What most photo apps actually say
Open the terms of service for almost any consumer photo app you've used. Search for the words "machine learning," "AI training," or "derivative works." Most of them — including ones with strong consumer brands — quietly grant themselves the right to use your uploaded content for product improvement, model training, or marketing materials. Some are explicit. Some are buried in catchall licensing clauses.
We don't think most of these companies are evil. The economics of building good ML models on user data are real, and giving up that lever costs something. But "costs them something" is exactly the point. The question is who pays the cost: the company that gets a better model, or the person who handed over their family photos thinking they'd just be processed and returned.
What we decided
Nostalgia does not use uploaded photos or restored outputs to train AI models. Not in the free tier, not in Plus, not in Pro. This is the default — there is no opt-out checkbox to discover six clicks deep in account settings, because there is nothing to opt out of.
Photos are processed only to deliver the restoration or archive feature you request. Human review is limited to support cases you explicitly report. The photo is not kept as training data, and the restored output is not kept as training data.
What this costs us
Training on user uploads would be an easier path for many photo apps. We chose not to make your private family material part of that trade.
We chose not to. The reason is simple: the photos people upload to Nostalgia aren't generic stock images. They are irreplaceable. They are the only images of someone who is gone. They are the wedding photo, the baby photo, the last photo. Training on irreplaceable family material to improve someone else's restoration of an unrelated photo is the kind of trade we don't think the original family would consent to if we asked. So we don't.
If we ever offer photo-content training as a feature, it will be a separate, explicit, opt-in flow with its own consent screen, its own review of what the data is used for, and its own off-by-default toggle. It will never be retroactive. It will never be the price of using the product.
What we do use
Product improvement happens from product-quality signals, not from training on photo content. For example, we can learn from:
- Which damage types Photo Insight detects most often (so we know which restoration tools to invest in)
- Which restoration steps users skip vs. accept (signal that the recommendation engine is right or wrong)
- Which capture quality grades correlate with which complaint patterns (so we can warn users earlier when a rescan would help)
- How often a restore fails or needs a retry
- Which parts of the product people use for restore, review, and sharing
Why the privacy stance compounds
Privacy is not a single decision. It's a set of decisions that have to all align, because any leak undoes the others. So:
Uploads are encrypted in transit and at rest. Access to user photos is limited, and support review happens only when you ask us to investigate a specific issue.
We don't share your photos with third parties for advertising, marketing, or analytics. Service providers may help us process restores, host files, or handle payments, but they do not get permission to use your photos for their own purposes.
When you delete a photo, we delete it. Not soft-delete-but-keep-a-shadow-copy-for-business-purposes. Hard delete from object storage and index removal. The 30-day trash window is the only retention buffer, and after that the bytes are gone.
Why we made this public
Privacy posture matters most when you're considering signing up. The terms you accept on day one bind everything you do after. So we want our stance on the table before you upload anything.
If at any point we change this — if we ever decide to train on user content under any circumstance — we will change this page first, give existing users at least 60 days notice, and give them a clean export of everything they've uploaded. The default for any data created before the change will remain not-trained-on, regardless of how the new policy reads. We don't think this change will happen. But if it does, the rules will be clear before the data moves.
If you'd like the legal version of all of this, our /legal/ai-policy and /legal/privacy pages contain the formal commitments. The terms there are what we're held to. This article exists because the legal terms don't always communicate the spirit, and the spirit is what we want you to walk away with: your family photos are not a resource we extract value from. They are a thing we help you preserve. That's the whole product.