Your photos stay on your device.

Last updated 13 October 2026 · Questions: contact@zerocapturestudio.com

Who we are

ZeroCapture (“we”) makes the ZeroCapture Studio app and runs zerocapturestudio.com and ZeroCapture Cloud. ZeroCapture is a trading name of UK AI GROUP LTD, a company registered in England and Wales (company number 15301459), whose registered office is 11 Stubbs Close, Billingham, England, TS23 3GH. UK AI GROUP LTD is the controller of the personal data this policy describes, except where we handle photos for operators (see ZeroCapture Cloud below). Questions about this policy or your data go to contact@zerocapturestudio.com.

The app

• Photos stay on the device. Every photo is saved in the device’s own photo library. We never receive it unless the operator turns on ZeroCapture Cloud (below). The app’s settings, PIN, branding and library are kept out of Android cloud backup and device-to-device transfer.
• The camera. The app uses the device’s camera to show the live booth and take photos. Where the camera can detect faces, the app uses that only to wake the booth when someone walks up. Faces aren’t recognised, recorded, saved or sent anywhere. The camera also records boomerangs and videos, on the device. Background removal without a green screen runs on the device itself: no picture or outline of anyone leaves it.
• The microphone. Only if the operator turns on “Record sound” for videos does the app ask for the microphone, and then it records sound only while a video is being recorded, into that video on the device. Boomerangs never have sound.
• Consent and guest details on the device. On White label, the operator can ask guests to agree to their terms on the booth, and ask for details (such as a name, an email address or a tick for a newsletter) and survey answers on the page a guest’s QR code opens. Those answers and agreements are the operator’s: they are kept in the app on the operator’s device, out of its photo library and backups, for as long as the operator chooses (90 days unless they change it), and the operator exports and deletes them. Answers given on the device’s own Wi-Fi page never reach us. The operator is the controller of this data and decides what to ask and why.
• QR sharing over Wi-Fi. A guest’s phone downloads their photo straight from the device over the local network. It doesn’t pass through us, and the link stops working after the time the operator sets.
• No accounts or analytics. Plans need no account. A free ZeroCapture account (signed in with Google, or with an email address and password) is used only for ZeroCapture Cloud and, on White label, for ZeroCapture mail and SMS (below). The app sends no usage analytics.
• Ads on the Free plan. On Free, the booth shows a full-screen ad from Google’s ad service (AdMob) now and then between photos. While the plan is Free, the app loads ads from Google, which receives the device’s advertising ID, its IP address and details of the device and the app, to choose ads and measure them. Google handles that data as its own controller, under Google’s advertising policies. In the UK and the EEA, Google’s consent form asks the operator, when the app opens, whether ads may be personalised; without consent they aren’t, and the choice can be changed in the app under Plan & help > Ads. Guests are never asked, and on Personal and White label nothing about ads is loaded or sent.

The app goes online only for these things:

• Google Play. Plans are bought and checked through Google Play Billing. Google handles the payment under its own privacy policy; we receive the purchase records Google Play gives developers.
• Personal monthly. When Personal becomes yours, the app sends us its Google Play purchase token (and, if you also bought Personal outright, that purchase’s token) so we can stop the payments in Google Play. We keep nothing beyond our request logs.
• Help and feedback. Only when the operator sends a report (see Help and feedback from the app).
• Updates. The app is installed and kept up to date by Google Play. It never checks for or downloads updates from us.

This website

The site is hosted by Vercel, whose servers keep standard request logs. It sets no advertising or analytics cookies, and its fonts are served from this site, not from Google. The account deletion page loads Google’s Firebase sign-in only when you start, to confirm which ZeroCapture Cloud account to delete. Signing in to our staff helpdesk sets one strictly necessary cookie, the session, which holds a random code and nothing about you and ends when the browser closes (or after 12 hours).

Your cloud on the web. When you sign in at zerocapturestudio.com/account with your ZeroCapture account, the site sets one strictly necessary cookie, the session. It holds a random code, never your password or a Google token. We keep a record of the session with your account’s id and when it started and was last used, never your IP address, and delete it when the session ends: after 7 days, after 24 hours without a visit, or when you sign out. Your email and ways to sign in are read from your account when a page needs them and aren’t stored again. The pages show only your own account’s cloud and never guest details. The sign-in page loads Google’s Firebase sign-in, and no account page has analytics, ads or other third-party scripts.

ZeroCapture Cloud

ZeroCapture Cloud is an optional, paid add-on for operators. No photo leaves a device unless the operator subscribes and signs in on it.

• What is stored. The operator’s account (a user id, its email address, the name Google gives for an account that signs in with Google, and which ways it signs in with; for an account with a password, Google’s Firebase keeps only a scrambled form (a hash) of it, and we never see it), the names of their devices (with each device’s model and app version), their photos (with a smaller preview for web pages), grouped by event with each event’s name, date, location and caption, their own backdrops, frames and collections, the look of their online pages (including any logo and fonts), and the settings of their online links and client galleries. A gallery password is kept only as a hash.
• Where. Photos and other files are stored with Cloudflare R2 in the EU. The account and its records are stored with Google Cloud (Firebase) in London. Our website’s servers run the pages and the service in between.
• How long. Each photo is deleted from the cloud 90 days after it was uploaded. Backdrops, frames and collections are kept while the subscription lasts. If the subscription ends, the cloud stays read-only for 30 days, then everything stored for the account is deleted. Seven days before that, we send one email to the account’s email address saying what will be deleted and how to keep it; we use that address for nothing else. Nothing Cloud does ever deletes files on a device.
• Guests. Apart from what a guest chooses to type on an online photo page (see email, SMS and guest details), we keep no data about guests or the operator’s clients. Online photo pages and client galleries count only views and downloads, as plain numbers: no names, email addresses, cookies, device ids or IP addresses are stored with them. IP addresses are used to slow down abuse, kept only in a scrambled (hashed) form, and deleted after an hour.
• The operator’s responsibility. While Cloud is on, the booth shows guests a short notice that photos are stored online. The operator runs the event and decides what happens to its photos: for photos and event details in Cloud, the operator is the controller and we store them on the operator’s behalf, as their processor. The operator remains responsible for telling guests and getting any consent needed there.
• Deleting the account. Operators can delete their Cloud account in the app, under Cloud > Delete account, or on the web at zerocapturestudio.com/account/delete. Online links and galleries stop at once, and everything stored for the account is erased within 24 hours. Files on devices are kept.

Email, SMS and guest details (White label)

On White label, a guest can ask for their photo by email or SMS, typing their address or number on their own phone, on the page their QR code opens, or on the booth itself. The operator may also ask for details and survey answers on that page. None of this needs a ZeroCapture Cloud subscription.

• Email addresses and phone numbers. Used only to send that guest that photo, once. They are never used for marketing, added to a list or shown to anyone else. When the operator uses ZeroCapture mail or SMS, we send the message for them: we keep the address or number in our delivery log for 30 days, so the operator can see whether it arrived, then remove it and keep only the message’s status. The operator’s device keeps its own log of its last 100 messages for up to 30 days. If the operator uses their own email server, the email goes from their device to that server and never through us.
• The photo online for 7 days. So the link in an email or SMS works, a copy of the photo is kept online for 7 days, then deleted, or sooner if the operator stops the link. If the photo already has a ZeroCapture Cloud link, that link is used instead. The page where the guest asks says so.
• Requests from online photo pages. When a guest asks on an online (Cloud) photo page, we hold the request for up to 24 hours until the operator’s device collects it and sends the message.
• Guest details on online photo pages. Answers a guest gives on an online (Cloud) photo page are held by us only in transit to the operator’s device, for at most 30 days, then deleted. No IP address, browser details or cookie is stored with them.
• Replying STOP. Where SMS come from a shared number, a guest can reply STOP. We then keep a scrambled (keyed hash) form of the number so we don’t send it SMS again, and nothing else.
• Who is responsible. The operator decides to collect these details and send these messages, so the operator is the controller of the guest’s address, number and answers, and we handle them on the operator’s behalf, as their processor. Emails are sent through Resend and SMS through Twilio. The operator’s SMS credits, and what each SMS used, are recorded on their ZeroCapture account; credits are bought with Google Play.
• Where. Copies of photos are stored with Cloudflare R2 in the EU, and the records with Google Cloud in London. Twilio and Resend may process a message in the United States (see below).

Help and feedback from the app

Operators can report a problem, suggest a feature or send us other feedback from the app, under Help & feedback. A report is sent only when the operator taps Send: nothing is collected in the background, and guests are never asked.

• What a report carries. The message the operator writes, the kind of report, and the time it was written. If they choose: an email address for our answer (filled in with their ZeroCapture account’s address when they’re signed in, which they can change or clear), and one screenshot (a picture of the app’s screen, or one they pick). The app warns that a screenshot can show guests’ photos, so they can choose one that doesn’t, or leave it out.
• Diagnostics, if the operator leaves them on. The app’s version, the device’s maker and model, its Android version, the plan, whether ZeroCapture Cloud is signed in (yes or no, never which account), the app’s settings, and the app’s recent log. Anything secret or personal in the settings is replaced with “[redacted]” before it leaves the device: the admin PIN and recovery code, email server passwords and user names, every email address and phone number, the SMS sender name, the Wi-Fi password, event names, places and captions, and any text the operator wrote. In the log, email addresses, phone numbers and anything that looks like a password or key are removed too. The operator can see exactly what is sent before sending it.
• What comes with every report. A random key the app makes for that install, so the app can show the operator their reports and our answers (we keep only a scrambled form of it, a hash), the plan and, if the operator is signed in to ZeroCapture Cloud, which account it is. No hardware id, and nothing about guests.
• Why. Only to help: to understand and fix the problem, consider the suggestion, and answer. We never use reports for marketing, and never add the reply address to a mailing list.
• Who sees it. ZeroCapture staff only. Reports are read in our helpdesk, which only ZeroCapture staff can sign in to, each with their own Google account protected by 2-Step Verification; every opening of a screenshot or diagnostics, and every answer, is recorded with who did it. Our answer is emailed to the reply address through our email provider, Resend, and shown in the app beside the report. We may also note things for ourselves on a report; those notes are never shown to the operator.
• Where. Screenshots and diagnostics are stored with Cloudflare R2 in the EU, and the reports with Google Cloud (Firebase) in London, as for ZeroCapture Cloud. They are never public: we open screenshots and diagnostics through links that stop working after a few minutes.
• How long. A report is kept for 12 months after it last changed (for example, after our last answer), then deleted with its files. Screenshots and diagnostics are deleted sooner: 90 days after we close the report. If you’d like a report deleted sooner, email contact@zerocapturestudio.com from the address you gave for our answer and we’ll delete it straight away. Once a report has been sent, the app deletes its own copy of the screenshot and diagnostics.
• IP addresses. Used only to slow down abuse, kept only in a scrambled (hashed) form, and deleted within a day or two.
• Our legal basis. Our legitimate interest in supporting the people who use our app and improving it, which a person sending us a report would expect. Sending a report is always the operator’s choice.

Sharing your setup (user setups)

This is the privacy notice for submissions to zerocapturestudio.com/setups. When you send us your setup with the form at /setups/submit, UK AI GROUP LTD (trading as ZeroCapture) is the controller of what you send.

• What we keep. The details you type (your display name, email address, any social handles, the setup type, title, where, the kit and your notes), your photos, the boxes you ticked with the version of their wording and when you sent the form, and what our reviewer decided. We keep a resized copy of each photo (at most 3,000 pixels on its longest side) with its metadata, such as camera details and location, removed, and delete the original you uploaded once that copy is made.
• What is shown. Only once a person at ZeroCapture has reviewed it: your photos, title, setup type, kit, notes, the display name you chose, the handles you gave (as links), and where, as you typed it. Never your email address. If you ticked “Feature me”, we may also post it on our social channels and tag your handles; if you didn’t, it stays on this website and is never posted.
• Your email address is used only about your submission: to confirm we have it, and to tell you we’ve published it, would like a change, have declined it, or have featured it. It is never shown, never added to a mailing list and never shared.
• Abuse protection. We keep the internet address your submission came from and your browser’s user agent for 30 days, then delete them. They are used only to stop abuse. Our rate limits keep scrambled (hashed) keys, deleted within a day or two.
• How long. While your setup is published, and for 90 days after it is declined, withdrawn or taken down (or after we ask for a change you don’t make), then we delete everything you sent.
• Where. Photos are stored with Cloudflare R2 in the EU and the records with Google Cloud in London, kept apart from ZeroCapture Cloud’s customer data. Emails are sent through Resend.
• Withdrawing. You can withdraw at any time, without a reason, with the link in the email we send you or by writing to contact@zerocapturestudio.com. Your setup leaves this website within 7 days, we make no new posts of it, and on request we take down posts we’ve already made wherever the social channel allows. Reposts, shares and screenshots made by other people are outside our control.
• Our legal basis. Your consent, given with the boxes on the form, for showing and posting your setup; withdrawing it doesn’t affect what was shown before. Our legitimate interest in keeping the form free of abuse, for the address and user agent.

Why we use your data

• With your consent: personalised ads on the Free plan, where the law requires consent (the UK and the EEA). Without it, Free shows non-personalised ads, which Google serves on the basis of its and our legitimate interest in funding the free plan.
• To fulfil a contract with you: checking Google Play purchases so the plan you paid for works, stopping Personal monthly payments once Personal is yours, sending the emails and SMS White label operators’ guests ask for, and running ZeroCapture Cloud for operators who subscribe.
• For our legitimate interests in running a secure, reliable service: request logs, limiting repeated tries and abuse, counting views and downloads of online pages without identifying anyone, and answering help and feedback reports sent from the app.

Who else handles it, and where

We use these providers to run the service: Resend (email, including photos guests ask to be emailed and our answers to feedback reports), Twilio (SMS guests ask for), Vercel (hosting this website and its services), Google (Google Play, Firebase, Google Cloud, and AdMob for the ads on Free) and Cloudflare (file storage in the EU, for ZeroCapture Cloud, messaged photos, setup photos and feedback screenshots and diagnostics). Some of them may process data outside the UK. Where they do, it is protected by the UK’s adequacy regulations or by the standard contractual clauses approved for UK transfers (the International Data Transfer Addendum). We don’t sell personal data, and we don’t share it with anyone else except where the law requires.

Children

Our app, shop and services are for businesses and adults, not for children under 13, and we don’t knowingly collect their data. Guests of any age can appear in photos an operator takes; those photos are the operator’s (see above).

Your rights

You can ask us for a copy of the personal data we hold about you, or ask us to correct or delete it, by emailing contact@zerocapturestudio.com. If you’re a guest at an event, the photos are the operator’s: ask them first, and we’ll help them where we hold any. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

We’ll update this page when what we collect changes, and change the date at the top.