Supa

Privacy Policy

Effective 28 September 2026 · Updated 9 October 2026

In short

Your photos and designs never leave your iPhone. There are no accounts, and we never ask for your name or email. With your permission only, we collect anonymous usage statistics (for example “a template was exported”) to improve the app. They are not linked to you, not used for advertising, and never sold. You can turn this off anytime in Settings. We do not track you across other apps or websites.

Photos and designs

Supa asks for access to your photo library so you can place photos into templates, and for permission to add photos so it can save your finished designs. Photos you pick are copied into Supa's private storage on your device to keep your drafts, and are deleted when you delete a draft. They are processed entirely on your device and are never uploaded to us or anyone else.

Purchases

Purchases are processed by Apple through the App Store. We do not receive your payment details. Supa checks with Apple, on your device, which collections your Apple ID owns.

Anonymous usage statistics

This is optional and off until you agree. The first time you open Supa, it asks whether you want to share anonymous usage statistics. If you choose “Not now”, nothing is sent. You can change your choice at any time in Supa → Settings → Share anonymous usage data.

If you agree, Supa sends a small set of anonymous events to understand how the app is used and where it can be better, for example: a screen was opened, a template was opened, photos were added, a design was exported or saved, a paywall was shown, a purchase was started or completed. Events include the template or collection involved, the app version, the app's language, and basic device information (such as the iOS version and device model).

Events are tied to a random identifier created when Supa is installed. It is not your Apple ID, advertising identifier or any other identifier from your device, and it is not connected to your name, email, photos or purchases. Deleting Supa removes it. We do not use your IP address to determine your location, and we do not build a profile of you.

These statistics are processed by PostHog on servers in the European Union (Frankfurt), acting on our behalf as a data processor under a data processing agreement that requires it to protect the data at least as well as described in this policy. PostHog may not use the data for its own purposes. Statistics are kept for up to 12 months and then deleted automatically.

What we don't do

• No advertising and no advertising identifiers.
• No tracking across other companies' apps or websites.
• No selling or sharing of data with data brokers.
• No collection of contacts, location, messages or photo content.

Children

Supa is not directed at children under 13 and does not knowingly collect personal information from them.

Your rights and choices

Withdraw consent: turn off Share anonymous usage data in Supa → Settings; nothing more is sent from that moment.

Delete your data: deleting Supa removes the random identifier and all your drafts and photo copies from your device; the anonymous statistics already sent are deleted automatically after 12 months, and because they are not linked to you we cannot single them out earlier. Your photos and drafts are never on our servers, so there is nothing else to delete.

If you have questions or a privacy request, including under the GDPR, email hello@wearesupa.co or message us on Instagram at @wearesupa.

This website

wearesupa.co sets no cookies and stores nothing on your device. To understand how the site is used, it counts visits anonymously: which page was opened, where the visit came from (the referring website or campaign link), the type of device, the browser's language and time zone, the country (provided by our hosting network, Cloudflare, without passing on your IP address), and whether the App Store, contact or Instagram links were clicked. The App Store link page (wearesupa.co/get, used in our ads) counts visits the same way. Each count uses a random, one-time identifier, so visits cannot be linked to each other or to you, and IP addresses are not stored. The counts are processed by PostHog in the European Union on our behalf.

Changes

If this policy changes, we will update this page and its date.