On This Day does not send your photos, or any personal data, off your device.
On This Day reads your photo library to find photos taken on the same date in earlier years. It prepares those photos for display in its widgets. Both steps happen on your device.
The app saves the prepared images in its own private storage, where only On This Day and its widgets can read them. They are kept out of iCloud backups, because On This Day can rebuild them at any time from photos already in your library.
The app deletes those images the next time it runs after you withdraw photo access. Deleting the app removes them at once.
Photo access is the only permission the app asks for. You can change it whenever you like, in iOS Settings.
The app contains no networking code. It has no analytics, crash reporting, advertising, or third-party SDKs, and there is no server behind it. It cannot send your photos, or anything made from them, anywhere.
Two things do use the network, and neither is On This Day's own code:
The Full Version is a one-off in-app purchase. Apple processes it. The app asks iOS whether this Apple Account owns the purchase, and unlocks the paid features if it does.
Your payment details never reach the developer. Apple does give the developer sales and financial reports through App Store Connect. Those reports cover sales, not the people who made them. Apple's privacy policy covers Apple's own handling of purchase data.
If you email support, the developer receives your address and whatever you write. The developer uses it to answer you, and keeps it only as long as that takes.
The app collects nothing today. If a later version adds anything that collects or sends data, the developer will update this policy first, and change the date below.
Hamish Tennent — support@mynameishamish.com