Polarr

GDPR overview

The word GDPR appears nowhere on Polarr's site, so no compliance claim is made in so many words. The substance is partly there. Section X of the privacy policy, dated 15 February 2022, addresses people in the European Economic Area and the United Kingdom, names Polarrcan Software Inc. in Vancouver as controller, lists legal bases (contractual necessity, legal obligation, legitimate interests and consent, with a right of withdrawal), and sets out rights of access, correction, erasure, export, restriction and objection, plus the right to complain to a supervisory authority. What is missing tells as much: no Article 27 representative despite a controller established outside the EU, no Data Processing Agreement, no data protection officer and no dedicated address. Every request goes through the support form.

Who owns the data?

Polarr's terms are explicit that the company claims no ownership of User Content: your photos, videos and filters remain yours. In exchange, making anything available through the Services grants Polarrcan a non-exclusive, transferable, worldwide, royalty-free and sublicensable licence to use, copy, modify, create derivative works from, distribute and publicly display that content in order to operate and provide the Services, and anything you share publicly is licensed to other users too. Two caveats deserve attention. Polarr accepts no obligation to store your content, and material you delete may leave copies behind. In Polarr Next, editing and AI training data never leave your computer.

Reuse rights

Because ownership stays with you, your own exports can be reused freely, commercially included, without asking Polarr for permission; the licence the terms restrict to personal, non-commercial use covers the software itself, not the pictures you make with it. Filters are designed to circulate: a look can be exported as a QR code and reimported into another Polarr app, and community filters are shared on that same basis. Content belonging to other users is a different matter, licensed only as far as the product's own functionality allows, so republishing it elsewhere is not covered. On Polarr's side, data serves service delivery, analytics, interest-based advertising and product research; it may be processed and stored anywhere in the world, and the policy never says whether customer content trains Polarr's models.

Data retention & training

Hosting summary

Polarr's terms state that the Services are controlled and operated from facilities in the United States. The privacy policy goes further: information may be transferred, processed and stored anywhere in the world, the United States expressly included, in jurisdictions whose data protection laws differ from the user's own. No data centre, country list or region is named beyond that, and the appropriate safeguards mentioned for onward transfers are described only as available on request, with no standard contractual clauses or transfer framework identified. Jurisdiction is split: the controller for the European Economic Area and the United Kingdom is Polarrcan Software Inc. in Vancouver, Canada, while the terms elect the law of the State of California. Polarr Next is the exception that matters most, because it hosts almost nothing. Photos are read locally and never uploaded, editing and AI training data sit on the user's own computer, and only account and payment details are synced. The domain itself resolves to an Amazon CloudFront edge node, which says nothing about where data actually rests.