Skip to content
← Privacy Center

Clickzy

Privacy Policy

Last updated: October 18, 2026

This Privacy Policy applies to the Clickzy mobile app — the disposable camera, reinvented for events. Clickzy is built and operated by Appstic Labs ("we", "us"), New Delhi, India. It does not cover other Appstic Labs products.

Photos from a film belong in storage the host controls. Hosts create the film and may connect Google Drive. Guests can join with an invite code and shoot without creating an account. When Drive is connected, photos upload to the host's Google Drive inside a Clickzy folder.

1. Information Clickzy collects

We collect only what Clickzy needs to run a film:

  • Host account. Hosts sign in with Apple, Google, or an email code. With Google, Clickzy receives your name, email address and profile picture. With Apple, Clickzy receives your name and email address (or Apple's private relay address if you hide your email). With an email code, Clickzy receives the email address you type. Clickzy also creates a Clickzy user ID.
  • Guests. Guests join with an invite code or QR and a display name. No email or phone number is required. If a guest is already signed in with Google, we may attach their Clickzy user ID to that guest record so they can resume on the same phone.
  • Install id. Clickzy stores a random id created on the phone. It is not a hardware identifier. It stays for that install, and deleting the app starts a new one. Clickzy uses it so a person blocked from a film cannot rejoin that film by reopening the app on the same install.
  • Email kept on a blocked film. If a signed-in guest is blocked on a film, Clickzy keeps that guest's sign-in email on that film only. The same address cannot rejoin that film after the app is deleted and a new account is created. They can still sign up and join other films. Unlocking them removes the email. Deleting their account does not.
  • Email sign-in codes. When you ask for an email code, we send a six-digit code to that address. Only a hashed copy of the code is stored, and it expires after 10 minutes or after five wrong tries.
  • Film details. Film name, cover image, camera style, reveal settings, guest limits, event schedule and photo metadata (who took a photo and when). A cover chosen from the camera roll is stored in the host's Google Drive, in a CoverPhoto folder inside that film. Built-in covers stay in the app.
  • Photos. Photos taken in Clickzy are uploaded to the host's own Google Drive when Drive is connected. For each photo, Clickzy also stores a small preview in that person's folder, under a Thumbs folder next to the full photo. We process photos in transit and may hold short-lived copies in server caches so the gallery loads quickly. Google Drive is the system of record — not our long-term photo store.
  • Nudity and sexual content. After a photo is taken, the phone may check it on the device. Only a high-confidence explicit result is held. A suggestive result, a low-confidence result, or a check that fails does not stop the upload. A held photo is not uploaded to the host's Google Drive. Appstic Labs stores that copy privately so we can review it. If we approve it, it is published to the host's Drive and the private copy is deleted. If we block it, we delete it and notify only the person who took it. If we do not decide within 48 hours, we delete the held copy and do not publish it. The person who took it can see that their own photo is under review while we hold it. We do not use these photos for advertising or to train models.
  • Notifications. If you allow alerts, Clickzy stores an Expo push token and the device timezone so we can deliver guest-join alerts, host announcements, film reminders, and reveal unlocks. Tokens are stored on your host or guest record. You can refuse the in-app prompt; then we do not request the system permission.
  • Purchases. Optional guest-capacity and infinite-exposure unlocks are billed by Google Play or the App Store. Clickzy checks each purchase with Google or Apple and records the product, the order or transaction ID, the price charged, and which film it unlocks. We do not receive or store full payment card numbers.
  • Camera and photo library. Clickzy uses the camera to take film photos. It can save a copy of each shot to your Photos app and lets you pick photos from your library. Clickzy does not use the microphone.
  • Diagnostics. Our API keeps operational logs (errors, request failures) to keep Clickzy reliable. The app does not include a crash-reporting SDK.

2. Google Drive in Clickzy

When a host connects Google Drive, Clickzy requests narrowly-scoped access to create and manage a Clickzy folder in that host's Drive. We use this access only to:

  • Create a folder per film (for example, Clickzy / My Wedding 12 Oct 2026).
  • Upload photos into a folder for each person, and a small preview of each photo into a Thumbs folder beside those photos.
  • Retrieve photos and those previews to show them in the Clickzy gallery.
  • Delete a photo and its preview when a host or guest deletes that photo in the app.

Clickzy never browses, reads or modifies other files in your Google Drive. We do not read Drive storage quota. The only Google Drive permission requested is https://www.googleapis.com/auth/drive.file — files Clickzy creates or that you open with Clickzy. Google sign-in uses only email and profile. Drive is requested later, when you choose to connect backup, after an in-app disclosure.

Limited Use of Google user data

Clickzy's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • We use Drive data only to provide the user-facing Clickzy features you see: creating a film folder, uploading photos and their small previews, showing the gallery, and deleting photos you delete in the app.
  • We do not transfer or sell Google user data to advertising platforms, data brokers, or information resellers.
  • We do not use Google user data for ads, retargeting, or to train AI models.
  • Humans at Appstic Labs do not read your Drive files or photos except in these cases: you ask us to (for example, support); we are reviewing a photo someone reported, or a photo the app held because it appeared to be explicit sexual content, and only to decide whether to keep it or remove it; a security investigation; or where the law requires it. A reported photo is read from the host's Google Drive on a private review page. A held explicit photo is the private copy described above, and it is not in Drive until we approve it. We do not use those photos for advertising or to train models.
  • You can disconnect Clickzy from a film's Google Drive in the app, or revoke Clickzy in Google Account permissions. Disconnecting the Google account from your Clickzy profile stops that login from being used for films you create after that. A film that already has its own Drive connection keeps working until you disconnect Drive on that film. Revoking Clickzy in Google Account permissions stops the films that were using that Google account. Photos in a film whose Drive is disconnected will not load for the host or for guests until the host connects Drive for that film again. The Google account email for a film is shown only to that host, not to guests or to anyone who only has the invite code.

3. How Clickzy uses information

  • To create films, send invitations, and run the shared film roll.
  • To show the gallery and apply the host's reveal settings.
  • To sync photos to the host's Google Drive.
  • To send the alerts you allowed (joins, announcements, reminders, reveal).
  • To review a reported photo, or a photo held for nudity or sexual content, and to remove it when it should not stay on a film.
  • To provide support and keep the app secure.

We do not sell personal data. We do not use Clickzy photos for advertising or to train AI models.

4. Who can see a film

Clickzy shares information only in these limited situations:

  • Inside the film. Photos and display names are visible to the host and, depending on the host's reveal and gallery settings, to other guests on that film.
  • Service providers. Infrastructure we use to run Clickzy. The Clickzy API is hosted on Railway. We also use push delivery via Expo, Firebase Authentication, Sign in with Apple, Google Drive / Sign-In / Play Billing, the App Store, and Resend to send sign-in codes and safety emails. These providers process data on our behalf.
  • Safety review. If a photo is reported, or if the on-device check holds it as explicit sexual content, Appstic Labs may view that photo to decide whether to keep it or remove it. We do not publish that review copy anywhere else. Suspected child sexual abuse material is reported to NCMEC and other authorities when the law requires it.
  • Legal. When required by law or to protect the rights and safety of users.

5. How long data is kept

  • Photos and their small previews stay in the host's Google Drive until the host deletes them there or in Clickzy. Deleting a photo in the app also deletes its preview.
  • Server-side copies of photos and previews are kept only to load the gallery quickly, until the cache reaches its size cap, then the oldest files are removed. They are not the stored copy. The stored copy is the host's Google Drive.
  • A photo held for explicit-content review is kept for up to 48 hours. We delete that private copy when we block it, when we approve it and publish it to the host's Drive, when 48 hours pass with no decision, or when the person who took it deletes their Clickzy account.
  • A photo report does not create a separate long-term copy. The private review page reads the photo from the host's Google Drive while the report is open.
  • Host account, film records, guest records and push tokens are kept while the account is active and removed when the account is deleted.
  • A record that a Google Play or App Store purchase token was already used is kept after the account is deleted. It stores which Clickzy account first used that token, so the same receipt cannot be applied to a new account. It does not include a payment card number.
  • A sign-in email saved because that person was blocked on a film stays on that film until the block is lifted. Deleting the account does not remove it. It is not used for other films or for advertising.

6. Your choices

  • Delete photos or your account. Delete individual photos in Clickzy, or delete your entire Clickzy account from Profile, then Account and settings, in the app (or see Delete Account). Account deletion removes Clickzy records and Drive tokens. A sign-in email saved on a film where you were blocked stays on that film until the block is lifted. Photos already in the host's Google Drive stay there unless the host deletes that folder.
  • Notifications. You can decline the in-app alert prompt, or turn notifications off later in system Settings.
  • Report or block. Guests and hosts can report an announcement, a photo, or a person in the app. The report is sent to Appstic Labs immediately. The host is not notified of the report. A reported photo stays on the film until we remove it. The private review page shows who took it and who reported it. We can keep the photo, remove it, block the guest from that film, or block the host. Blocking the host locks that film for everyone. A blocked person is notified and can appeal by emailing us. A photo report still open after 24 hours is flagged so we can decide. Hosts can also block a guest from shooting in that film. If that guest had signed in, their sign-in email stays on that film until they are unlocked. Deleting their account does not remove it, and it does not block them from other films. We may suspend an account for serious or repeated abuse.
  • Revoke Drive access. Hosts can disconnect the Google account from their Clickzy profile. That stops the login for films created after that. A film that already has its own Drive connection keeps working until Drive is disconnected on that film. Hosts can also revoke Clickzy in Google Account permissions. That stops the films that were using that Google account until the host connects Drive again.
  • Questions. Email contact@appsticlabs.com about Clickzy privacy. We respond within 30 days.

7. Children

Clickzy is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has used Clickzy and provided personal information, contact us and we will delete it.

8. Security

Clickzy uses encryption in transit (HTTPS), scoped OAuth tokens for Google Drive, signed URLs for photo access, and least-privilege infrastructure access.

9. Changes

If this Clickzy policy changes in a material way, we will note it in the app or on this page. The "Last updated" date always reflects the current version.

10. Who operates Clickzy

Clickzy is a product of Appstic Labs.
New Delhi, India
Email: contact@appsticlabs.com