Help center

Questions, answered.

Who can see my photos?

Only the friends you’ve mutually added. Subsets has no public feed, no discover page, and no public profiles — your content is never visible to anyone you haven’t accepted as a friend. Nothing you upload is indexable or shareable outside the app.

Does Subsets have passwords?

No. Subsets is passwordless. You sign in with a one-time code (OTP) sent to your email. Codes are stored only as cryptographic hashes, expire after 5 minutes, and work exactly once. Because your email is your key, keep your email account secure.

What happens to the location data (EXIF/GPS) in my photos?

We strip EXIF metadata — including GPS coordinates, camera details, and timestamps — from photos at upload. Your friends never receive a photo’s location data. The original EXIF stays only on your own device.

Do you sell my data or show ads?

No and no. We don’t sell or share your personal data, don’t show ads, don’t use third-party analytics (no Google Analytics, Mixpanel, or similar), and don’t collect advertising identifiers. Subsets is free, and you are not the product.

Will my photos be used to train AI?

Never. Our Terms of Service commit that your content will not be used to train, fine-tune, or evaluate any AI or machine learning models — by us or any third party. This applies even to anonymized content.

What happens when I delete my account?

Deletion is immediate and permanent. Your photos, albums, connections, sessions, and device tokens are removed from our active systems right away, and content you shared disappears from your friends’ view too. Residual copies in encrypted backups are purged within 30 days.

Can I download my data?

Yes. You can request a data export directly in the app from your account settings and download an archive of your data, or email [email protected]. We respond within 3-5 business days.

How old do I need to be to use Subsets?

At least 13 years old globally, and at least 16 in the European Economic Area and the United Kingdom. We verify age with your date of birth at signup, and we delete accounts found to be under the minimum age.

How is my data protected?

All traffic uses TLS 1.2+, stored data is encrypted with AES-256, and sign-in codes are hashed. Sessions use short-lived access tokens with single-use, rotating refresh tokens — if a stolen token is ever replayed, all related sessions are revoked automatically.

Which third parties handle my data?

Only infrastructure providers operating under strict data processing agreements: AWS (hosting and storage), Cloudflare (CDN and network security), Postmark (transactional email like sign-in codes), and Sentry (error and crash reporting). None of them may use your data for their own purposes, and we never share data with data brokers or advertisers. See our Privacy Policy for details.

Someone is bothering me on Subsets. What can I do?

Block them — blocked users can’t send you friend requests or interact with you at all. You can also report content or accounts that violate our Terms, and we review every report. For urgent issues, contact [email protected].

I live in the EU or California. What are my privacy rights?

You can access, correct, delete, and export your data regardless of where you live. EEA/UK users additionally have GDPR rights to restrict or object to processing, withdraw consent, and complain to their data protection authority. California residents have CCPA/CPRA rights to know, delete, and correct — and we don’t sell or share personal information, so there’s nothing to opt out of. Email [email protected] to exercise any right.

Still stuck?

Visit Support to contact the team.