This Privacy Policy describes how Sher ("we", "our", or "us") collects, uses, stores, and protects information when you use the Sher mobile application and related services (the "Service"). By using Sher, you agree to the practices described in this policy.
If you are under the age of 18, please read the Minors and Child Safety section below carefully. If you are under 13, you may not use Sher.
Sher is operated by Mandates Technology LTD, a company registered in the United Kingdom.
Sher lets a host create a Room for an event. When a Room is created, the host receives a QR code and a unique Room code. Guests join the Room by scanning the QR code or entering the code.
Once in a Room, members can capture photos using the in-app camera. Photos captured by any member of the Room are visible to, and downloadable by, every other member of that Room. Members can choose to upload or delete the photos they personally captured. The host can revoke a member's access to a Room at any time, which removes that member's ability to view or download photos in that Room going forward.
To use these features, Sher requests access to your device camera, photo gallery, and file storage. These permissions are used only to let you capture photos, save photos to your device, and upload photos you choose to share, as described above.
Phone number, required to create an account and receive one time passwords (OTP) for signing in to the app. This OTP is for account login security only, and is separate from how you access a Room, which is done through the Room code or QR code shared by the host.
Email address, optional, for account recovery and notifications.
Display name and profile photo, optional, shown to other members of Rooms you join.
Photos you capture, when you take photos within a Sher Room, those photos are uploaded to our storage and made available to other members of that Room, as described in Section 2.
Payment information, when you or a host pays to unlock a Room's gallery for download, payment is processed entirely through Apple's in-app purchase system. We do not receive or store your card number, CVV, or any other payment credentials. We store only a record of the transaction reference, amount, currency, and status, as provided to us by Apple.
Device information, device model, operating system version, language, time zone, and app version, used for compatibility and crash diagnostics.
Usage information, Rooms you create or join, photos you capture, unlock transactions, app crashes and errors.
IP address and approximate location, derived from your IP address for security purposes, such as detecting unusual sign in attempts.
Crash and error diagnostics, collected to help us identify and fix bugs. Crash reports are scrubbed of personal information before transmission.
We do not collect your precise GPS location.
We do not collect your contacts list.
We do not access your photo library beyond photos you explicitly choose to upload from your gallery or capture inside Sher.
We do not collect biometric data.
We do not use third party advertising trackers.
We use your information solely to:
Provide and operate the Service, including signing you in, creating and joining Rooms, and storing and serving photos you capture.
Process gallery unlock payments through Apple's in-app purchase system.
Send transactional notifications, for example that a payment has been confirmed, or that a new photo has been added to a Room you are in.
Detect and prevent fraud, abuse, and security incidents.
Diagnose and fix application errors.
Comply with legal obligations, such as tax records or responding to lawful requests.
Improve the Service through aggregated, non identifying analytics.
We do not sell your personal data to third parties. We do not use your personal data for behavioural advertising.
Photos you capture within Sher are stored on encrypted cloud storage. Photos are stored with private access controls and served only via short lived signed links.
Photos captured in a Sher Room are visible to and downloadable by every member of that Room, once the gallery has been unlocked according to the Room's payment terms, or during the event if the host has enabled real time viewing.
A host may revoke a member's access to a Room at any time. Once revoked, that member can no longer view or download photos from that Room.
Photos are never publicly accessible outside a Room and are never indexed by search engines. They are not visible to Sher employees except in limited cases necessary for moderation, legal compliance, or technical support, and only with appropriate access controls and audit logging.
Sher is a collaborative app, and any member of a Room may capture photos that include other attendees, whether they are the intended subject, in the background, or only partially visible. Sher relies on the host of each Room to inform attendees, before or at the start of the event, that other Room members may take photos of them during the event, and to give attendees a way to indicate if they do not wish to be photographed. Hosts are responsible for communicating this to attendees and for handling any such requests within their event. If you have concerns about a specific photo, you may still contact us directly using the details in Section 15, and we will assist in line with Section 5.6.
By default, photos are retained for 30 days after a Room's event ends. After 30 days, photos are soft deleted, meaning they are no longer accessible or downloadable, unless the host or a member pays to keep the gallery active. If no payment is made, photos are permanently and irreversibly deleted from our backend 90 days after the event ends.
You may delete a photo you personally uploaded at any time from within the app. You may also request deletion of any photo by contacting us at contact@mandatesvr.com. We process deletion requests within 30 days.
We may review photos for compliance with our content policy if a photo is reported by another user or flagged by automated systems. We will never review your photos for marketing, profiling, or any purpose other than safety and policy enforcement, except where you or another depicted person has separately opted in to marketing use as described in our Marketing and Photo Usage Policy.
Payments to unlock a Room's gallery are processed entirely through Apple's in-app purchase system. We never receive or store your card number, CVV, expiry date, or bank credentials. We retain a record of the transaction reference, amount, currency, status, and date for as long as required by tax and accounting laws.
You can delete your Sher account directly within the app, from Settings, without needing to contact support. Deleting your account permanently removes your profile information and revokes your access to all Rooms. Photos you captured in Rooms you were a member of may remain visible to other Room members in accordance with the Room's retention period described in Section 5.5, unless you delete them individually before deleting your account.
If you would prefer to request deletion by contacting us directly, you may do so at contact@mandatesvr.com. We process such requests within 30 days.
Members of a Room you join can see your display name if provided, your profile photo if provided, your role as host or guest, and any photos you capture in that Room.
We use trusted third party services to operate Sher, under strict contracts:
Cloud storage and content delivery providers, for photo storage.
Apple, for app distribution and in-app payment processing.
Google, for app distribution.
SMS providers, for OTP delivery during sign in.
Crash and error diagnostics providers, for identifying and fixing bugs.
We may disclose information if required by law, regulation, or valid legal process, or to protect the rights, property, or safety of Sher, our users, or others.
If Sher is acquired, merged, or restructured, your information may be transferred to the new entity. We will notify you before any such transfer affects your data.
You must be at least 13 years old to use Sher. If you are under 13, please do not use the Service or provide any information to us. If we discover that we have collected information from a user under 13, we will delete that information immediately and terminate the account.
If you are between 13 and 17 years old, you must have permission from a parent or legal guardian to use Sher. By using Sher, you confirm that you have your parent's or guardian's permission, and that your parent or guardian has reviewed this Privacy Policy.
Parents and guardians may review the personal information we have collected about their child, request deletion of their child's account and all associated data, and refuse further collection or use of their child's personal information, by contacting us at contact@mandatesvr.com with verification of their identity and relationship to the child.
For users we believe to be under 18, we do not show personalised advertising, and we apply stricter content moderation thresholds for reports involving minors.
If you believe a minor is at risk on Sher, or that content involving a minor violates our policies, report it in-app using the Report feature on any photo or member, or email contact@mandatesvr.com. We respond to verified child safety reports within 24 hours.
Account information such as phone number, email, and profile, is retained until you delete your account.
Photos are retained per the Room's retention period, described in Section 5.5.
Payment records are retained for as long as required by tax and regulatory compliance.
Logs and security records are retained for 12 months unless required longer for security investigations.
Crash diagnostics are retained for 90 days.
When you delete your account, we delete or anonymise your personal information within 30 days, except for records we are legally required to keep.
Depending on your location, you have the right to access a copy of the personal information we hold about you, request correction of inaccurate information, request deletion of your information, request a copy of your data in a structured, machine readable format, object to certain uses of your information, request that we limit how we use your information, and withdraw consent at any time where we rely on it.
To exercise any of these rights, contact us at contact@mandatesvr.com. We will respond within 30 days.
United Kingdom and EU users. As a UK registered company, we handle personal data in accordance with the UK GDPR and, where applicable, the EU GDPR. You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local Data Protection Authority.
California users. If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to opt out of the sale of personal information. Sher does not sell personal information.
All data in transit is encrypted using TLS 1.2 or higher. Photos are stored in encrypted storage with strict access controls. We follow secure coding practices and conduct regular security reviews. Access to user data by our staff is limited, logged, and audited.
No system is 100 percent secure. If you become aware of a vulnerability or believe your account has been compromised, please contact us immediately at contact@mandatesvr.com.
Sher is operated from the United Kingdom. Some of our service providers may store data in other countries, including the United States. By using Sher, you consent to the transfer of your information to these countries. We ensure that any cross border transfer complies with applicable data protection laws, including using Standard Contractual Clauses where required.
We may update this Privacy Policy from time to time. When we do, we will update the Last updated date at the top. For material changes, we will notify you through the app or by email at least 30 days before the changes take effect. Your continued use of Sher after the effective date means you accept the updated policy.
For privacy related questions, requests, or complaints, email contact@mandatesvr.com or visit www.sherapp.cloud.
For urgent safety concerns involving minors, see Section 9.5.