1. Who we are and what this policy covers
OldRoll Web at https://www.oldroll.io is operated by Pixl Concerto Technology Limited. In this policy, “we”, “us” and “our” refer to that operator.
This policy covers OldRoll Web and feedback submitted through the website. The OldRoll mobile apps and other websites have their own policies. Choosing a website region or language does not establish your residence or change the rights that applicable law gives you.
For privacy questions or requests, contact support@oldroll.io.
2. Photos and editing work
We process the photos you choose and the editing instructions you provide to carry out your requested task and return its result. Some work happens in your browser; camera and filter rendering uses server processing.
We use your editing photos for the processing you request. We do not use them to train models, publish them as examples, or add them to an account gallery. Choosing a photo for editing does not attach it to a feedback message.
Uploaded editing photos are retained for up to 7 days from upload, and generated results for up to 14 days from creation. Temporary processing and retry copies follow the same deadlines. Accessing an image does not extend these periods. We may delete files earlier when they are no longer needed. Processing logs and image snapshots retained for legal requirements follow the separate rules in section 7.
These temporary storage periods do not provide an online gallery or guarantee that an image will remain available for the full period. Keep your original photos and save results you want to retain. Recent work in your browser and images you submit as feedback are handled separately below.
3. Accounts, browser storage and preferences
You can create or sign in to an OldRoll Web account with an email verification code, Google or Apple. Each account has an email address, which you can change after verifying the new address. We use account and authentication information to create and maintain your account and verify control of it. This includes your account email and identifier, linked provider identifiers, session credentials and necessary verification records.
When you use Google or Apple, we receive the identifiers and available email information that the provider supplies for sign-in. This can include an Apple private relay address. Google and Apple handle information on their own services under their own policies.
We use necessary browser storage to keep you signed in. Signing in, signing out, changing accounts or deleting an account does not turn browser editing work into account storage or automatically remove it. You can clear site data through your browser controls.
We send verification emails for actions you request and security notices for completed account changes, where an account email is available. Signing in, changing your account email and deleting an account do not subscribe you to marketing emails.
OldRoll Web can keep recent photos, editing state and layouts in the same browser so you can return to unfinished work. This is not an online gallery, cross-device storage or a permanent backup.
We use browser storage for essential service settings. This serves a different purpose from analytics cookies.
You can remove site data through your browser settings. Doing so may remove recent work and saved preferences. Private browsing, browser storage limits and changing browsers or devices can also affect availability. Keep your original photos and save results you want to retain.
4. Website analytics
We use Google Analytics, provided by Google, to understand how people find the website, use editing tools, obtain results and encounter problems. Analytics is enabled by default when you visit.
Google Analytics uses cookies and similar technologies to distinguish browsers and visits. Analytics can include pages viewed, referral sources, browser or device categories, interface language, feature use, account activity and errors. Google Analytics can derive approximate location, such as country and city, from your IP address.
When you sign in, we use a non-public account identifier (User-ID) to understand activity associated with the same account across visits, browsers and devices. We also record whether you were signed in when an event occurred. We do not use device fingerprinting.
We do not send your photos, thumbnails, original file names, image addresses, email, Google or Apple user identifiers, verification codes, authentication tokens, feedback messages or attachments to analytics. We also exclude text you enter for dates, raw search terms and complete editing settings. We do not enable advertising, remarketing or Google signals.
We send the account identifier to Google Analytics only while you are signed in. Analytics information remains subject to the retention rules in section 7 after account deletion.
For more information about Google's handling of this information, see How Google uses information from sites or apps that use its services.
Your browser may offer controls to block or clear cookies. Clearing cookies does not itself stop future analytics collection or delete information already received by Google. To ask about your information or request deletion, contact support@oldroll.io.
5. Feedback and necessary technical information
When you submit feedback, we receive the description, related feature and email address required by the form, plus any images you choose to attach. We use them to understand the issue, respond and address the request. Images are optional; we do not automatically attach the photo in your editor.
Closing the form before submission preserves its draft during the current session. After submission, closing the form or clearing browser storage does not delete the message already received. Please avoid sending sensitive or unrelated information. Retention is explained in section 7.
We use necessary technical information to deliver the service, protect its security and reliability, and resolve faults. We handle this operational information separately from website usage analytics. Retention is explained in section 7.
6. Why information is used and who receives it
Our purposes are to deliver the editing you request, provide and secure your account and sign-in methods, keep recent work and preferences available, send requested verification and account-security messages, respond to feedback, maintain service reliability and security, and understand website usage.
We use service providers for hosting and processing, account authentication, email delivery, and protection against automated abuse. Depending on their role, these providers receive the editing, account, contact, technical or verification information needed to provide those services. Google provides the analytics service described in section 4. Google and Apple also handle information through their own authentication services as described in section 3.
We may disclose necessary information where the law requires it or where disclosure is lawfully necessary to address abuse or protect people's rights and safety. This does not authorize unrelated use of your editing photos. We do not sell your editing photos or provide them for advertising.
When you follow an external link or use your device's save or share options, the destination service handles the information you choose to send under its own terms. This does not remove our responsibility for the service providers acting on our behalf.
7. How long information is kept
We retain your personal information only for as long as necessary to fulfill the purposes described in this policy. Once it is no longer necessary, we delete or anonymize it in accordance with applicable law. Different information has different retention rules:
| Information | Retention |
|---|---|
| Editing images and temporary results on the server | Uploaded photos: up to 7 days from upload. Generated results: up to 14 days from creation. The same deadlines apply to processing and retry copies. Processing logs and snapshots follow the separate rules below. |
| Recent work and essential preferences in your browser | Subject to the storage conditions in section 3 and your browser's controls. |
| Account, authentication and verification records | Kept while needed to provide and secure your account, verify requested actions and complete account changes. Account-closure and related processing records retained for statistical analysis, service improvement or user support follow the two-year period below. Records kept for legal requirements follow the applicable legal retention rules. |
| Google Analytics user and event detail | 14 months, with no extension for new activity. |
| Browser analytics identifiers | Up to 6 calendar months, without renewal on each visit. Browsers may remove them earlier. Signed-in activity may still be linked through the account identifier; the 14-month detail retention period still applies. |
| Information used for statistical analysis, service improvement and user support, including feedback | No more than 2 years after termination of the agreement governing your use of the service. For account-related information, the two-year period begins when account deletion takes effect. Any shorter retention period specified in this policy continues to apply. |
| Processing logs retained for legal requirements | 200 days, so they can be made available to the relevant authorities upon a lawful request. Uploaded or generated editing images included in these logs are retained using disk snapshots. Unless the relevant authorities request access in accordance with applicable law, we do not internally retrieve, access or use these retained logs or snapshots. |
| Other necessary technical information | Kept only as needed to operate and secure the service and troubleshoot faults. We delete or anonymize information no longer needed for these purposes, subject to applicable legal retention requirements. |
Where applicable laws and regulations require a different mandatory retention period, that period applies. We limit that retention to the information and period needed to meet the requirement.
You can request account deletion through your account controls after verifying your identity and confirming deletion. Once deletion takes effect, the old account can no longer be used to sign in and its sign-in sessions are revoked. We remove its login email and linked sign-in identities; limited records may remain as described above. Later registration with the same email or sign-in provider creates a new account and does not restore the deleted account. Deletion does not delete your Google or Apple account or automatically clear photos and editing work stored in your browser.
After account deletion, we may retain anonymized statistics for internal analysis and service improvement. To request deletion of your personal information, contact support@oldroll.io.
8. Your choices and rights
You can browse without selecting a photo, submit feedback without an image, and clear locally stored site data. Editing a photo requires the information needed to process it; submitting the feedback form requires its stated contact and issue fields.
Depending on the law that applies, you may have rights to access or obtain a copy of your personal information, correct it, request deletion, restrict or object to processing, or receive a portable copy. You may also complain to the relevant data-protection authority. Contact support@oldroll.io to ask about these rights.
We ask only for information reasonably needed to identify the relevant records and verify your request. Account records may help identify account-related information, but editing photos are temporary and are not an account gallery. We may not be able to identify a particular image or browser record from a name alone. Clearing browser storage does not itself delete your account, feedback or other server records.
9. Children and security
OldRoll Web is not intended for children under 13. If you are a minor, you must have permission from your parent or guardian to use the service. Any higher minimum age or other requirements under applicable law also apply. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child that we should not have collected, we will delete it. Parents and guardians may contact support@oldroll.io with questions or deletion requests.
We use reasonable technical and organizational measures appropriate to the information handled. No internet transmission or storage system is completely secure. This statement does not limit any duties or remedies that applicable law provides.
10. Updates and contact
We will post the current policy on this page and update the date above when it changes. For material changes affecting how we use information or your rights, we will provide a prominent notice on the website before the changes take effect and state their effective date. Changes required by law or urgent security needs may take effect sooner. When a change requires your permission, we will request it before using information for that purpose; continuing to browse does not by itself give that permission.
For privacy questions or requests, contact support@oldroll.io. For an issue with OldRoll Web, you can also use Web feedback. We don’t handle or reply to mobile app support requests sent to this address. For app support, visit OldRoll App support.
Contact address: Pixl Concerto Technology Limited, ROOM 3C, 3/F WEST WING, TSIM SHA TSUI CENTRE, 66 MODY ROAD, TSIM SHA TSUI, HK.