The short version: RollGuard doesn't have a server, doesn't have accounts, and never sees your photos. Here's the detail behind that claim, including what's required to say for users in the EU, UK, California, and elsewhere.
This policy is issued by David Smith, trading as RollGuard, a sole trader based in New South Wales, Australia. Wherever "we," "us," or "our" appears below, it refers to David Smith. Contact details are at the end of this page.
RollGuard scans photos in your iPhone's camera roll to look for identity documents, payment card numbers, screenshots containing passwords or credentials (and photographed WiFi or router labels), and sensitive images, using Apple's own on-device Sensitive Content Analysis.
All of this scanning happens using your iPhone's own processor. RollGuard has no server to send photos to, and no photo, thumbnail, or scan result is ever transmitted off your device. Scanning works even in Airplane Mode.
If you ask RollGuard to check photos stored only in iCloud, it downloads those originals to your phone using Apple's Photos system — a download only, over Wi‑Fi; nothing about them is ever sent anywhere.
RollGuard has no account system. There's no sign-up, no login, and no email address collected to use the app. Nothing about your usage of the app is tied to your identity.
When RollGuard scans a photo, the text it recognises is examined on your phone and then discarded. For a photo that's flagged, RollGuard keeps just enough to show you the result: which photo it was, what kind of thing it found, a masked fragment (the same "•••• 4242" you see in the review queue), and your decision (kept, hidden, or deleted). The full text of the photo is never stored.
For a photo that isn't flagged, RollGuard keeps only that it was checked, when, and basic photo metadata — no text, no content, no record of what was in it. Photos beyond your free 30-day window that the background check counts but can't show you aren't stored at all; only the counts persist.
All of this lives in a local database on your device only. There is no hidden index of your library, and a device backup carries the same masked view you see in the queue — no text or fragments a person could use. Nothing is backed up to a RollGuard server, because none exists.
Choosing Keep, Hide, or Delete for a flagged item changes its status in this local record, but does not remove the record — the entry, with its masked fragment, stays in the local database so RollGuard can avoid re-flagging something you've already reviewed. The only way to remove this data entirely is to delete the app, which erases the whole local database with it. Like any app, RollGuard's local database is included in your own encrypted device backups until those rotate — which is why nothing sensitive is ever stored unmasked in the first place. We don't retain any copy of this data ourselves, anywhere, at any time — there is nothing on our side to delete, since nothing is ever sent to us.
RollGuard Pro is a one-time in-app purchase, billed and processed by Apple through the App Store — RollGuard never sees your payment details. To confirm your purchase and restore it if you reinstall, RollGuard uses RevenueCat, a purchase-management service. When you buy or restore Pro, RevenueCat receives the purchase receipt and a random identifier the app generates, and uses them to keep track of your entitlement. RevenueCat never receives your photos, scan results, or anything about your library — only purchase information, which is not linked to your identity. You can read RevenueCat's own privacy policy for more detail. The rest of the app works entirely on your device whether or not you ever buy anything.
We do not sell your data, and have never sold your data, to anyone, for any purpose.
RollGuard has an optional switch on its home screen — off by default — to send anonymous crash and error reports. If you turn it on and RollGuard crashes, or a scan fails unexpectedly, it sends a technical report of the error and your device model to Sentry, a crash-reporting service, so the problem can be fixed. It never sends anything about your photos, your scan results, or your identity: no names, no device identifiers, no images, no text from your library. Reports are retained for 90 days. With the switch off, the reporting software is never even started, and no connection is made. The app works identically either way.
Because RollGuard has no server and no central database of user data, the biggest usual security risk — a breach of stored personal information — doesn't really apply here: there's nothing on our side to breach. Your scan results live only in your own device's local storage, protected by whatever security measures your iPhone itself already provides (device passcode, encryption at rest) — and, as described above, they contain no raw text from your photos.
The only data that exists outside your device at all is the narrow, non-identifying purchase-processing information handled by RevenueCat and Apple, and — only if you've opted in — anonymous crash and scan-failure reports handled by Sentry. Each maintains its own security practices and compliance obligations for that data, independent of us.
If we ever became aware of an issue affecting that data, we'd investigate promptly and notify affected users and any relevant regulator as required by law. Given the scope of what's actually collected, we don't expect this to arise, but we take the obligation seriously regardless.
RollGuard never takes any of these actions automatically or without you choosing them.
If you're located in the EU, UK, or EEA, data protection law (GDPR, or the UK's equivalent) gives you specific rights over any personal data processed about you. Because RollGuard processes almost everything entirely on your own device and never transmits it to us, most of these rights are already satisfied by design — there is simply no copy of your scan data on our side to access, correct, or delete.
Where RollGuard does rely on RevenueCat as a data processor, our legal basis for that processing is the performance of a contract with you — completing the purchase you've requested — and our legitimate interest in preventing fraudulent transactions. Where you opt in to crash and error reporting or join the launch list, the legal basis is your consent, which you can withdraw at any time by turning the switch off or unsubscribing.
You have the right to: access any personal data we hold about you; request correction or erasure of it; object to or restrict its processing; request a copy of it in a portable format; and lodge a complaint with your local data protection supervisory authority if you believe we haven't handled your data properly. To exercise any of these rights, contact us using the details below.
Note: we'll reassess our obligations under Article 27 of the GDPR — including whether an EU representative is required — as our EU and EEA user base develops.
If you're a California resident, the CCPA (as amended by the CPRA) gives you the right to know what personal information we collect, request its deletion, and opt out of its sale or sharing. RollGuard does not sell or share your personal information, and has never done so. Because the app collects no personal information beyond the narrow, non-identifying purchase-processing data described above (and, if you opt in, anonymous crash and error reports), there is very little for these rights to act on — but you're welcome to contact us to confirm or request deletion regardless.
Residents of other US states with similar privacy laws (including but not limited to Virginia, Colorado, Connecticut, and Utah) have comparable rights, which we extend on the same basis described above.
RollGuard is rated 4+ on the App Store. This rating reflects the nature of what the app is designed to detect (including sensitive imagery), not that the app displays such content itself — RollGuard shows no images beyond what's already in your own camera roll, and it blurs any photo it flags as a sensitive image until you choose to reveal it. RollGuard does not knowingly collect personal information from children, and given the app has no account system, no information is knowingly collected from anyone, of any age.
Because RollGuard doesn't operate a server and doesn't transmit your photos or scan results anywhere, there is no cross-border transfer of that data to worry about. The only data that leaves your device at all is the narrow purchase-processing information described above, handled by RevenueCat and Apple, and — only if you've opted in — anonymous crash and scan-failure reports handled by Sentry; each maintains its own compliance framework for international data transfers.
If you choose to join the launch list on rollguard.app, your email address is stored by Buttondown, a small newsletter service, and used to send you one email when RollGuard launches — nothing else. Buttondown sends a confirmation email first, so only addresses you've confirmed are ever on the list. You can unsubscribe at any time using the link in any email, and the list is deleted after launch.
rollguard.app is a static website. It sets no cookies, runs no analytics, and doesn't track visitors. Visiting the site loads nothing from any third party — even fonts are served from rollguard.app itself. The only third-party request the site ever makes is the one you trigger yourself: joining the launch list sends your email address to Buttondown, as described above.
If this policy changes, the "last updated" date at the top of this page will change too. Continued use of RollGuard after an update means you accept the revised policy.
Questions about this policy, or to exercise any of the rights described above:
support@rollguard.app