Privacy policy

1. Who we are and what this covers

ShutterBase is an independent photo editor for Meta Quest, operated by Matt Sich in the United States (“we,” “us,” or “our”). Matt Sich is responsible for the personal information we receive in connection with ShutterBase and this website. Contact us at [email protected] for privacy questions, data requests, or security concerns.

This policy covers the ShutterBase app, this website, and support communications. It explains both data the app handles locally on your device and information we actually receive. Meta’s headset, operating system, store, account, and platform services are governed separately by Meta’s privacy policy.

2. What the app processes on your device

ShutterBase does not require a separate ShutterBase account. Its photo editing features operate locally, without sending your library to us. The app processes the following information to provide the features you use:

• Photos and image content: the files you choose to import, open, edit, or export, including RAW images and other supported formats. Images can contain identifiable people or other personal information.
• Photo metadata: information present in your files, such as filenames, capture dates, camera and lens details, exposure settings, and embedded location information. Reading embedded GPS metadata is different from collecting your live location.
• Library and editing information: references to your files, previews, collections, ratings, flags, labels, edits, masks, presets, and related settings needed to organize and edit your photos.
• Export preferences: the copyright notice, contact details, watermark text, or other metadata you choose to include, together with your output settings.

These data remain on your headset or on storage you select or reference. Edits are stored separately from original images. We do not have remote access to your headset’s library. ShutterBase does not send your photos to an AI service or use them to train AI models.

Permissions and headset input

File and storage access lets you open selected files from headset storage and connected devices, and save your edits and exports. Local network access supports the transfers described below. Headset and controller interaction is handled through Meta Horizon OS to let you use the app; it is not sent to us as an analytics feed. You can manage available permissions in your headset settings. Restricting a permission may prevent the related feature from working.

3. Local Access and sharing your files

When you enable Local Access, the app runs a local transfer service so a browser on the same network can send files to your headset. It processes the files you select, their filenames, the session code, and the network connection information needed to complete the transfer. This transfer does not route your photos through a ShutterBase cloud service.

A new access code is generated for each session. Keep that code private, use a trusted network, and turn Local Access off when finished. A session code controls access; it should not be treated as a guarantee that a network connection is encrypted. Do not expose the service to the public internet or forward its port through your router.

Exported files can contain image content, copyright details, and existing camera or location metadata, depending on your export settings. Review the output and metadata before sharing. Files you export, send to another person, or store in a service you choose are under your control and the recipient’s or service’s policies.

4. Analytics and crash reporting

Current app: ShutterBase does not include developer-operated analytics or automatic crash reporting. We do not receive automatic usage events, photo activity, or crash logs from the app.

Planned improvements: we may add limited diagnostics to understand reliability and improve the app. Before enabling collection, we will update this policy and provide an in-app notice identifying the provider, the information sent, its purpose, retention period, and available controls. We will obtain consent where required. This statement does not mean diagnostics are currently active or give us permission to collect unspecified information.

Any future diagnostics will be designed to exclude photo content, image previews, embedded photo metadata, filenames, file paths, and copyright or contact text entered into the editor. Meta may separately process platform or device diagnostics under its own policies and your Meta settings.

5. Information you send us

If you contact support or make a privacy request, we receive your email address, your message, and any attachments or technical details you choose to send. These may include your headset model, operating system or app version, camera model, screenshots, or sample files.

We use this information to reply, investigate an issue, improve compatibility, handle your request, and protect the service. Please send only what is needed. Remove sensitive content and location metadata from sample images where possible, and make sure you are authorized to share information about other people.

Our email service processes these messages to deliver and store our correspondence. Sending a support email is optional and is separate from using the app. We do not use your support address for a marketing mailing list.

6. This website and Cloudflare

Cloudflare hosts and delivers this website. When you visit, Cloudflare processes connection and request information, which can include your IP address, requested URL, request time, browser or device information, and security-related information. This is used to serve the pages, maintain performance, and prevent abuse. It is separate from the photos and editing data stored in the ShutterBase app.

We do not add advertising trackers, website analytics scripts, tracking pixels, or optional analytics cookies to this site. Fonts and screenshots are served from this website. Cloudflare may use technical storage or cookies when necessary for security or delivery; see Cloudflare’s privacy policy for its processing practices.

Following a store or other external link takes you to a separate service, which receives the information ordinarily sent by your browser. We do not control that service’s data practices.

7. Purchases and other disclosures

Meta handles purchases, payment details, your Meta account, and applicable store transactions. We do not receive your payment card details. Meta’s processing and any store information it makes available are subject to its policies and platform terms.

We do not sell your personal information, share it for cross-context behavioral advertising, or rent your photo library. We disclose information we hold only when needed to a service provider helping deliver the website or support, at your direction, or where reasonably necessary to comply with law, respond to a valid legal request, protect rights, or address fraud or security threats. A business transfer, if one occurs, will remain subject to applicable privacy obligations and any required notice.

8. Retention, deletion, and your controls

• Photos and edits on your headset: you control how long you retain these files. Use the app’s available library controls and your device’s file or app-storage controls to remove data. Removing a library entry may not delete a referenced original or an exported file; check the actual storage location. Clearing app data can remove your catalog and edits, so save anything you need first.
• Referenced storage, exports, and backups: delete these separately wherever you saved them. Removing app data does not necessarily remove originals on a USB drive, exported copies, files shared with others, or backups managed by your device or another service.
• Support and privacy correspondence: we keep messages and attachments only as long as reasonably necessary to resolve the request, investigate a related issue, and satisfy applicable legal or recordkeeping obligations. We review whether continued retention is necessary and delete or de-identify information no longer needed.
• Website technical information: retention depends on Cloudflare’s service settings and policies. We do not maintain a separate visitor-profile database.

To request access, correction, or deletion of information we hold, email [email protected] with the subject “Privacy request.” Identify the request and the email address you used to contact us; do not send your password or identity documents. We may ask for proportionate information to verify your request. We will respond within the timeframe required by applicable law and explain any lawful limitation.

We cannot remotely erase data that exists only on your headset or retrieve files we have never received. We can help you find the relevant deletion controls. If you sent us a sample image or other attachment, you can ask us to delete our copy.

9. Your privacy rights

Depending on where you live and which laws apply, you may have rights to access, correct, delete, or receive a copy of personal information we hold; restrict or object to certain processing; withdraw consent for processing based on consent; and complain to your local data protection authority. Exercising a right will not result in unlawful discrimination. Contact us using the request method above. If applicable law provides an appeal right and we decline a request, reply asking for a privacy appeal.

Where UK or European data protection law applies, we rely on providing the service you request for processing necessary to deliver it; legitimate interests in responding to support, maintaining security, and resolving problems, where those interests are not overridden by your rights; legal obligations where applicable; and consent where required. You can contact us to ask about a particular basis or object to processing based on legitimate interests.

Matt Sich is based in the United States. Website and email providers may process information in the United States and other countries where they operate. Where legally required for international transfers of information we control, we use applicable safeguards. Contact us for information about safeguards relevant to your request. Local photo editing itself does not transfer your library to us.

10. Security and children’s privacy

We use reasonable measures appropriate to the information we handle, but no device, network, or service can be guaranteed secure. Protect your headset, external drives, backups, and local network. Report a suspected vulnerability to [email protected] without including unnecessary personal information or exploiting other people’s data.

ShutterBase is a general-purpose photo editing tool and is not directed to children under 13. Applicable Meta account, age, and parental requirements also apply. We do not knowingly collect personal information online from children under 13. If you believe a child has sent personal information to us, contact us so we can investigate and delete it as required.

11. Changes to this policy

We will update the effective date when this policy changes. For material changes, including enabling analytics or crash reporting, we will provide an appropriate notice before the new processing begins and obtain consent where required. Earlier policy versions can be requested at [email protected].