Privacy

Last updated: October 31, 2026

What Gallery stores

For a photographer: the sign-in account (through auth), the titles of the galleries, the photos, and one logo.
For each photo: the original file, a large copy (2048 pixels) and a small copy (400 pixels), and the file name. The copies are made in the browser of the photographer.
For a password: only a hash (PBKDF2-SHA-256 with a random salt). The server cannot read the password.
For a client: a random code that your browser keeps, the optional name the client writes, and the photos the client marked with a heart. A client needs no account.
When a client presses "Send my picks": the name, the number of picks and the time. The client can also write an email address. The server sends the name, the number and the address to the photographer by email.
The email addresses that a photographer writes to send the link of a gallery, and the time of each send. The server sends each address an email with the title and the link. The reply address is the email address of the photographer. The server never sends the password.
An activity list for each gallery. It shows when a client opened the gallery (once a day for each browser), downloaded photos or sent picks. It shows the name of the client if the client wrote one. The server stores no IP address.
The sign-in email address of the photographer, in each gallery. The server needs it to send the "picks" email.
The options of a gallery. These are the pick limit, the watermark and the closing date. They are also the download size, the cover photo and the layout. The last ones are the lock on picks, the email gate and the collection.
A comment that a client writes on a photo (up to 500 characters). The server also stores the name of the client, if the client wrote one, and the time. The photographer sees all comments and can delete them. A client sees only their own.
The width and the height of each photo in pixels. The browser of the photographer reads them.
A collection: the name that the photographer writes, and the galleries in it. A collection has its own private link. Anyone with the link sees the titles of the galleries in it and the number of photos. They see a cover photo only for a gallery with no password and no email gate.
If a photographer turns on "Ask clients for their email": the email address that a client writes, the optional name and the time of the first visit. The server ties the address to the random code of that browser. The photographer sees the list and can export it as a CSV file. The server keeps each address until the photographer deletes the gallery or it closes.
If a photographer turns on "Lock picks after Send": a mark that tells the server that a client sent picks. The server keeps the mark until the photographer unlocks that client or deletes the gallery.

Where, and for how long

The photos are in a private Cloudflare R2 bucket. The rest is in a Cloudflare D1 database. The data stays until the photographer deletes it. A photographer can also set a closing date. After that date, the server deletes the gallery within one hour. It deletes the photos, the picks, the comments, the email addresses and the activity too. The server also deletes each activity event after 90 days. A photographer can delete a photo, a gallery or the whole account. Deleting the account also deletes all galleries, photos and the logo. Cloudflare D1 keeps backups of the database for up to 30 days, so deleted rows can stay in a backup for that time.

Who can see the photos

Only people who have the link of a gallery, and the password if the gallery has one. The link is random and long. The photos are never public: the server sends a photo only after it checks the link and the password. Search engines do not index a gallery. A client who wrote a name or marked favorites is seen only by the photographer of that gallery.

Cookies and tracking

No tracking and no ads.
When a client opens a gallery with a password, the server sets one cookie. It is for that gallery only, and it lets the client open the gallery for 7 days. It holds a random code, not the password.
The server limits the emails it sends. Each client can send picks 5 times a day for each gallery, and each photographer can email 50 addresses a day. It also limits comments. A client can write 20 a day, and a gallery can get 200 a day. It limits email gate entries too. A client can give 10 a day, and a gallery can get 500 a day.
To stop people who guess passwords, the server counts tries for each address. The count is stored as a keyed one-way hash of the IP address that changes every day. It has no content, and the server deletes it after one day.
The server does not put names, titles or gallery links in its logs.
The server also keeps anonymous usage counts (counts only, no content).
If the page has an error, it sends an error report. The report has no name, no password and no gallery link.

Report a gallery

Every gallery has a "Report this gallery" link. It opens an email to the address in the terms of use.

Your rights, your contact and the law

Who is responsible

I am Kevin Amado, and I am responsible for the data in Gallery. I am one person in Alberta, Canada. Write to kamadorueda@gmail.com with any question or request about your data.

Why data is used, and for how long

Counts, error reports and logs: to run the tool and fix errors. The legal basis is my legitimate interest. Counts stay 90 days. Logs and error reports stay 7 days. Nothing is counted when your browser sends Do Not Track or Global Privacy Control.
Cloudflare also records about one request in ten in more detail. That record has your browser, operating system, language, network and approximate location (country, region and city). It is deleted after 7 days.
Features you turn on, such as sign-in, sync, reminders or sharing: to give you that feature. The legal basis is your consent or our contract. This page says how long each kind of data stays.
Data in your browser: I do not receive it. It stays until you clear it.

Who receives your data, and where it goes

Cloudflare hosts this tool and handles the data for me. It works in the United States and in other countries. For transfers from the EU and the UK, it relies on the EU-US Data Privacy Framework and standard contractual clauses. If you sign in with Google, Google receives your sign-in request. I do not sell your data. This page names any other service.

Your rights

You can ask for a copy of your data.
You can ask me to correct it, delete it or stop using it.
You can ask me to move it to another service.
You can object to how I use your data.
You can take back a consent at any time.
Write to the address above. I answer within 30 days.
If the request is about an account, write from the email address of that account. This shows me it is you.
You can also clear the data of this site in your browser. That removes what the page keeps there.
If you delete your account in one app, I get a request to delete what my other apps keep for it. I finish it within 30 days.

Complaints

If you are not happy, you can complain to a data protection authority. In the EU, this is the authority of your country. In the United Kingdom, it is the ICO. In Canada, it is the Office of the Privacy Commissioner of Canada. For Alberta, it is the Office of the Information and Privacy Commissioner of Alberta. In Saudi Arabia, it is SDAIA. I would like to answer you first.

Children

This tool is not for children under 13, or under 16 in the EU without a parent's permission. If a child gave me data, write to me. I will delete it.

If you collect data about other people

You may use this tool to collect data about other people, such as joiners, customers, guests or signers. You then decide why and how. You must tell them, and you must have a lawful reason. I use that data only to run the tool for you, as your processor. I use it for nothing else.