Privacy Policy

ShutterPin · Effective 2026-10-20

ShutterPin is published by SINSABRIDGE Inc. ((주)신사브릿지).

ShutterPin reads your phone's location and sends it to your camera over Bluetooth so that the photos you take are geotagged. This page explains exactly which data the app accesses, how it is collected and used, and what does and does not leave your device.

Location data — what we access, and why

ShutterPin accesses and uses your device's location. This is the core function of the app.

What is accessed. Precise location (GPS-level latitude, longitude, altitude and accuracy) and approximate location, together with the timestamp of each fix. On Android this uses the ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION permissions; on iPhone it uses Core Location. Precise location is required — a camera geotag built from an approximate fix would be wrong by kilometres.
When it is accessed. While you are using the app, and — only if you grant it separately — in the background, including while the screen is locked and the app is closed. On Android this uses ACCESS_BACKGROUND_LOCATION with a location foreground service; on iPhone it is the "Always" location permission. Background access exists for one reason: so the app can wake when your camera powers on and start geotagging without you having to open it first. If you decline background access, the app still works while it is open.
How it is used. Each location fix is sent over a direct Bluetooth Low Energy connection to the camera you have paired. Your camera writes the coordinates into the EXIF metadata of the photos it takes. The app also shows you the current fix and the transmission status on screen.
Optional on-device recording. If you turn on track recording, the app keeps a log of your location fixes on the phone so you can export a GPX track or write coordinates into photos afterwards. Track data stays on your phone. You control recording and exports in the app.
Who it is disclosed to. Location is sent to your connected camera over Bluetooth. When you open a map, Apple Maps on Apple devices or OpenStreetMap tiles on Android receive requests for the area being displayed. These requests can reveal the viewed area and your network IP address to the map provider. Opening an external map shares the selected location with that map app. Location is not uploaded to SINSABRIDGE for advertising or analytics and is never sold.

Your location never reaches our servers

Location and tracks are processed on your device and are not uploaded to ShutterPin servers. Camera transfers use Bluetooth. Map requests go to the map provider as described above. Diagnostics, whether the default connection-quality events or optional detailed logs, never include coordinates or photos. If you agree to app improvement data, the app also reads the lens name and the camera's firmware version from the photo information it already receives during photo download; nothing else from your photos is sent.

Other data the app accesses on your device

Bluetooth. Scanning for and connecting to your camera, including the camera's name, address and model code. These are used to establish and keep the link; the camera's brand, model, model code and names are also included in connection-quality diagnostics (described below), while its Bluetooth address never leaves your device. On Android the scan permission is declared with neverForLocation, so Bluetooth scanning is never used to derive your position.
Photos, if you use post-tagging. When you ask the app to write coordinates into photos already on your phone, it reads and updates those files on the device. The photos are never uploaded.
Notifications. To show connection and transmission status.

What we collect on our servers

Account identifier. An opaque ID with no name or email attached. You do not need to sign in: when you first open the app it creates a random identifier on your device (on iPhone it is kept in the system keychain) so it survives reinstalls, and we store it to recognise the same installation again. Earlier Android versions used the opaque user ID from Google Sign-In instead.
Linked Google or Apple account (optional). If you choose to link a Google account, or on iPhone Sign in with Apple, so that you can recover the same account on another device, we store only the opaque account ID that Google or Apple issues for ShutterPin and which ShutterPin account it is linked to. When you recover an account this way, the automatic account created on the new device, including its diagnostics, is merged into the recovered account. We do not store your email address, name or password, even when the sign-in token includes an email address. For Sign in with Apple we also keep the Apple token needed to revoke it when you delete your account.
Purchase status. Which plan you hold, when a subscription expires, and the store transaction identifier — so your purchase can be restored.
Trial start date. Recorded once, when your account is first created.
Connection-quality diagnostics. Camera brand, model and model code, the camera's device name (including a name set on the camera) and the camera name you set in the app, phone model, OS and app versions, and pairing and connection results, linked to your account — described in detail under Diagnostics below. You can turn this off in Settings.
App improvement data (only if you agree). Photo download results, the camera's firmware version, the names of lenses you use with it, whether another phone took over the camera's Bluetooth connection, and your choice on plan notices, linked to your account — described under App improvement data below. The app asks before sending any of it, and you can change your answer at any time in Settings.
Lock-screen status push tokens (iPhone). When a camera connects while the app is in the background, iOS only lets the connection status appear on your lock screen (a Live Activity) through Apple's push service. For that we store the push tokens Apple issues for your device. The status push carries only what the app puts on that card — connection and transfer status text, the number of locations sent, the time of the last transfer, GPS accuracy, and a display label the app builds from the camera's brand and model code (for example Sony ILCE-7M4), never a camera name you chose. It never includes your coordinates. This content is passed through to Apple and is not stored on our servers.

That is the complete list. Account identifiers, purchase status and trial start date are used only to run your account and honour your purchase; diagnostics are used only for connection reliability and support; app improvement data is used only to make connections and photo download more reliable, to keep our camera, lens and firmware information accurate, and for support; push tokens are used only to show and update your connection status on the lock screen, and are deleted with your account.

What we never receive

Your location, movement history, or GPS tracks — these stay on your phone and your camera, as described above.
Your photos, their file names, capture times or locations, or any other data extracted from them — the only exceptions are the lens name and camera firmware version described under App improvement data, sent only if you agree.
Your contacts, advertising identifier, or browsing activity.

We do not track you across apps or websites, and we do not sell or share personal data with third parties for advertising.

Data kept on your device

GPS tracks, shooting history, camera pairings, and session logs are stored locally in the app and stay there. Deleting the app deletes them.

Diagnostics

Connection-quality diagnostics (on by default). ShutterPin supports many camera models that we cannot all test ourselves, so by default the app sends a small set of pairing and connection events to our support server. They contain only:

the camera brand, its model (for example ILCE-7M4 or EOS R6 Mark II) and the model code the camera advertises;
the camera's names: the device name the camera reports over Bluetooth, including a name you set on the camera itself (we keep the name first reported when you paired it and the name it reports now), and the camera name you set in the app, if you set one;
your phone model (for example iPhone14,3), OS version and app version;
pairing and connection results — whether a camera was found, paired, connected and became ready to receive location, the failing stage and error code if it did not, and timings — plus whether the shutter-sound and lock-screen status features started, and your notification permission and sound setting;
random diagnostic identifiers for the installation and app session, and a pseudonymous camera identifier (a one-way hash, not the camera's Bluetooth address).

These events are linked to your internal account identifier and trial, paid or expired status. We use them for support — to help you when you contact us about a specific camera — and for compatibility statistics showing which cameras and phones pair reliably. You can turn connection-quality diagnostics off at any time in Settings; the app then stops sending them.

App improvement data (only if you agree). The app asks you once whether to send the following; nothing is sent unless you choose Agree, and you can change your answer at any time in Settings. It is sent with connection-quality diagnostics, so it also stops when those are off. It contains only:

photo download results — whether the camera's Wi‑Fi connected and at which step it failed, the number of items on the card, how many files were saved or failed, total size, duration and speed, and whether the transfer stalled or reconnected (never file names, capture times or photo content);
the camera's firmware version, read from Bluetooth or from the information at the start of photos you download;
the names of lenses used with the camera (for example RF24-105mm F4 L IS USM) and the lens maker, read from the same photo information. Serial numbers, owner names and location in that information are never read;
when another phone appears to have taken over the camera's Bluetooth connection (some cameras connect to only one phone), with the error code and number of attempts;
whether the app showed you a plan notice and whether you chose to see plans or decide later.

We use this to find which cameras and phones download reliably, to fix connection and download problems, and to decide which lenses and firmware versions the app should describe. Lens names are kept only in the per-account summary below, not in individual events.

Detailed diagnostic logs (optional, off by default). With your permission, set separately in Settings, ShutterPin additionally sends structured connection stages, Bluetooth errors, transfer results, app and OS versions, random diagnostic device/session identifiers and pseudonymous camera identifiers, linked to your account in the same way.

No diagnostics, default or detailed, include coordinates, photos, Bluetooth addresses, authentication tokens or arbitrary log messages; our server rejects such data. Camera names are accepted only as the names described above, a name that looks like a Bluetooth address is discarded, and names are kept only in the per-account camera summary below, not in individual events. Names of nearby cameras you did not choose to pair are not stored.

Retention. Individual diagnostic events are used within a 30-day analysis window. Older events are purged when new diagnostics arrive. A per-account summary of your phones (model, OS and app version) and cameras (brand, model, model code, camera names, firmware version, the names of lenses seen with each camera, and pairing and connection counts) is kept while your account exists. Account deletion removes all linked events and this summary, including camera names and lens names, immediately. Diagnostics are used for product reliability and support, not advertising or cross-app tracking.

How long we keep data

Location. We never receive it, so we retain none of it. On your phone, an optional track is kept until you delete it or remove the app.
Account identifiers, linked Google or Apple account IDs and purchase status. Kept while your account exists, and erased when you delete it.
Anti-abuse record. After deletion, a keyed one-way hash of your identifier is kept for 12 months so the free trial cannot be restarted by deleting and recreating an account. It cannot be reversed to identify you.
Connection-quality diagnostics, app improvement data and detailed diagnostics. Individual events are used within a 30-day analysis window; the phone, camera and lens summary, including camera names, is kept while your account exists. Both are erased immediately when you delete your account.
Lock-screen status push tokens. Kept while your account exists and replaced when Apple issues new ones; tokens for a status card that has ended are removed within a day. The time of each status request is kept for two hours to limit abuse. Both are erased immediately when you delete your account.
Diagnostic reports. Kept up to 12 months, then deleted.

How we protect data

All traffic between the app and our service uses HTTPS with TLS. The account service runs on Cloudflare Workers with a managed database; administrative access is limited to the developer and protected by two-factor authentication. Purchases are verified directly against Apple and Google. Because we hold no location, photo, contact or payment data, that data cannot be exposed by a breach of our systems.

Service providers

Apple and Google — sign-in and payment processing, under their own privacy policies. On iPhone, Apple's push notification service also delivers the lock-screen status updates described above.
Cloudflare — hosts our account service.

Deleting your account

You can delete your account from inside the app, under Settings → Account. Deletion is immediate and removes your account record, any linked Google or Apple account IDs, purchase status, linked diagnostics (events and the phone, camera and lens summary, including camera names) and lock-screen status push tokens from our systems, with one exception described on the account deletion page: a keyed one-way hash of your identifier is kept for 12 months so the free trial cannot be restarted by deleting and recreating an account. If you signed in with or linked Apple, we also revoke the Sign in with Apple token.

Deleting your account does not cancel an active subscription — manage that in your Apple or Google account settings.

Your rights

You may request access to, correction of, or deletion of your data at any time by writing to support@sinsa.cc. Because we hold only account identifiers, purchase status, the diagnostics and the lock-screen status push tokens described above, in-app deletion removes everything we have about you, except the 12-month anti-abuse record described above.

Children

ShutterPin is not directed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes materially, we will update this page and note the new effective date.