Privacy Policy

SUPLOAD LLC

Version 2.4.1 | Published: October 23, 2026 | Effective Date: October 23, 2026 | Last Updated: October 23, 2026

1. Introduction

Supload ("we," "us," "our") is a camera app for work, developed by Supload LLC, a Pennsylvania limited liability company. Supload replaces the multi-app juggle (Camera, Photos, cloud storage) with a single workflow: capture, organize into groups, and upload directly to your cloud storage.

This Privacy Policy explains how we collect, use, store, share, and protect your information when you use the Supload mobile application ("the App"), the Supload customer portal ("the Portal," a separate service for managing subscriptions, user allocation, and billing), and the Supload marketing website at sup-load.com ("the Website").

Our core privacy principle: your photos and videos go directly from your device to your own cloud storage account (Google Drive, Dropbox, or Microsoft OneDrive). We never store, access, or process your media files on our servers. We collect only the minimum data necessary to provide the service.

By creating a Supload account, you agree to the practices described in this policy. If you do not agree, do not create an account or use the App.

2. Privacy at a Glance

3. Information We Collect

3.1 Account Information

When you sign in, we collect the following from your authentication provider (Google, Apple, or your organization's single sign-on):

The acceptance record does not include your IP address or device user agent. We also keep a log of the legal-document change notices we send you (the document, version, delivery channel, and date), so we can show which notices you received.

When you link a cloud storage provider (Google Drive, Dropbox, or OneDrive), we receive the account identifier and email address associated with your cloud account through the OAuth authorization flow. This may be different from the email you used to sign in. We keep a cloud connection record on our backend holding the provider, that account identifier and email address, and the identifier of the device that linked it. We use this information solely to establish and manage the connection to your cloud storage. The record never holds a folder, a file, or a token.

3.2 Photos and Videos

Supload captures photos and videos using your device's camera. These files are:

• Stored locally on your device within your local install of the iOS Supload app as temporary groups until you upload or delete them

• Uploaded directly to your linked cloud storage (Google Drive, Dropbox, or OneDrive) when you initiate an upload, running in the background with checkpoint-based resume

• Deleted from your device automatically only after your cloud provider confirms the complete file was received and stored, never on a partial or interrupted transfer. You can also delete items yourself, keep them after sharing a link, or move an item that is too large to upload into your Photos library ("Save to Photos & Remove")

• Never sent to, stored on, or processed by Supload's servers

We do not access, view, analyze, scan, or use the content of your photos or videos on our servers for any purpose other than facilitating their upload to your chosen cloud storage provider. Our backend does not store your photos or videos, their file or folder names, your group names, or your upload history; the App keeps those on your device. If you opt in to usage analytics, upload events are counted as described in Section 3.4. When you share a group by link (the App uses a link for larger shares), the App uploads the shared items into a folder it creates for that share in your cloud storage (under "Shared via Supload") and makes that folder viewable by anyone who has the link. A sharing link the App creates stays open until you change the folder's sharing in your cloud provider's own settings; the App cannot turn it off, set an expiry date, or add a password.

Whenever you browse your cloud folders or upload, Supload caches your cloud storage folder structure (folder names and hierarchy) locally on your device so you can choose a destination and queue uploads without an internet connection. This cached data is stored locally on your device within the App's private storage and is never sent to Supload's servers. It is deleted when you unlink the cloud provider or delete your account. When offline mode is on, the App refreshes this cache in the background using iOS background processing to keep your folder structure current. When you turn off offline mode, the App asks whether to keep or clear your saved folders, and the cache is deleted if you choose "Clear saved folders."

Supload LLC is not responsible for any loss, corruption, or inaccessibility of content stored locally on your device prior to upload completion, except to the extent caused by Supload LLC's gross negligence or willful misconduct. Until an upload is confirmed complete, your content exists only on your device and is solely your responsibility. The App's copy of your content is excluded from your device backups (see Section 6.1). For more information, see our Terms of Service, Section 5.4.

3.3 Location Data (Optional, You Control This)

If you enable "Content location" in the App's privacy settings (Profile, then Permissions), Supload records the GPS coordinates where a photo or video is captured and stores them in a private file on your device, within the App's sandboxed storage. These coordinates power the in-app map, which shows your capture locations, useful for job sites, inspections, and field documentation.

These coordinates are not written into your photo or video files (they are not added to the photo's EXIF metadata), are not uploaded with your media to your cloud storage, and are never sent to Supload's servers or included in analytics. Some location data does leave your device, and none of it reaches Supload. To show a place name for each capture spot, the App sends that spot's coordinates to Apple's geocoding service from your device when the photo is taken. The in-app map loads its map images from Apple. If you tap "Open in Maps," you choose Apple Maps or Google Maps, and the App hands that spot's coordinates to the one you pick; Apple's or Google's privacy policy governs what it does with them. If you use the share feature to send a group of photos, Supload includes a short, readable location summary (for example, a street or city derived from those coordinates) in the message you send, so the people you share with can see where the photos were taken. That summary goes only to the recipients you choose, never to Supload. If Content location is on and you choose the location style for naming new groups (Profile, then Camera settings), the street or town of a group's first capture becomes the group's name; a group's name is also the name of the folder the App creates in your cloud storage and appears in the subject line when you share. The coordinates themselves are never used in a name.

The App requests "While Using the App" location authorization only (never "Always"). When you disable Content location, the App stops recording new capture locations immediately.

3.4 Usage Analytics (Opt-In Only, You Control This)

If you opt in, we collect usage analytics to improve the App, such as feature usage patterns, app performance metrics, and error rates. Performance metrics come from Apple's MetricKit framework and cover launch and hang times, CPU, memory, disk writes, and time in the foreground, reported once a day per device. Analytics events are recorded with your account identifier, which is what lets us delete them when you delete your account. Personal details are stripped from event content before storage, as described below.

Analytics are off by default. You must opt in to share analytics data. You can change this at any time in Profile, then Permissions, then "Share usage analytics." The setting turns off automatically when you sign out or a different account signs in on the device. If you belong to an organization, the analytics you choose to share also update your last-active date and the organization's usage totals that its administrators see (Section 11); your last-active date is kept on your membership record, which your organization retains as its own record (Section 11), and the underlying events are deleted after 28 days.

How we protect your analytics data when you opt in:

• First-party only. Analytics go exclusively to our own backend (Supabase). We never share them with third-party analytics services.

• Personal details stripped before storage. On your device, every analytics event passes through a filter that removes an extensive set of personal-data keys (including email, display name, GPS coordinates, IP address, device identifiers, file and folder paths, group names, tokens, and secrets) at every level of the event and redacts email addresses found in any value. Our backend then applies its own filter, which removes identifier-shaped keys at every level and caps every remaining value at 256 characters, before the event is stored.

• Consent is checked before every event. If you have not opted in, no analytics events are sent. No restart required, and opting out stops transmission immediately and discards any events still queued on your device.

• Short-lived. Auto-purged after 28 days.

We do not use any third-party analytics SDKs.

3.5 Crash Reports

Crash reporting is automatic and helps us keep the App stable; there is no separate switch. Because crash reports are tied to your account, signing out stops them: the App clears the crash identity and discards any reports still queued. A crash that happens while you are signed out is kept on the device and sent under the next account that signs in. Crash reports include the error type and message, the stack trace, the screen or action where the crash happened, the app version and build number, the device model and iOS version, and your account identifier, so we can match a crash to a support request and delete the report with your account. We scrub known personal-data patterns from crash reports using an email filter and the same keyword blocklist we use for analytics before they are stored, though rare fragments may remain. Crash reports are stored for up to 90 days and then automatically deleted. On account deletion, local crash log files are also deleted from your device.

3.6 Customer Portal and Website

The Supload marketing website (sup-load.com) provides product information, pricing, FAQ, and legal documents. The customer portal (hosted on Cloudflare Pages) does not use cookies. It keeps your sign-in session in your browser's local and session storage, which is required for the portal to function and is cleared when you sign out. When you start a purchase on our website, the account page keeps a five-minute return code in session storage so it can complete your purchase when you come back from the payment page. We do not use advertising or cross-site tracking cookies on the portal or the website, and we do not use advertising networks or data brokers. Cloudflare's bot-protection features on our domains may set strictly necessary, short-lived security cookies (such as __cf_bm or cf_clearance) to tell people apart from automated traffic; these are security cookies, not advertising or analytics cookies.

Our website runs no analytics or tracking scripts; the Turnstile bot check on our waitlist form is described below. Cloudflare, which hosts and protects the site, processes standard request data (your IP address, the page requested, and your browser type) to deliver and secure the site and to show us aggregate traffic counts (requests, bandwidth, visitors, and countries) computed from its own edge logs, with no script and no cookie, under the Cloudflare Privacy Policy. We also use Google Search Console to see how our site appears in Google Search. It relies on Google's own search data and places no script or cookie on your visit to our website.

If you fill in a form on our website (today, the launch waitlist form, which appears on several pages), we store what you type (your email address, and your name, company, and message if the form asks for them and you add them), which form you used, and any notes our staff write while handling your request, on our own backend. We do not record your IP address or browser details with a form entry. The waitlist form uses Cloudflare Turnstile, a small script that checks your browser to tell people from automated traffic; Cloudflare processes the signals that check needs under the Cloudflare Privacy Policy, and we receive only a pass-or-fail result, which we do not keep. The form links to this policy. We use form entries only to respond to you and, for the waitlist, to tell you about the launch; see Sections 7.1 and 17.

3.7 Device and Technical Information

We access certain device capabilities for core functionality. iOS controls each of them, and you can change any of them in iOS Settings:

You can change or revoke any permission at any time in iOS Settings under Supload. Revoking a required permission may limit the App's functionality. We do not request "Always" location access. "Allow Tracking" is not requested because Supload does not track you (see Section 9).

Security and account-activity log. When you take certain security-sensitive or billing-sensitive actions on your account, for example signing in through the web, linking a cloud provider, making a purchase in the App, changing your subscription, or deleting your account, our backend records an entry in a server-side audit log. Each entry includes the action taken, the account identifier of the user who took it, the date and time, a few details about the action (such as the provider or plan involved, or the domain of an email address), and, where the request carries them and for security and fraud-prevention purposes, a shortened form of the IP address (its network prefix) and the device or browser user agent. We use this log to secure accounts, investigate suspicious activity, support billing and compliance, and meet our legal obligations. These entries are retained for up to one year (see Section 7.1). This log is separate from your Terms acceptance record, which does not include your IP address or user agent (see Section 3.1).

Sign-in and session records. Separately, our authentication system records each sign-in, sign-out, token refresh, and account change with your email address, display name, the sign-in method, and the time, to detect account takeover and abuse. These entries are kept for 180 days and are deleted with your account. While you are signed in, each active session also records the IP address and the device or browser user agent most recently used with it (updated at each token refresh, about hourly in use); a session record is deleted when you sign out, when you delete your account, or after 90 days without use (90 days in which it has not been refreshed).

3.8 Information We Do NOT Collect

We do not collect advertising identifiers (IDFA), browsing history, contacts, health or fitness data, biometric data, call logs or SMS messages, or data from other apps. For purchases made in the App, Apple processes your payment and shares no payment-method details with us. For purchases made on our website, Stripe processes your payment and shares limited billing metadata with us. For card-based payments, Stripe's notice names the card brand and the last four digits, which we remove before the record is stored; what we keep is the identifier Stripe assigned to your payment method. Stripe's checkout offers cards and other payment methods, such as digital wallets and pay-over-time options; the exact metadata differs by method, but we never store your full card or bank account number, wallet login credentials, or other payment credentials. Stripe processes those directly, and if you pay with a third-party payment method, its provider receives your details under its own terms.

3.9 In-App Feedback and Diagnostic Logs (Optional, You Control This)

If you submit feedback through the feedback button at the top of Profile, we collect your message, category (bug, feature request, or general), app version, device model, and iOS version. You may optionally include your email address for follow-up. Profile, then Send Feedback instead opens an email to [email protected] in your mail app; we handle that email like any other message you send us (see our Subprocessors page, Google Workspace).

If you enable "Include Diagnostic Logs" when submitting feedback, Supload attaches on-device logs from your current app session using Apple's OSLogStore framework. These logs help us diagnose the issue you are reporting. Diagnostic logs may include app state transitions, network request metadata, timestamps, and context messages written by the App. They do not include the contents of your photos or videos, your cloud storage credentials, or your cloud file contents.

Diagnostic logs are truncated to 100 KB before submission. You can also export logs to a file from the feedback form (the feedback button at the top of Profile, then Export Logs), which generates a .log file you control. Supload does not receive a copy of exported files unless you choose to include them in a feedback submission.

Feedback submissions are accessible to Supload LLC staff for support and product improvement purposes. Feedback submitted without the diagnostic logs toggle enabled is stored without any device logs. If you do not wish to share diagnostic logs, do not enable the toggle. Feedback is retained for up to 90 days and then deleted automatically. When you delete your account, the message text, contact email, and diagnostic logs you submitted are erased, and only a de-identified record may be kept to improve the service (see Section 7).

3.10 Information Collected Before Account Creation

You may use the App's camera, local photo organization, and on-device features before creating an account. Data kept locally during pre-account use includes crash reports (captured automatically and stored on your device until you sign in) and iOS permission grants (stored by iOS, not by us). Crash reports are uploaded to our servers only after you create an account or sign in, and locally stored records may then be associated with your new account. Until you create an account or sign in, the App sends nothing to Supload's backend. If you open our Terms or Privacy Policy from the App before signing in, your device loads them from our website (Section 3.6); like any internet request, that carries your IP address, which Cloudflare, which hosts our website, processes briefly to deliver and secure the page (Section 3.6).

4. How We Use Your Information

We do not use your information for advertising, profiling, automated decision-making, selling to third parties, or cross-app tracking. We do not use your content or your personal data to train artificial intelligence or machine learning models, we do not permit our service providers to do so on our behalf, and the App does not send your data to any third-party AI service. We do not make any automated decisions that produce legal effects or similarly significant effects on you.

We conduct data protection assessments as required by applicable law.

5. Third-Party Services and Subprocessors

A complete list of subprocessors is published at sup-load.com/subprocessors. We update that page before adding or replacing a subprocessor and give Enterprise administrators at least 30 days' notice by email; anyone else can join the notice list by emailing [email protected]. Enterprise customers may object as described in our Data Processing Agreement. If we must replace a subprocessor urgently to keep the service secure or available, we will give as much notice as we can and explain why.

Each subprocessor listed in Part 1 of that page processes personal data for us under written data processing terms that require it to protect that data with appropriate security measures, to use it only to provide its service to us, and not to sell it. We have reviewed those terms and confirm that each subprocessor protects your data at least as well as this Privacy Policy describes. One of them is Google Workspace, which we use for our business email, so support and privacy requests you send us are handled there. Some of these providers also process limited data as independent businesses for their own purposes, such as fraud prevention and security at Stripe; that processing is described in their own privacy policies (see Section 5.3). The sign-in, cloud storage, and App Store providers you connect (Google, Apple, Microsoft, and Dropbox) handle the data you send them under their own privacy policies and your own agreement with them; they are your providers, not ours, and we do not control them.

5.1 Cloud Storage Providers

Supload asks each provider for the permission that lets you choose a destination folder, including folders you already have, and upload to it. On every provider, the permission you grant on the authorization screen allows broader access than the App uses, and the App limits itself to the operations described here. Supload does not read, download, or modify the contents of your existing files on any provider. The specific permission requested is shown on each provider's authorization screen. If future versions require additional permissions, we will disclose the changes before requesting them.

Google Drive. Supload asks for Google's full Drive permission, which Google describes on its authorization screen as "See, edit, create, and delete all of your Google Drive files." We ask for it because, until Google supports its Picker in iPhone apps, it is the only permission that lets the App show your existing folders and upload into any of them without a separate picker step. You decide whether to grant it, on Google's own authorization screen. The App's Google Drive features need this permission to work as designed: if you do not grant it, or you remove it later, uploading to Google Drive will not work until you grant it again, and the rest of the App keeps working. Google controls this permission and reviews the apps that use it; Supload's use of it is subject to that review and to the Google API Services User Data Policy below, and if Google changes or withdraws it, the App's Google Drive features may stop working until we update the App. When Google makes a narrower, folder-by-folder permission available to iPhone apps that can do the same job, Supload will move to it and we will update this policy. With this permission, the App: reads the names and structure of your folders so you can choose where to upload; checks by name whether a folder it is about to create already exists in that location, and whether your chosen destination still exists; creates folders and uploads files into the folder you choose or, when you share a group by link, into a folder it creates for that share; on resume of an interrupted upload, reads the names of the files in that upload's destination folder to avoid uploading the same file twice; reads the names of the files it uploaded before it deletes its own local copy; stamps the folders it creates, and may stamp the folder you choose as a destination, with a small hidden app-only marker so it can recognize them later; reads your account email address and display name when you link; reads how much free space your Drive has; when you share a folder from the App, sets a view-only "anyone with the link" permission on a folder Supload created; and, when offline mode is on, receives from Google a list of recently changed items so it can refresh the folder cache, keeps only the folders, and discards everything else on your device. The App never reads the contents of any file, never deletes or trashes anything in your Drive, and does not touch Shared Drives. Our staff do not read information received from Google APIs except with your consent, for security, to comply with law, or in aggregated and anonymized form.

Dropbox. Supload asks Dropbox for permission to read the names and structure of your files and folders, to write files, to create and read sharing links, and to read your account information. That permission lets the App see file and folder names across your Dropbox, but the App reads folder names and structure to let you choose a destination; lists the names of the files in your chosen destination folder (or, if you have not chosen one, in the top level of your Dropbox) before it deletes its own local copy, on retries, and when you share, and keeps those names on your device only; writes only the files you upload; reads your account email address and account identifier when you link, and how much free space your Dropbox has before an upload, and keeps the free-space figure on your device; and, when you ask for a sharing link, creates a public view-only link to a folder Supload created, or reuses a link already on that folder if it is public and view-only.

Microsoft OneDrive. Supload asks Microsoft for permission to read and write your OneDrive files and to read your basic profile. That permission is broader than the App's use: the App reads folder names and structure to let you choose a destination; lists the names of the files in your chosen destination folder (or, if you have not chosen one, in the top level of your OneDrive) before it deletes its own local copy, on retries, and when you share, and keeps those names on your device only; writes only the files you upload; reads your account email address and display name when you link; and, when you ask for a sharing link, creates a public view-only link to a folder Supload created.

A sharing link the App creates stays open until you change the folder's sharing in your cloud provider's own settings; the App cannot turn it off, set an expiry date, or add a password.

Each provider's handling of the files you upload is governed by its own privacy policy: the Google Privacy Policy, the Dropbox Privacy Policy, and the Microsoft Privacy Statement.

Google API Services User Data Policy. Supload's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Artificial intelligence and machine learning. Supload does not use Google Workspace APIs, including the Google Drive API, to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Information received from Google APIs is used only to provide and improve the user-facing features described in this Privacy Policy.

What we do and do not do with cloud provider data. Supload accesses, uses, and stores information from Google Drive, Dropbox, and Microsoft OneDrive only to provide and improve the user-facing features described in this Privacy Policy. From the provider you link we receive the account identifier and email address associated with that account, an access token, and the folder information described above. The access token is stored only in your device's iOS Keychain and the cached folder information is stored only on your device, as described in Section 6.1. We do not sell this information, transfer it to data brokers or information resellers, or use it for advertising of any kind, including targeted, personalized, retargeted, or interest-based advertising. We do not use it to determine credit-worthiness or for lending purposes, to build or sell databases, or to develop, improve, or train artificial intelligence or machine learning models. We disclose it to third parties only as described in this Privacy Policy.

Our responsibility for the data we access. Supload LLC is responsible for the privacy, security, and integrity of the data it collects or accesses from the cloud storage account you link, using the measures described in Section 6. Your use of that cloud storage account itself remains governed by your own agreement with the provider.

5.2 Authentication Providers

Google Sign-In, Sign in with Apple, and your organization's single sign-on. Supload uses Microsoft's MSAL library both for Enterprise single sign-on (via Microsoft Entra ID) and to connect consumer Microsoft OneDrive accounts for cloud storage. For Enterprise customers using directory sync (SCIM 2.0), your identity provider sends Supload user provisioning data (email address, display name, given and family name, an external identifier, active status, and a role mapping) to manage organization membership; provisioning is limited to email domains your organization has verified. When your identity provider deprovisions you, Supload disables your membership in that organization and releases its seat; it does not delete your account or any data. Supload does not share data back to the identity provider beyond deprovisioning confirmations. See the Google Privacy Policy, the Apple Privacy Policy, and the Microsoft Privacy Statement.

5.3 Payment Processing

Apple. Pro purchased inside the App is billed by Apple through Apple In-App Purchase. Apple is the merchant of record and processes the payment. We never receive a card number, bank account number, wallet credentials, or any other payment credential from Apple. What we receive and store is the subscription record described in Section 7.1, which we use to unlock Pro on your account and to keep it in step when you renew, cancel, or receive a refund. Your purchase is governed by Apple's own terms and the Apple Privacy Policy.

Stripe. Pro purchased on our website, and all Enterprise subscriptions, are billed by Stripe through a secure web checkout that offers cards and other payment methods, such as digital wallets and pay-over-time options. If you pay with a third-party payment method, its provider receives your details under its own terms. At checkout Stripe collects your name, email address, and billing address, which it uses to take payment, calculate sales tax, and prevent fraud; we do not store your name or billing address. We receive subscription status, the email used at checkout, and limited billing metadata; for card-based payments Stripe's notice names the card brand and last four digits, which we remove before the record is stored, keeping the identifier Stripe assigned to your payment method. We never store full card or bank account numbers or wallet credentials; if a bank payment method is used, Stripe's notice may name the bank and the last four digits of the account, which we remove before the record is stored. Stripe's checkout asks you to accept our Terms of Service before you pay, and we record that you did. See the Stripe Privacy Policy.

Stripe's checkout and customer-portal pages are operated by Stripe. On those pages Stripe collects identifying information about the device and browser you use, including through cookies and similar technologies, and uses it to operate and improve the services it provides to us, including fraud detection, authentication (for example, Link), and analytics about its own services. That processing is described in the Stripe Privacy Policy. Our own website and portal do not set advertising or cross-site tracking cookies (see Section 3.6).

5.4 Backend and Infrastructure

Supabase provides authentication, database, crash reporting, analytics, and session management. The data it stores for us lives in the United States (AWS US West); our server functions run in the Supabase region nearest the request. See the Supabase Privacy Policy. When you link a cloud provider, Supload sends a device identifier to our backend to record which device owns that connection, used for security and to manage your cloud integrations. Cloudflare hosts the customer portal and website, provides DNS and content delivery, and protects them against automated abuse. See the Cloudflare Privacy Policy.

5.5 Email Delivery

Resend delivers the email we send you: account and organization notices, billing and renewal reminders, and, if you asked for it, launch news. Receipts for purchases made on our website come from Stripe, and for purchases made in the App from Apple. Resend processes your email address to deliver messages. See the Resend Privacy Policy.

5.6 SDK Privacy Manifests

Where a third-party SDK we bundle provides an Apple Privacy Manifest (PrivacyInfo.xcprivacy), we review it before adding or updating that SDK. SDKs that access or transmit user data are supabase-swift (backend, including its bundled Auth component for authentication), GoogleSignIn-iOS (Google sign-in), GTMAppAuth (Google OAuth authorization state), AppAuth-iOS (OAuth flows), gtm-session-fetcher (Google HTTP transport), SwiftyDropbox (Dropbox API), MSAL (Microsoft sign-in and OneDrive), and KeychainAccess (secure local storage). The App also bundles AppCheckCore, a Google library whose device-attestation path is disabled in this release, so it neither collects nor transmits data, and the Google utility libraries it depends on (GoogleUtilities, Promises, and their interop shims), which perform no data collection of their own. We also use swift-crypto for cryptographic operations. Additional utility libraries, including swift-concurrency-extras, are listed in the App under Profile, then Terms & Policies, then Open Source Licenses. We update this list before adding new SDKs.

6. Data Storage and Security

6.1 On Your Device

6.2 On Our Backend (Supabase / AWS US West)

Our server functions run in the Supabase region nearest the request; the data they store lives in the United States. Row Level Security policies are applied to tables containing user data. The iOS app uses only the Supabase anon key (not service_role), so RLS cannot be bypassed from the client. Our hosting provider keeps operational logs (request records that include IP addresses and browser or device details) for about one day.

6.3 Security Measures

All network communication uses HTTPS/TLS (ATS fully enabled, no exceptions). Cloud OAuth tokens are stored in the iOS Keychain with hardware encryption and afterFirstUnlockThisDeviceOnly access control, are not synchronized to other devices, and are never stored on Supload's servers. Personal-data sanitization is applied to all analytics. Secrets are managed through secure build processes and are never stored in source code.

Supload staff may access account information (email, organization membership, audit logs) for support, compliance, and operational purposes. Staff use named accounts protected by multi-factor authentication. Through Supload's own support tools, access is limited to member-level account data, and we record administrative changes and are extending that record to reads. Through our hosting provider's administrative console, staff have full administrative access to our backend records, under the provider's own access controls and logs, and use it only to operate and support the service. Neither route reaches your photos, videos, or cloud provider credentials, which we do not hold. Our internal analytics tools do not surface your individual usage activity. Authorized staff can access crash diagnostics, including crash reports and aggregated crash dashboards, as required to operate and stabilize the service. We scrub known personal-data patterns from crash reports using an email filter and a keyword blocklist before they are stored, though rare fragments may remain.

Supload LLC implements commercially reasonable security measures but does not guarantee absolute security. No method of electronic transmission or storage is completely secure. You are responsible for maintaining the security of your device, authentication credentials, and cloud storage accounts. Supload LLC is not responsible for unauthorized access resulting from compromised device security, weak or reused passwords on third-party services, or security incidents at your cloud storage provider.

7. Data Retention and Deletion

7.1 Retention Schedule

Account information is kept only while your account exists. Everything else follows the fixed schedules above or stays under your direct control. Deleted data may remain in our hosting provider's backups for up to about seven days before those backups age out; we do not use backups to restore individual accounts.

7.2 Account Deletion

Profile, then Profile (under the Account heading), then Delete Account (double confirmation).

Server-side: an Edge Function cascades deletion to your user data tables, including analytics, crash reports, cloud connection records, sign-in and session records, and your organization memberships, and your Supload account is removed from our authentication system. The Terms acceptance record (Terms version, Privacy Policy version, timestamp, email, and waiver-notice flag) is retained for six (6) years for legal claims defense, and the log of legal notices we sent you for about four (4) years after each notice, then both are permanently deleted. If you sign up again with the same email address, your new account is reconnected to your former personal organization, including its subscription and billing history and any audit entries still held. Feedback is handled as described in Section 3.9: the message text, contact email, and diagnostic logs are erased, and only a de-identified record may be kept. Audit trail entries that record actions taken under your account have your identifier removed; the action, time, shortened IP address, and user agent remain as part of our security and compliance records until the organization is deleted or the 1-year audit-trail retention period expires, whichever comes first. We rely on our legitimate interest in security, fraud prevention, and maintaining accurate compliance records as the basis for this limited, time-bound retention. All other account data is permanently deleted, except for the purchase records described immediately below. If any table deletion fails due to a technical error, we will identify and remove the residual data promptly upon detection.

Purchases made through Apple or on our website. The subscription record is scrubbed in place. The token or identifier tying the record to your Supload account and, for Apple, the stored transaction payload are erased. A minimal billing record (the transaction or subscription identifier, the product or plan, the status, and the dates) is kept for no longer than two (2) years so that refund, dispute, and cancellation notices Apple or Stripe send after your account is gone can still be processed, then purged. Your email address on a personal organization record is erased and replaced with a one-way hash for no longer than the same two-year period, so that you can be reconnected to a subscription you previously purchased if you return. This organization-level scrub applies to a personal organization of which you are the only member. If an organization has other members, its records remain that organization's data (see Section 11), and your membership in it is removed as part of the deletion cascade. Deleting your Supload account does not cancel an Apple subscription; cancel that in your Apple Account settings. A subscription billed through Stripe is set to stop at the end of the current period.

We also clear the App's cloud tokens on your device and ask Google and Dropbox to revoke Supload's access. Microsoft does not offer an app-side revocation; we delete the tokens from your device, and you can remove Supload in your Microsoft account settings (account.live.com/consent/Manage). You can always revoke Supload's access directly from your provider's own permissions page (your Google Account permissions, your Dropbox connected apps page, or your Microsoft account consent settings).

Device-side: the App's documents, cached account record and sign-in hints, Keychain items, and local crash logs are deleted; camera settings and cached thumbnails may remain until you remove the App.

Not affected: files already in your cloud storage. You manage those directly.

8. Your Privacy Rights

8.1 All Users

• See your data. Photos are in your cloud. Account info is in your profile.

• Get a copy of your data. Email [email protected], or use Profile, then Download My Data (under the About heading) where it is available. We provide a copy of the account information Supload stores about you in a machine-readable format, within 45 days: your profile, organization memberships, cloud service connections, Terms acceptance and legal-notice records, subscription and purchase records, usage analytics (if you opted in), crash reports, feedback submissions, and audit trail entries. OAuth tokens and information that belongs to another party (such as another organization member's data) are excluded for security. The in-app export does not include your sign-in and session records (Section 3.7), the Stripe event ledger and billing audit records (Section 6.2), or website form entries; email [email protected] if you want those as well.

• Delete everything. Profile, then Profile (under the Account heading), then Delete Account.

• Turn analytics on or off. Profile, then Permissions, then "Share usage analytics." Immediate. It turns off automatically when you sign out or a different account signs in.

• Control location. Profile, then Permissions, then "Content location." Immediate.

• Unlink cloud services. Profile, then Cloud Services. We delete the connection record when you unlink. You can also revoke Supload's access from your provider's own permissions page (Google Account permissions, Dropbox connected apps, or Microsoft account consent settings at account.live.com/consent/Manage).

8.2 United States Residents

Wherever you live in the United States, you can ask us to see, copy, correct, and delete your data, free of charge; we answer within 45 days and decide any appeal within 45 days. If you live in a US state with a comprehensive privacy law, including but not limited to California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, you have rights to access, delete, correct, and port your data, to opt out of sale, targeted advertising, and profiling, and to limit the use of sensitive personal information. We will not discriminate against you for exercising any of these rights.

We do not sell your personal data. We do not share your personal data for targeted advertising. We do not share your personal data with data brokers or ad networks, or with anyone for their own advertising or marketing. There is no sale or sharing to opt out of. For details on our tracking practices, see Section 9.

Universal Opt-Out Mechanisms. We recognize Global Privacy Control (GPC) and similar opt-out preference signals as valid requests to opt out of sale or sharing. Because we do not sell or share personal data for targeted advertising, there is no sale or sharing to opt out of, regardless of whether you use GPC.

For CCPA/CPRA: categories collected are identifiers, commercial information (your subscription and purchase records), internet activity (opt-in usage analytics, the shortened IP address and device or browser user agent in our security and account-activity log, and the IP address and user agent in your sign-in session records), geolocation (optional, stored on your device only), professional or employment-related information (your organization membership and role), and audio/visual information (on your device and cloud only). We do not sell personal information or share it for cross-context behavioral advertising. In the twelve months preceding the effective date of this Privacy Policy, Supload LLC has not sold or shared any personal information.

Sensitive Personal Information. Under CCPA/CPRA, "sensitive personal information" includes categories such as precise geolocation and biometric data. Supload records precise geolocation only if you enable Content location, and only in a private file on your device that powers the in-app map. It is not written into your photos, not uploaded with your media, and not transmitted to or stored by Supload. We do not use sensitive personal information to infer characteristics about you.

California Shine the Light Law. California residents may request information about our disclosure of personal information to third parties for those third parties' direct marketing purposes. Supload does not share personal information with third parties for their direct marketing purposes.

Right to Appeal. If we deny a privacy rights request, we will explain why and provide instructions for how to appeal the decision. You may submit an appeal by emailing [email protected] with the subject line "Privacy Rights Appeal." We will decide appeals within 45 days.

8.3 European Economic Area and United Kingdom (GDPR and UK GDPR)

The App is not offered in the European Economic Area or the United Kingdom, and we have not appointed a representative under Article 27 of the GDPR or the UK GDPR. If we make the App available in those regions, we will appoint the required representatives and update this policy before we do. If you are located in the EEA or the UK and have questions about this policy, contact [email protected].

Data Controller: Supload LLC, 502 W 7th ST, STE 100, Erie, PA 16502, United States · Privacy Contact: [email protected] · Legal Bases: contract performance, consent, legitimate interest, legal obligation.

8.4 Users Outside the United States

Supload is offered in the United States. If you are outside the United States and use our website or contact us, we handle your information as described in this policy, and you can reach us at [email protected] with any request about it.

8.5 Exercising Your Rights

Contact [email protected]. Response within 45 days. No fee. We may verify your identity before fulfilling a privacy rights request by matching the information you provide with the account information we have on file. We will not fulfill requests that we cannot reasonably verify. You may designate an authorized agent to submit a privacy request on your behalf. We may require the agent to provide written authorization from you and may verify your identity directly.

9. Tracking and Advertising

Supload does not track you across other apps or websites. No IDFA, no ads, no ad networks, no data brokers, no third-party cross-app analytics, no cross-context behavioral advertising, no device fingerprinting. No App Tracking Transparency prompt because there is no tracking.

We also honor Do Not Track (DNT) browser signals. Because we do not track users across websites or apps, DNT signals do not change our data practices.

10. Age Requirement

Supload is designed for working professionals. You must be at least 18 years old to create an account. In the App, when you create an account and each time you sign in, and on the Portal when you create an account, you must check a box confirming you are at least 18 (or the age of majority where you live, if higher), as stated in our Terms of Service. Where your app store provides an age signal for your account, we use it only to confirm you meet the 18-plus requirement, we do not use it for any other purpose, and we do not keep it once the check is done; where no signal is available, Supload relies on your confirmation. We do not collect a birth date. The App is rated for adults on every storefront where it is offered (18+, or the local equivalent).

We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, including through an app store age signal, we will promptly delete their account and all associated data and restrict account creation consistent with applicable law. If you believe a user under 18 has created an account, contact [email protected].

Several states have enacted app-store age-verification and parental-consent laws, some of which are in force and others of which take effect in 2027. These laws place their primary obligations on app store operators and require developers to act on the age signals the store provides. Supload's 18-plus rating and 18-plus account requirement are designed to keep the App outside the scope of minor-directed obligations under those laws.

11. Enterprise and Organization Accounts

If your account belongs to an organization, its administrators manage membership, seats, and organization settings through the Portal. Administrators can see, for each member, the email address, display name, role, seat status, join date, last-active date and last sign-in date, and any per-member upload cap the organization sets; which cloud storage services each member has linked and whether each connection is working; a report of members idle for 30 days or more, and pending seat invitations; a CSV export of that information; and the organization's audit log, which shows who took each action, what it was, and when, with details such as which cloud service was linked and the domain of that cloud account's email address, but not the IP address or device details recorded with it. Administrators cannot see your photos or videos or the names of your files or folders. Members of the same organization can see each other's names, email addresses, roles, seat status, join dates, and last-active dates (including those of members who have been removed from the organization), and organization-wide usage totals. Organizations own their organizational data (team configurations, membership and role records, and the reports and audit log about their own organization). Individual users' photos remain their own, uploaded to their personal cloud storage (Google Drive, Dropbox, or OneDrive) and not accessible to administrators through the App.

If your organization has verified your email domain and turned on automatic membership, your account is attached to that organization when you sign in with a matching address, and its administrators can see and manage your membership as described above. You will see the organization in your Profile. An administrator can remove you, but signing in again with a matching address adds you back; until we add a Leave option, the lasting way to leave is to delete your account (Section 7.2).

Supload does not currently send notifications about your organization to outside addresses (webhooks). If we add this feature, we will update this section, including what each notification contains, before it is available.

Each organization's data is logically separated through Row Level Security policies. No organization can access another organization's data through the App or customer portal.

11.1 Data Processing Agreements

Our Data Processing Agreement (DPA) forms part of every Enterprise customer's agreement from its first day of Enterprise use, including trials. The DPA documents the roles, responsibilities, and obligations of each party regarding the processing of personal data. A signed copy is available on request at [email protected].

12. On-Device Processing and AI Features

All processing happens on your device: capture (AVFoundation), encoding, thumbnail generation, night mode, red-eye reduction, QR code scanning, text recognition, document detection, and caching. The App includes on-device features powered by Apple system frameworks (AVFoundation, Vision). These process data entirely on your device and never send content to external servers.

We do not use your content or personal data to train artificial intelligence or machine learning models, we do not permit our service providers to do so on our behalf, and the App does not send your data to any third-party AI service. Future on-device intelligence features (scene detection, OCR enhancements, document scanning improvements) will use Apple's Core ML and Vision frameworks exclusively, run entirely on your device, and never train on your content. We will give at least 30 days' notice before introducing any feature that uses artificial intelligence or machine learning on your data. The on-device Apple framework processing described above is already disclosed here and is not a new feature.

13. International Data Transfers

Supload LLC is based in the United States, Supload is offered in the United States, and the account data described in this policy (account information, crash reports, analytics, feedback, subscription records, and billing metadata) is stored in the United States on Supabase (AWS US West); our server functions run in the Supabase region nearest the request. If you use our website from outside the United States, you provide any information directly to us in the United States. The App is not offered in the European Economic Area or the United Kingdom (see Section 8.3).

Our subprocessors commit to Standard Contractual Clauses and equivalent safeguards in their data processing terms where their own transfers require them. We protect all personal data with the security measures described in Section 6, including encryption in transit and at rest.

Photos and videos transfer directly from your device to your own cloud provider and never pass through Supload.

14. Data Breach Notification

14.1 Definition

A "security breach" means an incident in which account data (email, display name, user ID, or other personal information) is accessed, acquired, or disclosed by an unauthorized party.

14.2 Notification to Users

We will notify affected users without undue delay after confirming a security breach, and no later than any deadline required by applicable state breach notification law.

Notification will be sent to the email address associated with your account and, when feasible, through an in-app notification.

Supload LLC's notification obligations apply only to data that Supload LLC stores on its servers (account information, analytics, crash reports, feedback, and billing metadata). Because Supload does not store, access, or process your photos or videos, Supload LLC has no obligation to notify you of security incidents at your cloud storage provider (Google Drive, Dropbox, or OneDrive) or authentication provider (Google, Apple, Microsoft). You should monitor security notifications from those providers directly.

14.3 Notification to Authorities

We will comply with all applicable state breach notification laws, including any requirements to notify state attorneys general, consumer reporting agencies, or affected individuals, and any requirements to provide credit monitoring services.

14.4 What We Provide

Breach notifications will include: a description of the nature of the breach, the types of data involved, the likely consequences, the measures taken or proposed to address the breach, and contact information for questions.

15. Business Transfers

If Supload LLC is acquired by or merged with another company, or if we sell substantially all of our assets, your account data may be transferred to the successor entity as part of that transaction. We will use commercially reasonable efforts to notify users of any such transfer and of any material changes to this Privacy Policy that result. Until a new privacy policy takes effect, the successor entity will be bound by the commitments in this Privacy Policy. You may delete your account at any time. In the event of bankruptcy or receivership, we will use reasonable efforts to ensure any successor entity adheres to the commitments in this Privacy Policy.

One exception: information we received from Google APIs, such as the account identifier and email address of a Google account you linked, may be transferred as part of a merger, acquisition, or sale of assets only with your explicit prior consent, as Google's API policies require. We will ask for that consent before any such transfer, and information for which consent is not given will be deleted rather than transferred.

16. Law Enforcement Requests

Supload LLC discloses account data to law enforcement only where we reasonably believe we are legally required to do so. We evaluate each request for legal validity, scope, and jurisdiction, including compliance with the Stored Communications Act (18 U.S.C. Section 2701 and following) and other applicable law. We may challenge overbroad or legally deficient requests. Our policy is to notify affected users before disclosure unless we are prohibited from doing so by law or we reasonably believe notice would create a risk of harm. We produce only the minimum data responsive to a valid request. Contact [email protected] for questions.

17. Marketing Communications

If you joined our launch waitlist or asked us about Supload through a form on our website, we email you about the launch and about your request. You may opt out of marketing at any time via the unsubscribe link or by contacting us. We process opt-outs within 10 business days. We never send marketing to users who have not opted in or who have opted out.

18. Changes to This Policy

We use a two-tier process, matching our Terms of Service.

Routine changes. We update the "Last Updated" date, notify account holders by email, show an in-app notice with the effective date, which asks you to confirm the new version the next time you open the App, and record what changed in the Version History at the end of this policy. We update our Subprocessors page before adding or replacing a subprocessor, with the notice described in Section 5; that is a routine change to this policy.

Material changes (changes that expand what we collect, how we use it, or who we share it with): we provide notice at least 30 days before the change takes effect and require your affirmative re-acceptance in the App before the changed policy applies to you. Material changes apply prospectively only.

We keep a record of the change notices we send, as described in Section 3.1.

19. App Store Privacy Label

How to read this label. Apple's App Store privacy label uses a broad definition of "collect" that counts transmitting data off your device, including to your own cloud storage, even when Supload never receives or stores it. Because the App's privacy manifest declares the types listed above, they appear here as Data Linked to You, and never as data used to track you. Your photos and videos and your precise location are still never sent to, stored on, or accessed by Supload's servers, as described in Sections 3.2 and 3.3. This label reflects Apple's off-device definition, not any storage by Supload.

20. Contact

Privacy: [email protected] General: [email protected] Legal / Law Enforcement / DPA Requests: [email protected] Website: https://sup-load.com Mail: Supload LLC, 502 W 7th ST, STE 100, Erie, PA 16502, United States

Version History