Privacy Policy

Effective Date: April 2, 2026 · Last Updated: April 2, 2026

Your memories belong to you. BackInTime will never sell your photos, use them for advertising, or use them to train our AI without your explicit consent. Your photographs are processed solely to restore them for you — nothing else.

Overview

BackInTime (“we”, “us”, “our”) is an AI-powered photo restoration service. We understand that the photographs you share with us are deeply personal — they hold family memories, history, and loved ones. This Privacy Policy explains in plain language what personal information we collect, how we use it, how we protect it, and what rights you have over it.

This policy applies to the BackInTime website, iOS app, Android app, and all related services (the “Service”).

Your Photo Data at a Glance

1. Who We Are

BackInTime Pte. Ltd.
Email: [email protected]
Website: https://www.backintime.app

For users in the European Union/EEA, BackInTime acts as a data controller in respect of your personal data.

For users in Singapore, BackInTime is the organisation responsible for your personal data under the Personal Data Protection Act 2012 (PDPA).

2. Information We Collect

We collect the following categories of information when you use the Service:

2.1 Information You Provide

• Account Information — Name, email address, password (hashed) — to create and manage your account.
• Profile Information — Display name, profile picture (optional) — to personalise your experience.
• Payment Information — Billing address, payment card details (processed by our payment provider — we do not store full card numbers) — to process subscription payments.
• User Content (Photos) — Photographs you upload for restoration — to provide the photo restoration service.
• Communications — Emails, support messages you send us — to respond to your enquiries.

2.2 Information We Collect Automatically

• Device Information — Device type, operating system, browser type, unique device identifiers.
• Usage Data — Features used, pages visited, restoration history, session duration.
• Log Data — IP address, access times, error logs.
• Cookies and Tracking Technologies — Session cookies, analytics cookies, preference cookies (see Section 10).
• Diagnostics and Performance Data — Device model and manufacturer, operating system version, app version, API request outcomes and error reports.

About diagnostics. Our mobile apps and this website report performance and error information automatically, so that we can find and fix faults. On iOS and Android this is limited to technical data — device model, operating system version, app version, and whether an API request succeeded or failed — and is not linked to your account. On the website, Grafana Faro additionally assigns a random session identifier so that events from a single browsing session can be read together; it is not tied to your account and is not used to build a profile of you.

We do not use this data for advertising, and we do not sell it. There is no advertising identifier in either mobile app.

2.3 Information from Third Parties

• Social Login Providers (e.g., Google, Apple) — Name, email, profile photo for account creation.
• Payment Processors (e.g., Stripe) — Payment confirmation, billing status.
• Google Analytics — Aggregated web usage trends (website only).
• Grafana Cloud — Application performance monitoring and error diagnostics: device model, OS version, app version and API request outcomes.

2.4 Special Categories of Data — Photographs

Your photos may contain sensitive information, including:

• Faces and biometric features — Our AI processes facial features to perform restoration and enhancement.
• Images of minors — Old family photographs may depict children, including individuals who are currently under 18.
• Sensitive personal histories — Photos may reveal health conditions, religious practices, or other sensitive matters.

We treat all photographs as sensitive personal data and apply heightened security measures accordingly.

3. How We Use Your Information

• Providing the photo restoration service
• Managing your account
• Processing payments
• Sending transactional emails (receipts, alerts)
• Improving and developing the Service
• Security, fraud prevention, and abuse detection
• Sending marketing communications (only with your consent)
• Complying with legal obligations

3.1 What We Do NOT Do

• We do not sell your personal data or photographs to third parties.
• We do not use your photographs for advertising.
• We do not train our AI models on your photographs without your separate, explicit, and informed consent.
• We do not share your photos with other users.
• We do not use AI-processed outputs for any purpose other than delivering them to you.

3.2 AI Training Transparency

We believe you have the right to know exactly how your photos are used. Our position is straightforward:

We will never use your photos to train or improve our AI models without asking you first.

If we ever wish to use User Content for model training or improvement purposes, we will:

1. Ask for your separate, opt-in consent — it will not be bundled into general Terms acceptance.
2. Clearly explain what data would be used, how it would be used, and for how long.
3. Allow you to withdraw that consent at any time, with no impact on your access to the Service.
4. Provide the option for your data to be anonymised before use.

Until you have given that consent, your photos are used for one purpose only: restoring them for you.

4. How We Share Your Information

4.1 Service Providers (Data Processors)

We engage trusted third-party companies to help operate the Service. These providers act as data processors under our instruction and are contractually obligated to protect your data. Examples include cloud infrastructure providers, AI processing services, payment processors, email services, analytics providers, and customer support platforms.

4.2 Legal Compliance and Safety

We may disclose your information if required by law, court order, or government authority, or when we believe disclosure is necessary to protect the rights, property, or safety of BackInTime, our users, or others.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred as part of the transaction. We will notify you via email and/or a prominent notice on the Service before your data is transferred and becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information for other purposes with your explicit consent.

5. International Data Transfers

BackInTime operates globally and your data may be transferred to and processed in countries other than your country of residence.

For EU/EEA Users: We transfer data outside the EU/EEA only where appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and transfers to countries with an adequacy decision.

For Singapore Users: We transfer data overseas in compliance with the PDPA's overseas transfer obligations, ensuring comparable protection.

For California Users: We do not sell or share personal information as defined under the CCPA.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

• Account information: For the duration of your account + 90 days after deletion.
• User Content (original photos): For the duration of your account + 30 days after deletion.
• Processed Content (restored photos): For the duration of your account + 30 days after deletion.
• Payment records: 7 years (legal and tax obligations).
• Usage logs and analytics: 12 months (rolling).
• Support communications: 3 years from last interaction.
• Security logs: 12 months.

Photo Deletion: When you delete a photo from the Service or close your account, we will permanently delete your original and restored photos from our systems within 30 days, except where we are required to retain the data by law.

7. Your Rights

7.1 Rights for All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention obligations).
• Data Portability: Receive your data in a structured, machine-readable format.

7.2 Additional Rights for EU/EEA Users (GDPR)

• Restriction of Processing: Request that we restrict processing of your data in certain circumstances.
• Object to Processing: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw any consent you have given at any time.
• Lodge a Complaint: Lodge a complaint with your local data protection authority.

7.3 Additional Rights for California Users (CCPA)

• Know: Know what personal information we collect, use, disclose, and sell.
• Delete: Request deletion of personal information we have collected.
• Opt-Out of Sale: We do not sell personal information; this right is not applicable.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

7.4 Additional Rights for Singapore Users (PDPA)

• Access: Request access to personal data we hold about you.
• Correction: Request correction of inaccurate personal data.
• Withdrawal of Consent: Withdraw consent, subject to legal or contractual restrictions.
• Data Portability: Right to data portability.

7.5 How to Exercise Your Rights

To exercise any of your rights, please contact us at [email protected] or through the account settings in the app. We will respond within the timeframes required by applicable law.

8. Your Privacy Controls

Beyond your legal rights, BackInTime provides in-app controls so you can manage your photo data directly:

• Delete a photo: Photo detail screen → Delete
• Delete all photos: Account Settings → My Photos → Delete All
• Close your account: Account Settings → Close Account, or see Delete Your Account for the full process, timings and what we retain
• Download your data: Account Settings → Export My Data
• Manage cookie preferences: Account Settings → Privacy → Cookie Preferences
• Opt out of marketing: Account Settings → Notifications → Marketing, or unsubscribe link in any email
• AI training consent: Account Settings → Privacy → AI Training

9. Children's Privacy

9.1 Age Restrictions on Accounts

The Service is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete the data promptly.

If you are a parent or guardian and believe your child has provided personal information to us, please contact us at [email protected].

9.2 Photographs Containing Children

Old family photographs uploaded to the Service may depict individuals who are currently minors. Our processing of such photographs is strictly limited to providing the restoration service you have requested. We apply additional protections to all User Content, including heightened security, no commercial use, and no AI training without consent.

10. Cookie Policy

10.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies to operate and improve the Service.

10.2 Types of Cookies We Use

• Strictly Necessary: Authentication, security, session management — cannot be disabled.
• Performance/Analytics: Understanding how users interact with the Service — can be disabled.
• Functional: Remembering your preferences and settings — can be disabled.
• Marketing: Personalised advertising and remarketing — can be disabled.

10.3 Managing Cookies

You can manage your cookie preferences through:

• The cookie banner presented on your first visit.
• Your browser settings (note: disabling necessary cookies may affect functionality).
• Our Cookie Preferences Centre (available in account settings).

11. Security

We take the security of your personal data seriously and implement industry-standard technical and organisational measures to protect it, including:

• Encryption in transit: All data is transmitted over HTTPS/TLS.
• Encryption at rest: Stored photos and personal data are encrypted.
• Access controls: Strict role-based access controls for staff.
• Security audits: Regular security assessments and penetration testing.
• Incident response: A documented data breach response plan.

However, no method of transmission or storage is 100% secure. In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and relevant authorities in accordance with applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date, send you an email notification, and display a prominent notice on the Service. We will provide at least 14 days' notice before material changes take effect.

13. Contact and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy, please contact us:

Privacy Team — BackInTime
Email: [email protected]

For EU/EEA Users: You have the right to lodge a complaint with your local data protection authority.

For UK Users: You may contact the Information Commissioner's Office (ICO).

For Singapore Users: You may contact the Personal Data Protection Commission (PDPC).

This Privacy Policy was last updated on April 2, 2026.