Draft — to be reviewed before launch.
Privacy Policy
Who is responsible
gallerypics is run by:
The photos and gallery details in a gallery are uploaded by the photographer, who decides what is shared and with whom. For that data the photographer is the controller and gallerypics processes it on their behalf (see the Data Processing Agreement). If you are a couple or a guest, your photographer is the first person to ask about the photos in your gallery.
What data we process
Photographers and their team members: name and email address (through the sign-in provider Clerk), the studio's name, each member's role, and the studio's plan and subscription status. Payment details are entered with Stripe; we keep only Stripe's customer and subscription references.
Galleries: gallery title, the couple's names, the event date and venue, the gallery PIN (stored encrypted), and the photos with their file names, dimensions and capture time, and which photos are hidden from guests (and whether the photographer or the couple hid them). Originals are kept as uploaded, including any metadata in the file (such as camera details or a GPS location). The thumbnails and web-size copies shown in galleries have all metadata from the original file removed, including GPS. A full-size download is the original file.
Couples: we don't ask for the couple's email address and send them no email. The photographer creates a couple PIN in the dashboard and gives it to the couple themselves; the couple type it on their gallery's own link. The PIN is stored encrypted, so the photographer can show it again. Galleries set up before couple PINs may still use a private gallery link instead, of which our database keeps only a hash. The photos the couple mark as favorites are stored with the gallery and shown to the photographer.
Guests: guests have no accounts, and we ask for no names or email addresses. When someone enters a guest PIN or a couple PIN, we count attempts by a salted hash of their IP address (for IPv6, of its network prefix) to stop them from being guessed. When a guest marks a photo as a favorite, we keep it under a random id stored in a cookie on their device (see Cookies), not linked to a name or an IP address; the photographer sees how many guests marked each photo. We also count how often a gallery is opened with a PIN, as a number per gallery with the time of the last opening, nothing about who. The IP address itself is not stored in our database. Our sign-in provider's script (Clerk) also loads on gallery pages, so Clerk (United States) receives guests' IP address and browser details when they open a gallery, and may set its signed-out cookies (see Cookies).
Server and network logs: our hosting and network providers (Railway and Cloudflare) log requests, including IP addresses and the pages requested. A couple's private link (on galleries set up before couple PINs) appears in these logs.
Error reports and performance traces: when something breaks, an error report goes to Sentry. Sentry also receives a sample of performance traces (one in ten), which can include the addresses of pages visited. Sentry's collection of user details, cookies, request headers, request bodies and URL query parameters is switched off.
Why we process it
- To run photographer accounts and studios, and let team members sign in.
- To store photographers' photos, make the gallery copies and show galleries to the people they share them with.
- To bill subscriptions.
- To create the couple PIN (or, on older galleries, the private gallery link) that photographers share with their couples.
- To keep the favorites that couples and guests mark, and show them to the photographer.
- To protect galleries against PIN guessing and abuse.
- To find and fix errors and slow pages.
Who processes data for us
| Company | Purpose | Location |
|---|---|---|
| Clerk | Sign-in and accounts for photographers and their team members. Its script also loads on gallery pages, so it receives guests' IP address and browser details | United States |
| Stripe | Subscription payments and invoices | United States |
| Cloudflare | Photo storage (R2), image delivery and network protection | EU (R2 storage); delivery and caching through its worldwide network |
| Railway | Hosting of the app, the background worker and the database | EU region |
| Sentry | Error reports and sampled performance traces | Copy to come — This processor's data region (Sentry: the region of the Sentry organization) |
The app, the background worker and the database run in Railway's EU region. Photos are stored in a Cloudflare R2 bucket in the EU jurisdiction. Cloudflare delivers gallery images through its worldwide network, which caches the thumbnails and web-size copies (never the originals) close to viewers. Clerk and Stripe are in the United States and process data under their own data processing agreements.
Copy to come — Legal basis for transfers to Clerk and Stripe in the US (e.g. Standard Contractual Clauses)Cookies
gallerypics uses only cookies that are needed for the service: signing in, access to galleries, and keeping a guest's favorites. There are no analytics or advertising cookies, so there is no cookie banner. The gallery access cookies are signed so they can't be forged, and scripts on the page can't read any of our gallery cookies.
| Cookie | What it does | Lifetime |
|---|---|---|
| Clerk cookies | Keep photographers and team members signed in to the dashboard. Guests who open a gallery may get Clerk's signed-out cookies, because Clerk's script loads on gallery pages. | Copy to come — Names and lifetimes of the cookies Clerk sets on the production domain |
gs_ + gallery id | Remembers that a guest entered the guest PIN (or opened a public gallery), or that the couple entered their couple PIN (or opened their private link). | 30 days; renewed when fewer than 15 days remain and you visit the gallery |
gpa_ + gallery id | Lets the image server deliver that gallery's photos to guests and the couple. | 12 hours, renewed on visits |
gps_ + studio id | Lets the image server deliver the studio's photos to its signed-in members. | 12 hours, renewed on visits |
gpv | A random id that a guest's favorites are kept under, so they are still there on the next visit. Set only when a guest first marks a favorite. | 1 year |
How long we keep data
- Galleries never expire: photos and gallery details are kept until the photographer deletes them. Deleted photos and galleries can be restored for 30 days and are then permanently deleted from storage; a deleted gallery's details are deleted with it. A deleted gallery's page stops working at once.
- Thumbnails and web-size copies can stay in Cloudflare's cache until it evicts them. Only someone with access to the gallery can fetch them. When a gallery is deleted, guests' and the couple's access to its images ends within 12 hours. Members of the photographer's own studio can still load cached images until they are evicted.
- Deleting a studio deletes all of its galleries, which are then permanently deleted after 30 days.
- Favorites are deleted with their photo or gallery.
- Salted IP hashes used against PIN guessing are deleted within about two hours of the last attempt.
Your rights and how to contact us
Copy to come — People's rights (access, correction, deletion, objection…) and the supervisory authority to complain toWrite to us at the email address under “Who is responsible” above.