Privacy policy

If you read a book

You can open a book from its link on the web or in the Layouts app. You don’t need an account.

• We don’t ask for your name or email, and the author isn’t told who you are or that you opened their book.
• On the web, your browser keeps, in its own storage on your device, a short list of the books you’ve opened, the TVs you’ve sent books to, a random ID of its own, and whether you turned captions on. We never receive the list of books or your captions choice. A remembered TV’s token and the random ID reach us only when you send a book to a TV, as “If you use an Apple TV” explains.
• The Layouts app remembers your Captions choice the same way, in its own storage on the iPhone, iPad, Mac or Apple TV, and we never receive that either.
• If you save a book in the app while you’re signed in, we record that you saved it, so it shows under Shared with you on your devices. If you’re signed out, the book is saved on that device only.
• Shared with you in the app also lists the links to Layouts books that people sent you in Messages, which Apple’s Shared with You picks out. The app reads which links those are on your device only: nothing about them is stored or sent anywhere until you tap one, which opens it like any other link. You can turn this off for Layouts in Messages’ settings, under Shared with You.

If you join the waitlist

The website has a form for joining the waitlist for the beta.

• We keep the email address you give and when you gave it, in our database at Convex. We use it only to tell you about the beta, such as when there’s room for you, and we don’t share it.
• To stop the form being misused, the website counts how many addresses come from one network in an hour. It counts them under a scrambled copy of your IP address, made with a secret key so it can’t be turned back into the address, never the address itself, and the count is deleted shortly after the hour is over.
• To be taken off the waitlist, contact us, and we’ll delete your address.

If you make books

Making books needs an account, and you make them in the Layouts app on your iPhone, iPad or Mac. On a Mac, the app makes, narrates and publishes books as it does on an iPhone, so what follows holds there too, except sharing photos to Layouts from other apps, which is for the iPhone and iPad.

Your account

You sign in with Apple or with a code sent to your email. Our sign-in provider, Clerk, handles this. Clerk holds your email address (or the private address Apple creates, if you choose Hide My Email) and your name, if you give it one. Our own database keeps your Clerk ID, your display name and the date you joined.

Your books

A book’s title, subtitle, author name, pages, text, captions, photo descriptions and settings are stored on our servers. That lets you work on more than one device and share the book. Your author name starts as your account name, and you can change it in Book settings. Each time you publish or update a book, we keep that version, and the app makes a picture of the cover for link previews and uploads it.

Your photos

When you add a photo, the app uploads four things:

• The original file you picked. It goes to private storage that has no public address, and it keeps whatever your camera wrote into it, which can include when and where the photo was taken. A RAW photo is developed into a HEIC file first, and that file is the original we keep.
• Smaller copies for reading, at a few sizes. They’re made on your device from the picture alone, so they hold no location, date or camera information.
• A full-size copy of the photo, made on your device from the original’s pixels with its metadata taken out, so it has no location, date or camera details. Only what’s needed to show the photo stays: its size, orientation, color profile and, for an HDR photo, the brightness map that shows its highlights. Readers get it only from a book you allow downloads from.
• A fingerprint of the file (a SHA-256 hash), so the same photo isn’t uploaded twice.

The app reads a photo’s date on your device only to put your photos in order. It never reads where a photo was taken.

Photos you share to Layouts

On an iPhone or iPad, you can share photos to a book from another app, such as Photos or Files. Layouts keeps them in a folder on your device that only Layouts can open, until the app adds them to the book and uploads them as it does any photo you add. So that you can pick a book as you share, the app keeps a list of your books in the same folder, with each one’s ID, title and how many pages and photos it has. Beside it is a scrambled copy (a hash) of your account’s ID, so photos shared for one account never go into another’s books. The list and the hash stay on your device, and signing out, or deleting your account, empties the folder.

Camera details

The app reads the camera’s make and model, the lens, and the focal length, aperture, shutter speed and ISO that a photo recorded, and keeps them with the photo on our servers, whether or not a book shows them. Readers see them when they inspect a photo, as long as the book’s Camera details setting is on. It’s on until you turn it off in Book settings, and a book that has it off leaves them out when you publish. After you change it, update the book to change what readers see. We never read a photo’s serial number, its owner’s name or where it was taken, and we never show when it was taken.

Your voice

When you narrate a page, Layouts asks to use the microphone, and it records only while you record a take. A lossless recording stays on your device. A compressed copy of each page’s narration is uploaded with the book, along with when you highlighted each photo.

When you finish narrating a page, and when you open a book whose earlier narrations have no captions yet, the app writes down what you said, on your device, with Apple’s speech recognition, which asks your permission first (opening a book never asks). Your voice isn’t sent anywhere for it. The words are uploaded with the narration as its captions, a line or two at a time, each with the time it starts and ends. A book’s Narration captions setting, on until you turn it off in Book settings, decides whether they’re published with it.

If you use an Apple TV

The Apple TV app has no sign-in.

• When the TV app first starts, our server gives it a random ID, which the TV keeps in its Keychain. We store only a scrambled copy of it (a hash), with the TV’s name (“Apple TV · Maple”, say, until you rename it) and the list of books sent to it.
• When you send a book to a TV, from the iPhone, iPad or Mac app, or from the web, we record that the TV has it. A pairing code works once and expires after 10 minutes.
• When a book is sent by its code, the TV says what sent it: “Sent from iPhone”, or iPad, Mac or the web. That’s the kind of device, never the name you’ve given yours, and we keep it with the code for about a day.
• To stop people guessing codes, your phone, Mac or browser sends a random ID of its own, kept on that device, each time it looks up a code or sends to one. We count tries under it for a minute and delete the counts within about ten minutes.
• A send by code also carries a random ID for that one send, which we keep with the code for about a day, so a send whose answer got lost can be tried again without sending the book twice.
• To let you send again with one tap, the phone, Mac or browser remembers the TV with a random token, and we store only a hash of it. When you’re signed in, the token belongs to your account, so your remembered TVs follow you. You can forget a TV in Your TVs. While you’re signed in, that turns its token off, but we keep the record, with your account, until you delete your account. Forgetting a TV on the website, or in the app while you’re signed out, takes the token off that device only: our hash of it stays until it has gone 90 days unused, and nothing can send with it once the token is gone.
• In the TV’s Settings, Forget phones and browsers turns off every token a phone, browser or account remembers that TV by, so each needs the TV’s code to send to it again, except an account the TV is linked to. The TV keeps its books, and that link.
• If you link a TV to your account, it also shows your published books, until you unlink it from your phone or the TV.
• For Top Shelf, the row of recent books the Home Screen shows while Layouts is in its top row, the TV app keeps a small file for Layouts’ Top Shelf to read: each of its books’ IDs and titles, where its cover photo is on our media server, and whether it’s still available. The file stays on the TV, in a folder only Layouts can open; the Home Screen loads the covers from our media server, as the app does.

What a shared link shows

When you publish a book, Layouts gives it a link: layout.photos/b/ followed by 16 random letters and numbers.

• Anyone with the link can view this book, and could save what they see. They don’t need an account. The link isn’t listed anywhere, and search engines are asked to skip it, but it isn’t a password: anyone you send it to can send it on.
• Readers see the book as you published it: its title and subtitle, the author name you set, its pages, photos, captions, text and narration, with when each photo is highlighted, and each photo’s camera details if that setting is on.
• If a narration has captions and the book’s Narration captions setting is on, readers can turn them on to see the words as the narration plays. Anyone with the link can read them, as they can hear the narration.
• If you turn on Downloads and 100% zoom in a book’s settings, readers can zoom a photo to its own pixels and save it: the full-size copy, with no location, date or camera details in it, never your original file. It’s off until you turn it on. After you turn it off, update the book to stop offering the copies; the files stay in our storage, at addresses that can’t be guessed, until you delete your account.
• A photo’s description, if you write one for people who can’t see the photo, is published with the book too. Screen readers such as VoiceOver read it aloud, and anyone with the link can find it in the book’s page.
• Apps like Messages may show a preview of the link, with the book’s title, your author name and a picture of its cover.
• Readers never get your email address, your account, your other books, your drafts, your original photos, or where or when a photo was taken.
• Reset link gives the book a new link, and the old one stops working. Unpublish turns the book’s link off for good. After either, TVs that were sent the book, and the app for people who saved it, show it as no longer available the next time they check with us; until then a TV’s Top Shelf row, or a copy kept for offline reading, can still show it. On the web, a link can keep showing the book for a short while: usually under a minute, but the first person to open it after that can still see the old page while it refreshes.
• Neither can take back what someone has already seen, saved or downloaded. Published photos and narration are served from file addresses that can’t be guessed but aren’t password protected, so someone who already has an address can open that file until it’s deleted.

How we measure use

We use PostHog to count what happens in the apps and on the website, such as a book being published, a link being opened, a narration being played or a photo being saved at full size. Each event holds counts, lengths of time and a few category words, such as whether a book was opened in the app, on the web or on a TV, along with the basic details PostHog adds on its own: your device or browser and its version, the app’s version, screen size, language, time zone, whether you’re on Wi-Fi or cellular, and an ID PostHog makes for each install. It never holds your photos, text, titles, links or file names.

• In the iPhone, iPad and Mac apps, events carry your account ID while you’re signed in, so we can see how far people get; when you’re not, they carry a random ID PostHog makes for that install, and signing in joins your earlier events to your account. On an Apple TV they carry a random ID. On the website they aren’t tied to a person.
• The iPhone, iPad, Mac and Apple TV apps also send an event of their own when the app is installed or updated, opened, and sent to the background. Nothing else is captured on its own: no taps, screens or text, and no screen recording.
• PostHog sees the IP address each event is sent from, as any server does. We’ve set it to throw the address away rather than store it, and every event asks it not to work out a location from it.
• On the website, each event also carries the address of the page it was sent from, with the random part of a book’s link or a TV’s code taken out, and the domain of the website that sent you there, such as mail.google.com, but not which of its pages.
• On the website, PostHog keeps nothing in your browser: no cookie and no saved ID. Its random ID lives only in the page and goes when you leave it, and a browser that sends Do Not Track isn’t counted.

We use this to see what works and what doesn’t. We don’t use it for advertising, we don’t sell it, and we don’t track you across other companies’ apps and websites.

Like any app or website, our hosts see the IP address and basic technical details of a device when it connects. If you use TestFlight and allow it, Apple also shares crash reports and feedback with us.

Who handles your data

These companies run the services Layouts is built on. Each handles data for us under its own terms and privacy policy.

• Convex is our database and servers, which hold accounts, books, links, TVs, saved books and the waitlist.
• Cloudflare stores photos and narration, delivers them to readers, and runs the domain’s DNS.
• Clerk handles sign-in and holds your email address.
• Vercel hosts the website.
• PostHog counts usage.
• Apple provides Sign in with Apple and TestFlight.

We don’t sell your data, and we don’t share it with anyone else unless the law requires us to.

How long we keep it, and deleting it

• Your books stay until you delete them. Deleting a book in the app removes its draft and all its versions, right away, and turns its links off. On the web, a link can still show the book for a short while after: usually under a minute, but the first person to open it after that can see the old page while it refreshes.
• Photos, narration and cover pictures stay in our storage after you remove them from a book or delete the book, until you delete your account. We haven’t built an automatic clean-up for them yet.
• Updating a published book keeps its earlier versions. Readers only ever get the newest one.
• Unpublishing keeps the book in your account, and you can publish it again with a new link.
• Delete account, in the app’s account menu, deletes your books, photos, narration, links, saved books and remembered TVs, and your sign-in with Clerk. It also unlinks any TV linked to your account. It runs in the background, so it can take a little while.
• Cloudflare’s network, and the devices and browsers of people who opened a book, may keep a copy of a published photo or narration for up to a year after the original is deleted.
• Usage counts stay with PostHog after you delete your account. They carry an account ID but no name or email.
• Signing out removes your books, saved books, remembered TVs and any photos waiting from the share extension from that iPhone, iPad or Mac, not from your account. Removing a book from a TV removes it from that TV only.
• An email address on the waitlist stays until you ask us to remove it.
• An Apple TV’s record (its hashed ID, its name and its list of books) stays until you ask us to delete it. It isn’t tied to an account unless you link the TV.
• When you’re signed out, the hash of the token your phone, Mac or browser remembers a TV by is deleted once it has gone 90 days without a send. After that, sending to that TV takes its code again.

Your choices

• In the app you can edit or delete any book, turn camera details or captions off, allow or stop downloads, reset or unpublish a link, forget a TV, sign out and delete your account.
• Photos: Layouts sees only the photos you pick. It doesn’t ask for access to your whole library, or for your location. On an iPhone or iPad, the first time you save a photo from a book with Save Image, the system asks whether Layouts may add photos to your library, which lets Layouts add photos, not see them. On a Mac, Layouts saves only where you choose in the save panel.
• Microphone: used only for narration. You can turn it off in Settings and still make books without narration.
• Speech recognition: used only to write a narration’s captions, on your device. If you don’t allow it, narration works as it did, without captions.
• Camera: used only to scan a TV’s code. Layouts doesn’t keep or upload what the camera sees.
• If you want something the app can’t do, such as a copy of your data, contact us.

Security

Everything travels over encrypted connections. A book’s link token is 16 random letters and numbers. On our servers, TV IDs and sending tokens are stored only as hashes. Original photos sit in private storage. No system is perfectly secure, and we can’t promise otherwise.

Children

Layouts isn’t for children under 13, and we don’t knowingly collect information from them. If you think a child has an account, contact us and we’ll delete it.

Changes and contact

When this policy changes, we’ll change the date at the top.

Questions, or a request about your data? Ask the person who invited you to the beta to put you in touch with the developer.