RollTogether

RollTogether Privacy Policy

Last updated: November 10, 2026

RollTogether is an iPhone app that compares your photo library with another iPhone nearby and lets each person send the other the photos they choose. It is made by an independent developer. This page says what the app touches on your iPhone, what leaves it, and where that goes.

The short version: RollTogether has no accounts, no servers, and no analytics. It collects no data about you. The only place anything from your iPhone goes is the other iPhone you chose to compare with, and only what is listed below, unless you choose to email the developer from Settings.

What the app does not do

  • It does not create accounts or ask for your name, email address, or phone number.
  • It does not send anything to the developer on its own. There is no server to send it to. The one exception is an email you write and send yourself (see “If you send feedback”).
  • It does not include analytics, advertising, or any third-party code.
  • It does not track you, and it does not share data with third parties.

Photos

RollTogether asks for access to your photo library so that it can:

  • compute a fingerprint (a SHA-256 hash of the original file) for each photo, video, and Live Photo you let it see, on your iPhone;
  • show you which of your own photos the other iPhone is missing, so you can choose which to send;
  • save the photos the other person sends you into your library and into a “RollTogether” album.

Fingerprints are kept in a cache on your iPhone so later comparisons are fast. Your photos themselves are never copied, uploaded, or transmitted unless you select them, tap Send, and the other person accepts.

If you grant Limited access, only the photos you selected are compared.

What travels to the other iPhone

Everything in this section goes directly between the two iPhones, over Wi-Fi, peer-to-peer Wi-Fi, or Bluetooth. It never passes through a server.

While the two iPhones find each other

  • The name you chose under Settings > This iPhone > Name, or, if you chose none, the name iOS reports to apps (“iPhone”). Any nearby iPhone running RollTogether can see this while you are on the Find screen.

During a comparison, after both people confirm the same code

  • Blinded fingerprints: each photo’s fingerprint keyed with a secret that both iPhones derive for that one session. They are meaningless outside the session and cannot be turned back into a photo or even a fingerprint.
  • Counts: how many photos match and how many do not.
  • If you chose to compare a place: the rough area both people agreed on (a coordinate snapped to a roughly 1 km grid, a radius, and a place name), so both iPhones can filter to it. A photo’s own location is never sent.
  • If “Compare how photos look” is on for both people: for photos that did not match exactly, blinded slices of a visual descriptor and two coarse size buckets, so the same picture can be recognized at a different quality. The descriptor itself is never sent. Switching this off on either iPhone switches it off for both.
  • A random identifier for your installation of the app (see “What the app stores”), encrypted.
  • Whether the optional Fast Transfers feature is switched on.

Not sent during a comparison: thumbnails, filenames, dates, locations, camera information, or any other photo metadata.

When you send photos

  • The photos you selected, with their filenames and file types, encrypted end to end so that only the receiving iPhone can read them. An edited photo travels as its edited version. With “All Photos Data” on, the original and its edit data travel too. With “Include Location” off, location data is removed before sending.
  • When a modified version of a photo travels (for example, with location removed), the fingerprint of that photo’s original travels with it, so the receiving iPhone recognizes the photo at the next comparison.

What the app stores on your iPhone

  • Your preferences: the name shown to others, your send options, and whether Fast Transfers and “Compare how photos look” are on.
  • A fingerprint cache for your photo library.
  • A random identifier created the first time the app runs. It is not linked to your Apple Account, your hardware, or your photos, and it is sent only to iPhones you have confirmed a code with, encrypted. It lets the other iPhone remember your pairing.
  • For each iPhone you have paired with: its identifier, its name, a nickname if you gave it one, a pairing key so the two can reconnect without a code, which photos you chose not to send it, and which photos it sent you in which transfer. These records are kept out of iCloud and computer backups, and they are erased together when you swipe that iPhone’s row in Settings and tap Forget.
  • With Fast Transfers: which iPhones you declined to pair with, and which paired iPhones you switched off.
  • A technical log of recent sessions (the transport used, timings, error codes, how many items each transfer sent or could not save, whether the app was in the foreground, your language and app settings, the kinds of network connection your iPhone had (never an address), and the names of iPhones seen nearby or connected to, with nothing about what your photos are or show), which stays on your iPhone unless you choose to include it in feedback.

Deleting the app deletes all of the above. A Wi-Fi Aware pairing made for Fast Transfers lives in iOS and is removed in iOS Settings.

If you send feedback

Send Feedback in Settings opens an email addressed to the developer in your own mail app. Nothing is sent until you tap Send there, and you can change or delete any of it first. The email contains what you write, your email address, and your iPhone model, iOS version, and app version. If you choose to include the connection log, the technical log described above is attached, with the names of other iPhones and other identifying details removed. The developer uses these only to reply to you and to fix problems.

Services provided by Apple

  • Place names. When you narrow a comparison to a place, the app asks Apple’s geocoding service to name the area, using a coordinate snapped to a roughly 1 km grid rather than any photo’s exact location. This is the only time the app contacts any server. Apple’s privacy policy covers that request.
  • Fast Transfers (Wi-Fi Aware). On supported iPhones, you can choose to pair two iPhones through iOS so transfers use a direct Wi-Fi Aware link. The pairing is made by iOS’s own pairing sheet, lasts beyond the session, and can be removed in iOS Settings.
  • Photos, Multipeer Connectivity, and Local Network are iOS features the app uses. iOS controls the permissions, and you can change them at any time in Settings.

Security

The two iPhones agree on a secret for each session with an ephemeral key exchange (Curve25519). The six-digit code you both confirm verifies that no third device sits between you. Fingerprints are blinded with HMAC-SHA256 under that secret, and photos are encrypted with ChaCha20-Poly1305 under a key derived from it. Pairing keys are stored with iOS’s complete file protection.

Children

RollTogether is not directed at children under 13 and collects no personal information from anyone.

Changes

If this policy changes, the new version will be posted at this address with a new date.

Contact

support@getrolltogether.app