Privacy by Design: How Films Keeps Your Roll Yours

A shared camera asks something real of you: you're handing your photos — and your friends' photos — into a shared space. That only works if everyone trusts where those photos go and who can see them. So here's the plain-language version of how Films treats your roll. No legalese, no hand-waving. Just what happens to your photos, and what doesn't.

Your film is private to the people in it

A film isn't public. It's visible to the people you invited and nobody else. There's no public feed, no discover page, no way for a stranger to stumble onto your roll. When you create a film and share the link, you're drawing a small circle around a specific group of people, and the photos stay inside that circle.

If you didn't share the link with someone, they can't see the film. That's the whole model — closed by default, opened only to the people you choose.

Before the reveal, the roll is sealed

The reveal mechanic isn't just a nice experience; it's also a privacy boundary. Before a film develops, the photos aren't on display — not to other guests, and not even to the person who took them. The roll is sealed until the moment you set. That means nobody is quietly browsing the night as it happens, and nobody can pull a frame out early.

A photo you can't see yet is a photo nobody else can see either. The wait protects the roll as much as it builds the suspense.

Your photos aren't training anything

This is the question more people are rightly asking of every app that touches their images, so let's be direct about it. Your photos are yours. They exist to be the roll you and your friends shot together — not raw material for some model, not a dataset, not a product being sold on behind the scenes. The point of the app is the night you captured, full stop.

You stay in control of your roll

Control means a few concrete things, and they're the things that actually matter day to day:

• You decide who's in a film — it's invite-only, and you hold the link.
• You decide when it reveals — the timing is yours to set.
• You can remove what you don't want — including the sample films that come pre-loaded, which are clearly marked and removable so your space is yours from day one.
• Leaving means leaving. If you want your data gone, there's a clear path to delete it, not a maze designed to make you give up.

Why this is a design choice, not a policy footnote

"Privacy by design" means the protection is built into how the thing works, not bolted on afterward as a setting you have to find and switch off. A film is private because films are private — that's the default shape of the product. The roll is sealed before the reveal because that's how the reveal works. You're invited or you're not, because invitation is the only way in.

When privacy is structural like this, you don't have to trust a promise on a page. You can see it in the behavior of the app itself: there's simply no public surface for your photos to leak onto, because we never built one.

The people in the frame, not just the account

Most privacy conversations are about the account holder — your data, your settings, your photos. But a shared camera raises a second, more human question: what about everyone in the photos? A roll from a party contains dozens of people, most of whom didn't tap a single button. Their faces, their unguarded moments, their bad-angle laughs are all on that roll. A shared camera that didn't take them seriously would be a problem dressed up as a feature.

This is exactly why the closed, sealed model matters so much. Because a film is invite-only and reveals only to the group, the people in those photos aren't being broadcast to strangers — they're being seen by the same friends who were in the room with them. The audience for the roll is the same set of people who lived the night. That's a fundamentally different thing from a photo that could end up anywhere, and it's the reason people relax and let themselves be caught honestly.

The sealed-until-reveal design protects the subjects too, not just the shooter. Nobody's pulling embarrassing frames in real time to send around; nothing escapes the circle before the group sees it together. And the same control that lets you manage your own data lets you handle the rare photo that shouldn't have made the roll — the etiquette of "take that one down" stays inside the group, where it belongs. A shared camera is a shared responsibility, and the structure is built so that responsibility is easy to honor.

The point of all of it

The reason any of this matters is simple: a shared camera is an act of trust between friends, and the app's only job is to be worthy of that trust. You're capturing real nights with real people, often at their most unguarded. The least an app can do is make sure those moments stay exactly where you meant to put them — in a small, private circle, revealed when you're ready, and never used for anything you didn't intend.