Roll is built so the fun part, everyone shooting one shared roll, never turns into a data problem. Here is what we collect, what we don't, and what you control.
Photos live in the roll they were taken in. While a roll is sealed, nobody sees them but the person who shot them. When it opens, access follows the rule the host chose: either everyone sees the full album, or each guest keeps only their own frames. You can download your photos at full resolution and delete the ones you took.
Face match is optional. If you use it, your face is turned into a set of numbers, a mathematical signature, never a stored picture. That signature lets us file the frames you appear in into your own album, matched at a 90% confidence floor. Delete it and every match link goes with it. Skip the scan entirely and you still see the whole roll.
Hosts sign in with an email one-time code. We keep your email to run your account and send login codes, nothing more. Guests who join with a code don't need an account at all.
You can delete your face signature, your photos, or your whole account at any time from the app. Deleting your account removes your rolls, your uploads, and your profile. For anything else, email hello@uroll.app.