Grainhaus

Formerly Flashback

Web iOS

Effective: 13 July 2026 · Last updated: 13 July 2026

0. Which products this covers

Grainhaus (formerly Flashback) ships on two platforms. This single policy applies to both. Where the two products behave differently, the relevant section is tagged so you can see at a glance which platform it covers:

Grainhaus Web — the vintage camera simulator running at flashbackcamera.vercel.app.
Grainhaus iOS — the iPhone / iPad app distributed via the App Store.

Two tags appear in section headings below: WEB (browser app — sent to Google Analytics, hosted on Vercel) and iOS (App Store app — fully on-device).

The short version of the policy: your photos and video stay on your device on both platforms. The only data that leaves your device is anonymized, aggregate usage telemetry sent from the web app to Google Analytics, plus standard web-server access logs from the web hosting provider (Vercel). The iOS app does not contact any server at all unless and until you tap Save to Photos, which writes to your local Photos library — it does not transmit anything off your device.

1. Data we do NOT collect (both platforms)

Camera frames. Processed on-device only — never uploaded, transmitted, or stored on any server.
Photos you snap. Saved locally to the platform's private storage (browser IndexedDB on web; app sandbox on iOS). Never uploaded.
Caption text. Stored next to the photo locally. Never uploaded.

2. Data that leaves your device

2.1 Web Web

Google Analytics 4 (GA4). We use Google Analytics 4 to understand aggregate feature usage. On each page load, GA4 sets first-party cookies and sends anonymized events — typically a page_view, occasional click interactions, and standard browser/IP information — to Google. GA4 does not receive your camera stream, photos, captions, or any other content you create in the app.
You can opt out by:
- Using your browser's privacy controls (e.g. blocking third-party cookies, enabling Do Not Track / Global Privacy Control where supported).
- Installing the Google Analytics Opt-out Browser Add-on.
- Using a content blocker that filters googletagmanager.com.
For details on Google's handling, see Google's Privacy Policy.
Hosting access logs (Vercel). The web app is hosted on Vercel. As is standard for any web request, Vercel logs your IP address, user-agent string, referrer, the requested URL, and a timestamp. These logs are used for abuse prevention, capacity planning, and debugging. They are not used to profile you. See Vercel's privacy policy for how they handle infrastructure data.

2.2 iOS iOS

The iOS app does not contact any server. It contains no analytics, crash, ad, or remote-config SDKs, and we receive no telemetry from the app.

The only off-sandbox action is Save to Photos, which writes a copy of the Polaroid to your device's Photos library. The photo is not transmitted to us or to anyone else.

3. Data stored on your device

3.1 Web Web

Photos you keep on the Pin Board, along with their captions, are stored locally in your browser. To clear this data, use your browser's site-data controls. (See section 2.1 for analytics cookies, which fall under that section's opt-out.)

3.2 iOS iOS

Captured photos and captions are stored in the app's private sandbox. Tapping Save to Photos writes an additional copy to your Photos library.

To delete: use the in-app gallery's delete control, or uninstall the app to wipe the sandbox. Copies saved to your Photos library must be removed from the Photos app.

4. Device permissions and usage strings

4.1 Web Web

Browsers prompt for camera access the first time you click Power. Granting the prompt lets the live viewfinder render your webcam feed through the chosen filter. Browser camera data is sent to the GPU for decoding; no network transmission occurs. You can revoke at any time via the browser's site permissions.

4.2 iOS iOS

The iOS app requests two permissions: camera (when you open the camera view) and Photos library — save only (when you tap Save to Photos). No other permissions are requested — no microphone, no Photos read, no location, no contacts, no tracking, and no advertising ID.

5. Third-party services and assets

5.1 Web Web

Google Analytics 4 — described in section 2.1.
Vercel hosting — described in section 2.1.
Sound effects — shutter, motor, and lens-shutter WAVs are served from /sound/ on this domain. They are fetched passively when you first interact with the camera; they do not set cookies or send identifying data.
Fonts and SVG icons — loaded from this domain; we do not embed any third-party scripts beyond Google Analytics.

5.2 iOS iOS

None. The iOS app embeds no third-party SDKs and makes no remote calls. All filter code, audio, and storage run on your device.

6. Children's privacy

Both Grainhaus products are general-audience tools and are not directed at children under 13 (or the age of digital consent in your jurisdiction, if higher). We do not knowingly collect personal information from children.

7. International data transfers Web

Because Google Analytics and Vercel are global services, the limited telemetry described in section 2.1 may be processed in countries other than your own, including the United States. The iOS app does not perform cross-border transfers because it does not transmit any user data off-device.

8. Your rights and choices

Web — access / deletion of local photos: use your browser's site data controls (section 3.1).
Web — opt out of analytics: see section 2.1.
iOS — access / deletion of local photos: use the in-app gallery delete control, or uninstall the app to wipe the sandbox (section 3.2).
iOS — delete saved Polaroids from your Photos library: use the iOS Photos app — the Grainhaus app does not control those copies.
EEA / UK / Switzerland: the limited processing described in section 2 is the only processing of your personal data we are responsible for on either platform. You have the right to lodge a complaint with your local data protection authority.
California residents: neither Grainhaus product "sells" or "shares" (as those terms are defined by the CCPA / CPRA) personal information for cross-context behavioural advertising.

9. Changes to this policy

We may update this policy to reflect changes in the apps, in our hosting, or in applicable law. The Effective and Last updated dates at the top will reflect the most recent revision. Material changes will be flagged inside the web app on the next visit; the iOS version of this policy that ships in-app will be updated in the next app release.

10. Contact

Questions, concerns, or data requests can be sent to sonlegaming01@gmail.com. We aim to respond within a reasonable timeframe. This contact covers both the web and iOS versions of Grainhaus.

This page is provided for transparency and is not legal advice. If you need legal guidance on how this policy applies to your situation, please consult a qualified professional in your jurisdiction.