This document is available in all eight website languages.
Purchases and local allowance
Apple processes Plumb Pro purchases through StoreKit. Plumb reads Apple-verified product identifiers, transaction status, expiration and revocation information to provide and restore Pro. Plumb does not receive your payment card details or Apple Account password, and does not send purchase records to a developer-operated server. Apple processes transactions under its own privacy policy. Monthly free-save usage and related capture identifiers are stored locally on this device; they are not a cross-device account quota.
Who operates Plumb
Plumb is operated by QShot Technology Co., Ltd., a company registered in China. Privacy and legal contact: support@plumb.cam. This notice applies to the Plumb iPhone app.
Privacy at a glance
Plumb has no user accounts, advertising network, or developer-operated photo server. Photos and correction data are processed on your iPhone. Your Library stays on the device unless you choose to enable iCloud Sync. You may choose to enable limited first-party usage statistics after the first-run guide.
iCloud Sync
iCloud Sync is off by default. When you turn it on, Plumb stores Original and Corrected photos, edits, place metadata, and Plumb albums in your private CloudKit database managed by Apple so they can appear on your other devices. This data counts against your iCloud storage. Photos identifiers and unfinished Photos operations remain only on the device where they were created. Turning sync off stops future transfers but does not delete data already in iCloud.
Data handled on your device
Plumb handles photos you capture, Original and Corrected versions, thumbnails, EXIF data, camera and lens settings, orientation, capture time, and local Photos identifiers needed for actions you request. Automatic correction also uses motion and gravity samples, camera intrinsics, orientation, crop and transform records, and processing diagnostics. Plumb stores your settings, favorites, local albums, Current Shoot state, and recovery records needed to safely complete Photos operations.
Location information
When Record Location is on, Plumb may store precise coordinates, accuracy, capture time, and a place name or address with the photo. Precise location can reveal where you live, work, or travel, so this feature is optional. To resolve a place name or nearby point of interest, Plumb may send the coordinate and nearby search area to Apple through Core Location and MapKit. Apple processes that request under its own privacy policy; Plumb stores the result locally with the capture.
Why Plumb uses this data
Plumb uses local photo and sensor data to take photos, perform requested correction, preserve Original and Corrected versions, organize the Library and albums, display capture information, and recover interrupted saves without duplication or loss. Where law requires a legal basis, processing supports functions you request; optional Location and Photos access relies on your permission or consent; and security, support, and reliable operation may rely on the operator’s legitimate interests where permitted.
Permissions
Camera access is required to take photos. Motion access supplies device-orientation evidence for perspective correction. Location access is optional. Photos access is used only to save, verify, organize, download from iCloud when necessary, or delete Photos copies and albums you request. You can change permissions in iOS Settings. Withdrawing a permission may disable the related feature but does not remove photos already saved in Photos.
Apple services, sharing, and other recipients
Photos, iCloud Photos, CloudKit, Core Location, MapKit, the iOS share sheet, and Mail are Apple or system services. Plumb sends photos outside the app only when you enable iCloud Sync, save or manage Photos content, or choose a share destination. Place lookups and feedback use the services described here. When usage statistics are enabled, the limited events described below go to Plumb's Cloudflare-hosted endpoint. The chosen destination and service provider apply their own terms and privacy practices. Plumb may also disclose information if required by valid law or legal process, or when reasonably necessary to protect users, the operator, or the public.
Optional usage statistics
Usage statistics are off by default. After the first-run guide, you can choose to enable them; you can change your choice at any time in Settings > Privacy & Analytics. Only after you opt in, Plumb sends a small set of once-per-install feature milestones, the app version, whether this install existed before statistics were introduced, and the current App Store region to plumb.cam, hosted by Cloudflare. This helps us understand the path from first capture to saving and Pro. No photos, photo or album identifiers, album names, precise location, Apple Account information, advertising ID or device ID are sent. Cloudflare processes technical connection data such as IP address to deliver and protect the endpoint, but Plumb does not write it to its usage dataset. The usage dataset is stored for up to three months. Turning statistics off stops future uploads and clears pending statistics on this device; previously aggregated counts cannot be singled out for deletion because they carry no user identifier. This is not cross-app tracking or advertising. Share daily capture & purchase statistics Send daily counts of capture attempts, saved originals, correction results, camera unavailability, paywall views, purchase attempts and verified/cancelled/failed/pending results, and restores to Plumb’s Cloudflare service. Includes UTC day, app version/build and distribution channel. No photos, location, accounts, transaction IDs or persistent device IDs. A random batch key prevents duplicates for 7 days; daily totals are retained for 90 days. No advertising or cross-app tracking. Turn off anytime to stop sharing and erase queued counts; received anonymous totals cannot be individually deleted. Declining does not affect any feature. Old consent does not enable this sharing. Available starting with version 1.0.7 (72), only after explicit consent to the combined usage-statistics choice. Build 71 does not collect daily counters. Existing usage or diagnostic consent does not enable this feature. Pending daily counts stay on the device for at most seven UTC days, with at most fourteen batches and 128 unfinished operations. No historical photos are scanned. Day-end unknown results are not failures. Cloudflare processes connection information for delivery and security; Plumb does not write request IPs or headers into this database. Provider security logs and recovery backups follow separate retention practices. Processing may occur outside your country. Revenue, renewals and refunds are determined by Apple reports, not these counters. Starting with 1.0.7 (72), first-use milestones and daily counters use one Share usage statistics switch and one complete consent choice. New users are asked once; the old prompt is not shown first while daily statistics remain unavailable. Existing users keep their previously authorized scope until they explicitly agree to the expanded scope. A previous refusal is not automatically prompted again. Turning the unified switch off stops both kinds of statistics. Correction diagnostic sharing remains separate.
Optional correction diagnostic reports
Correction diagnostic sharing is optional and separate from usage statistics. One Settings switch controls successful and failed automatic correction diagnostics, and is off by default. Earlier category-only consent remains unchanged until you explicitly change it; the row explains partial sharing. Turning the switch off stops both categories, and turning it on authorizes both. An eligible new failed capture asks once if no failure-sharing choice has been made. Agree and send authorizes that report and future eligible new failure reports only, not successful reports; declining, closing or accessibility Escape prevents further prompts. This failure-only choice is retained and shown as partial sharing in Settings. Choices persist across launches and do not affect Plumb, Pro or correction allowance. The Original is preserved and failed correction does not use correction allowance. A report contains hardware model, iOS and app/build versions, correction outcome, and numerical motion, timing, camera calibration, orientation, crop and transform parameters needed to investigate failures or incomplete correction. It contains no photos, location, Apple Account information, persistent device or installation identifiers, photo identifiers, filenames or image hashes. A random per-report key prevents duplicate uploads; it is not a user identifier. Reports are not used for advertising or cross-app tracking. Only with your choice does Plumb send the report over HTTPS to its Cloudflare-hosted endpoint at plumb.cam for troubleshooting and improving correction reliability. Cloudflare processes connection information such as IP addresses to deliver and protect requests; Plumb does not store IP addresses or request headers in its diagnostic database. Provider security logs and recovery backups are separate from the report table and follow their applicable service retention practices. Up to 50 pending reports remain on this device for at most seven days and may retry when the app resumes or connectivity returns. Authorized reports may retry after restart. Reports separately authorized in an earlier app version remain eligible for retry without enabling automatic failure sharing. Turning a sharing switch off clears pending reports of that category and cancels its uploads, but cannot undo reports already received. Failure sharing does not upload historical captures or other reports queued before the first choice. Reports in the server diagnostic table are removed after fourteen days through daily cleanup; recovery backups and service logs may remain separately. Diagnostic handling may occur where Cloudflare operates, outside your country. Where consent is required, you may withdraw it for future sharing through Settings. Contact support@plumb.cam for applicable access or deletion requests; because reports carry no stable personal identifier, identifying a particular report may be limited. Do not email photos or sensitive information merely to identify a report.
No tracking, advertising, or sale
Plumb does not use advertising SDKs, cross-app tracking, behavioral profiling, or third-party analytics. The operator does not sell personal information or share it for cross-context behavioral advertising.
Storage and retention
Local captures and metadata remain on your iPhone until you delete them from Plumb or remove the app. When iCloud Sync is enabled, synchronized records remain in your private CloudKit database until deletion is synchronized or you remove the data through iCloud storage management. Turning sync off alone does not delete them. Photos copies and Photos albums remain under your Photos and iCloud settings until you delete them there; deleting Plumb does not delete those copies. Support emails and attachments are retained only as long as reasonably necessary for support and legal obligations. Apple and email providers determine their own retention periods. Deleted photos move to Settings > Trash for 30 days unless you permanently delete them sooner. Trash retains their Original, Corrected, metadata and saved edit records for recovery; albums do not enter Trash. When iCloud Sync is enabled, deletion, restore and permanent deletion propagate to your other devices after sync. Minimal deletion-state records may remain to prevent an offline device from uploading a permanently deleted photo again.
Your choices and privacy rights
You can view and delete captures in the Library, choose whether deletion also affects Photos, turn off iCloud Sync or location recording, change iOS permissions, manage Plumb data through iCloud storage settings, or uninstall Plumb to remove its local app container. Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, withdraw consent, and complain to a privacy authority. Most app data is controlled through Plumb and your iCloud settings. For support correspondence held by the operator, contact support@plumb.cam.
Regional disclosures
California residents may exercise rights available under applicable California law. Plumb does not sell or share personal information for cross-context behavioral advertising and will not discriminate against you for exercising applicable rights. Where precise location is treated as sensitive personal information, including under China’s PIPL, Plumb processes it only when Record Location and the relevant iOS permission are enabled, and you can withdraw that permission at any time. Mandatory local rights continue to apply.
International processing
The operator is based in China. If you email support, your message may be processed in China and in countries where your email provider or the operator’s email provider operates. Apple services may process data in locations described by Apple. Plumb does not transfer your on-device Library to its own server. Applicable safeguards and mandatory local rights continue to apply.
Children
Plumb is a general-audience camera and is not directed to children. Plumb has no account, advertising, or developer-operated photo server. A parent or guardian can turn off the limited usage statistics in Settings and should supervise device permissions and any sharing or feedback sent by a child.
Security
Plumb uses the iOS app sandbox, system permission controls, integrity checks, and fail-closed photo processing to reduce unauthorized access, corruption, and accidental loss. No storage or transmission method can be guaranteed completely secure, so keep independent backups of important work.
Changes and contact
This notice may change when Plumb’s features, providers, or legal obligations change. The updated date changes when a material revision is published. Questions, privacy requests, and requests concerning support correspondence can be sent to support@plumb.cam.
Filter usage statistics
Only after a separate opt-in, share daily counts of successfully applied camera filters and later removal or restoration. Built-in filters use fixed categories; all custom filters share one Custom category. No photo IDs, filter names or parameters, LUTs, photos, location or persistent user/device IDs leave your device. Local capture keys recognize only new, consented captures and prevent duplicates; at most 10,000 keys are kept for 90 days. No historical Library scan or unique-user tracking. Counts use the existing Cloudflare daily service, UTC day, app version/build/channel and random batch deduplication; receipts expire after 7 days and totals after 90 days. Counts describe observed retained-use changes, not all users or an exact current worldwide photo inventory. Unobserved offline changes, expired keys, withdrawal and queue limits can leave gaps. Turning off this option clears its local keys and all pending daily counts; the main usage-statistics switch also stops it. Received anonymous totals cannot be individually recalled. Re-enabling starts fresh. Optional sharing does not affect any feature. Existing consent does not enable this new scope.
plumb.cam
This website is hosted by Cloudflare, which processes technical request data such as IP address, browser information and requested URLs to deliver and secure the site. There is no advertising or added analytics SDK. Your chosen website language is stored only in this browser; you can remove it by clearing site data. When you email support, your address, message and attachments are processed by the operator and email providers to respond. Optional iCloud Sync requires Pro; turning it off or losing Pro does not delete previously synchronized records.
Test applications are now closed. The following explains how previously submitted applications are handled.
Beta applications: we collect your email, chosen language, application time and consent version to manage applications and send invitations. Cloudflare stores applications; Resend processes invitation emails and application notifications sent to our support inbox. Applications are retained for up to 90 days; email providers may retain delivery records under their own policies. A short-lived hashed network identifier limits abuse. We do not add you to marketing lists. To withdraw or request deletion, email support@plumb.cam.
QShot Technology Co., Ltd.
support@plumb.cam