Privacy

On your devices

Fuji Recipe Viewer for Mac and iPhone reads your photos and RAF files on your own device to show their recipes, previews and maps. Your My Photos stay on your devices and in your own private iCloud (see Library sync below); your Saved recipes stay on the device where you saved them. None of your photos or these lists go to the developer or this website unless you deliberately upload a photo.

Location Track and private iCloud

On iPhone, Location Track is optional. Its switch in Settings → Location Track is on by default, but nothing is recorded until you grant permission. Allow Location Access records while the app is open; Allow Always Access lets recording continue in the background. The app never asks for location permission at launch or just because Settings is open.

• Each recorded point is a precise time, a coordinate and a horizontal accuracy value — nothing else.
• Points are stored on your iPhone and in your own private iCloud database, the one tied to the Apple ID signed in to iCloud on your device.
• The developer cannot inspect your location history, and this website never receives it. It is never used for advertising or shared with anyone.
• Fuji Recipe Viewer for Mac reads the same private iCloud database, with the same Apple ID, to place photos on the map by capture time.
• You choose how long points are kept: 30 days, 90 days (the default), 365 days (1 year), or Forever. The app carries out this retention, so removal of aged-out points from your private iCloud database can lag while your iPhone is not running.
• Delete Location History… (Delete History) removes every point from your iPhone immediately. If your iPhone is offline, the matching private iCloud deletions stay pending and finish when it reconnects.

Library sync

Library sync keeps your Mac and iPhone photo libraries in step through your own private iCloud database. For each photo it stores the file name, capture date, camera, recipe settings, location and a 400-pixel preview. Originals are only sent when you ask (Get Original, Send to iPhone, Send to Mac) and are deleted from iCloud after import, or after 14 days if they are never received. On the Mac you choose which folders sync; on the iPhone you can stop sharing My Photos in Settings. The developer cannot see any of this data and the website never receives it.

Account and sign-in

An account is optional. You can create one with Sign in with Apple or with Google. For the account the service stores:

• The provider (Apple or Google) and your provider user ID.
• A verified email address, only if the provider supplies one — for Apple this can be a Hide My Email relay address.
• An internal account ID and secure session records that keep you signed in on your devices.
• For Sign in with Apple, an encrypted Apple refresh token, kept only so the service can revoke Apple sign-in when you delete your account.
• For sign-in, session refresh and sign-out, hour-long rate-limit counters keyed on a keyed hash (HMAC) of your IP address — never the raw address.

There is no password: Fuji Recipe Viewer never asks for, creates or stores one.

Publishing recipes

Publishing happens only from the Fuji Recipe Viewer app, as a deliberate, explicit action. When someone publishes a recipe, this site stores:

• The recipe settings read from the file (film simulation, dynamic range, white balance, and the other in-camera settings shown on the recipe page) and the camera model.
• A scaled preview photo without metadata: EXIF, GPS, and MakerNote data are stripped on your device before it is sent, so the photo never reaches this server with them.
• A title and/or display name, only if the person publishing chose to enter one. Leaving both blank publishes the recipe anonymously.
• The account that published it, so you can see and delete your own uploads under My Uploads.

Purchase verification

Browse is part of the paid iPhone app. To unlock it, the app sends Apple's signed AppTransaction purchase record to this service, which verifies it and issues an app token. The service keeps the transaction ID and environment together with a hash of a random device key the app generates on first use, to limit how many devices share one purchase and to deter abuse; the same hash is also used to deduplicate view counts from the app, as described below. The device key is stored on the server only as a hash. Verification does not require an account and the purchase record is not tied to one. App tokens expire after 90 days and expired ones are cleaned up automatically, so deleting your account does not remove them.

Website visits, likes and reports

• View counts are deduplicated per visitor using a hashed identity — the app's device key hash if the request carries one, otherwise a hashed, peppered IP address. Never a raw IP address, and never the device key itself.
• The hashes used to deduplicate views are kept for about two days and then removed.
• Likes require an account and are counted once per account.
• If you submit a report on a recipe, the chosen reason and your optional message (up to 500 characters) are stored, together with a hashed IP address to rate-limit abuse of the report form. They are kept with the report until the report or the recipe is removed.
• The public pages set no cookies, load no third-party scripts and store nothing in your browser: website views use a hashed IP address.

Retention and deletion

A published recipe stays up until you delete it, you delete your account, or it is removed following a report. Anyone can flag a recipe with the Report button on its page.

Deleting an account: open Settings → Fuji Recipe Viewer account → Delete Account…, confirm with the account you signed in with, then tap Delete Account. The app sends the exact confirmation DELETE together with a one-use re-authentication for that same account; that re-authentication cannot be reused or applied to a different account. The server then removes your account, sign-in identities, sessions, your likes, your published recipes and the reports about them in a single transaction, and signs out every session.

In that same step the server also places Apple token revocation and photo file removal in a durable cleanup queue. That cleanup runs afterwards and is retried if it fails, so it is not instantaneous. A Google disconnect can also remain pending on your device for a while.

Deleting your account does not delete anything stored on your own devices: your local My Photos,Saved and Location History remain. Location History has its ownDelete Location History… (Delete History) control in Settings.

No advertising or tracking

There is no advertising, no tracking, no third-party analytics and no data sold or shared for marketing. Everything described above is used only to make the app and the website work.

Contact

Questions about this policy or your data: hello@nickroodenrijs.comEmail us— see also Support.