albums and what you wrote stay until you delete them or your account. A photo you delete is erased from storage within 30 days. "Feeling nostalgic" conversations are deleted after 30 days. Face data stays only while faces are on. Technical logs are kept for 30 days, and the logs of requests to our storage and website for 120 days. Beta list entries and stories stay until you ask us to remove them or delete your account. Emails you send to our addresses go to the person who answers them, and our copy is kept for 90 days.
The beta
Nostalgo is in public beta. During the beta, Plus features are free. If you test through Apple's TestFlight, Apple's terms for TestFlight apply, and Apple passes on crash reports and any feedback you choose to send through TestFlight.
Your rights
You can see and change what you wrote in the app, get a copy of your photos and text by writing to us, and delete your account in the app. If you are in the European Economic Area, the United Kingdom, or a US state with its own privacy law, those rights are yours by law as well, including the right to object and the right to complain to your regulator. Write to privacy@nostalgo.app and we will do it.
Children
Nostalgo is not for children under 13, and we do not knowingly collect anything from them. Old family photographs often show children, which is normal and is not the same thing as a child using the app.
Security
Data is encrypted in transit and at rest, and access to it is limited to the people who run the service. If something happens that affects your data, we will tell you plainly and quickly.
Changes
When this page changes in a way that matters, we will say so on this site and, for anything significant, by email.
Contact
Write to privacy@nostalgo.app about privacy, or to hello@nostalgo.app about anything else. A person reads both.