BW is made by Wonderful So and run on our own servers. This describes everything we hold, why, and how to make us delete it. It is written to be read rather than to be complied with.
Every photograph you take. The app has no way to import a picture and no way to send one anywhere unless you publish it deliberately. Your negatives, your edits and your photographs are on the device and nowhere else — if you never make an account, the app sends us nothing about you at all.
Reading this website is a separate matter, and it is not nothing. It is described below, under what reading the website leaves.
Published photographs are stored on Cloudflare R2. Everything else is in our own database.
The pages that can be rated on need to know who is rating, so they start a session — and a session is a row in our database, whether or not you ever sign in. That row holds a random session identifier, your IP address, the browser's user-agent string, and your account if you have signed in on this browser. No page you visited, no photograph you looked at, no profile assembled over time.
It is created by loading a photographer's page or the sign-in page, and it is
deleted about two hours after your last request. The marketing pages, and the
feeds at /@handle/feed.xml and /@handle/feed.json,
start no session and leave no row.
We count how the app is used, and we cannot tell whose use we are counting. An event carries a name from a fixed list, the app version, the major iOS version, and whether the device is a phone — no account identifier, no device identifier, no session identifier, no IP address, and the date rather than the time. Two events from one phone are indistinguishable from two events from two phones.
Crash and hang reports come from Apple's own MetricKit, which aggregates them on the device and delivers them a day later with nothing personal in them.
Basic app activity counts are kept as individual event records for up to 30 days. After that, we delete those records and keep only daily totals, like how many times the app opened on a given date.
Under the GDPR: your address, handle and published work are processed to perform the service you asked for (Article 6(1)(b)). Reports and moderation records, and the short-lived session records the website leaves — an IP address and a user-agent string, kept for about two hours — are processed under our legitimate interest in keeping the app safe for the people in it and in a rating being cast once, by somebody, rather than a thousand times by a script (Article 6(1)(f)). Anonymous counts are not personal data.
If you are in the UK, EU or EEA you may ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or complain to your data protection authority. If you are in California you have equivalent rights under the CCPA and CPRA, including the right not to be discriminated against for exercising them.
We do not sell or share personal information, in the CCPA sense or any other. We never have.
Deletion is in the app: Settings → Delete account. It removes your account, your published photographs, your portrait, your ratings and your reports, immediately and without asking us. For anything else, write to [email protected] and we will answer within 30 days.
BW is not intended for children under 13, and under 16 in countries where that is the threshold for consent. We do not knowingly hold data about them; if you believe we do, write to us and it will be removed.
Our servers and object storage are operated on our behalf by hosting providers who process data only as instructed. If data is transferred outside the UK or EEA it is done under the European Commission's standard contractual clauses.
This policy is subject to change. If we make a change that materially affects your privacy or how your data is handled, we will make that clear in the app or on this page. The date at the top is the current version.
Wonderful So, [email protected]. We are the data controller for everything described here.