Privacy

What we store, where it is kept, who else is involved, and how to see it, correct it or have it deleted.

Last updated: [date]

The short version

• Your pictures are stored in your own DigitalOcean Space, not on our disks.
• We store your account and your library's records: the words and settings around the pictures.
• Our servers handle a picture in passing when it is uploaded, to make the copies used for viewing. Those copies go to your Space too.
• We do not sell your data, show ads or track you. We set one cookie, and it is the one that keeps you signed in.
• Reading pictures with AI is off until you set it up. Recognising faces is off until you turn it on.

We would rather be exact than comforting. ImageStoria is not end-to-end encrypted. Our servers run your library, so they can technically reach your Space with the key you gave us. This page says what we do with that reach and what we do not.

Who is responsible

Chaz.Art & Co runs ImageStoria. [Full legal name of the entity and its registered address.] For anything on this page, write to [contact email].

For your account and for payments, we decide how the data is used. For what is inside your library, you decide: you choose what to upload, who to invite and which features to turn on, and we store and process it on your instructions. [Lawyer: confirm the controller and processor roles, the legal bases, and whether a data processing agreement is offered.]

This page is about the hosted service. If you run the self-hosted software, nothing reaches us, and you are responsible for your own data.

What we store

Your account

• Your email address and your name.
• A hash of your password. We do not store the password itself and cannot read it.
• The name of your library, your plan, and your payment history.
• When you made the account and when you last signed in.

The keys to your Space

The address of your Space, its name, and its access key and secret key. The keys are sealed, which means encrypted with a key held on our servers, before they are stored. They are never shown again, to you or to anyone. The account page shows only the last few characters of the access key.

If you connect a cloud AI provider, its API key is stored in the same way.

Your library's database

Each library has a database of its own, apart from every other library's. It holds:

• titles, descriptions, tags, comments, likes, stories and the settings of your edits;
• what was read from each file when it was uploaded: the date, the place if the file carried one, the camera and its settings, the file's name and size;
• what a worker or a cloud AI provider wrote, if you use one: captions, the scene, labels, text read in a picture, and the numbers used for search by meaning;
• face data, if you turn on people recognition (see Faces);
• the people you invited: their email address, name, a hash of their password, their role and what they may do;
• the story links you made, and tokens for your workers, stored as hashes.

Technical records

Like any web server, ours record requests: the time, the address asked for and the IP address it came from. We use these to keep the service running and to stop abuse. [What is logged and for how long.]

What stays in your own bucket

Every photo and video you upload is stored in your DigitalOcean Space, exactly as it arrived, together with the smaller copies made for viewing. Database backups of your library may be stored there as well. [Owner: confirm whether hosted libraries write backups to the subscriber's Space.]

When a file is uploaded, it passes through our servers on its way to your Space. The server reads the date, place and camera from it and makes the viewing copies. Some later actions do the same: developing an edited copy, making a reel of a story, or preparing a download. We do not keep a copy afterwards.

When you look at a picture, your browser fetches it from your Space through a signed link that expires. The files in your Space are never made public.

The Space is in your DigitalOcean account. DigitalOcean stores it under its own terms and privacy policy, in the region you chose. We never delete anything in it.

What the people who run the platform can see

Our admin pages show accounts, plans, payments, and for each library its counts and sizes: how many items, how much storage, how many people. They do not show pictures, titles, comments or any other content.

We do not open a library's database or a subscriber's Space to look at content. [Lawyer: state the narrow exceptions, such as a valid legal order, or fixing a fault at the subscriber's request and with their consent.]

Faces

Recognising people in pictures uses face data: numbers worked out from a face that can tell one person from another. In many places the law treats this as biometric data, which gets special protection.

• It is off by default. Only the owner of a library can turn it on, one space at a time.
• Faces are found by a worker on a machine the owner runs. They are never sent to a cloud AI provider.
• Face data is stored in the library's own database. It is never sent to a browser.
• Only the owner and editors see names, face outlines and the People page. Commenters, viewers and visitors with a story link never do.
• It is deleted with the picture it came from, with the person when the person is removed, when recognition is turned off for a space, or all at once if the owner chooses.
• We do not use face data for anything else, and we do not compare faces across libraries.

If you are the owner of a library: you decide to turn this on, so you are responsible for having the right to process the faces of the people in your pictures. In some places that means asking them first. Check the law where you live before you turn it on. [Lawyer: jurisdictions where consent or notice is required, for example under GDPR article 9 and the Illinois BIPA, and whether the feature must be withheld anywhere.]

If you are in someone's pictures and want your face data removed, ask the owner of that library. If you cannot reach them, write to us.

Reading pictures with AI

This is optional, and off until the owner sets it up. There are two ways.

A worker

A worker is a program on a machine the owner runs. It asks the library for work, fetches the pictures it is given through signed links, and sends back what it found. Our servers never connect to that machine. No picture is sent to an outside service. Some model files are downloaded to the worker's machine from public model hosts when it is set up.

A cloud AI provider

The owner may instead connect a provider they choose, with their own API key: Claude (Anthropic), OpenAI, Google, MiniMax, or any service at an address they give. The pictures to be read are then sent to that provider, under the owner's own account with that provider and under that provider's terms and privacy policy. What the provider keeps and how it uses it is set by those terms, not by us. Read them before turning this on.

We do not send any picture to an AI provider unless the owner has set this up.

Payments

By card

Card payments are handled by Stripe. You type your card into Stripe's page. We never see or store the card number. We receive from Stripe a customer reference, the state of the subscription, and for each payment the amount, the date and whether it went through. Stripe handles your card data under its own privacy policy.

In USDC

A USDC payment is a transfer from your own wallet on Ethereum, Base or Solana. We store your wallet address, the chain, the amount and the transaction hash, to match the payment to your account. We never hold or see your wallet's keys.

Data on a public chain is public and permanent. Anyone can see the transfer from your wallet to ours, and its amount, for as long as the chain exists. We cannot delete or change it, and deleting your account does not remove it. If your wallet can be tied to your name, so can the payment.

To read the chain we use [node or RPC providers], which see the requests we make.

Email

We send email about your account: to confirm your address, to reset a password, to remind you before a paid period ends, and to tell you about a payment that failed. Your library sends invitations to the people you invite. We do not send marketing email unless you ask for it.

Email is sent through a delivery provider, Resend, which handles the address and the message in order to deliver it.

Cookies and local storage

That is all. No ad trackers, no analytics cookies, and no cookie banner, because there is nothing to consent to. A library sets its own session cookie at its own address in the same way. [Owner: confirm what else the library app keeps in local storage.]

The site loads no fonts and no scripts from anywhere else, so no third party learns that you visited. Two exceptions happen only when you ask for them: paying by card takes you to Stripe's page, and the map inside a library draws its map tiles from OpenFreeMap, whose servers see your IP address and the area you are looking at.

The people you invite

The people a subscriber invites exist only in that library. We store their email address, name, password hash, role, and what they add: comments, likes, uploads and edits. They sign in at the library's own address.

If you were invited to someone's library, the owner of that library decides what happens to it, and can remove you and what you added. You can ask the owner, or us, for a copy of your data or to have it deleted.

Public story links

An owner or editor can make a public link to one story. Anyone who has the link can open that story without an account, and nothing else in the library. A link can be given a password, can allow downloads of the originals, and can let visitors add their own photos.

Visitors do not need to give their name or an email address to read a story. Photos a visitor adds are stored in the owner's Space and become part of that library, under the owner's control. [Owner: confirm what is recorded about a visitor who adds photos.] Deleting a link ends it at once.

Who else handles data

These you choose yourself, under your own account with them: DigitalOcean for your Space, and a cloud AI provider if you connect one.

We do not sell personal data and do not share it for advertising. We give data to authorities only when the law requires it. [Lawyer: international transfers and the safeguards used.]

How long we keep things

• While your account is open: as long as you keep it.
• When a library is paused for non-payment: its database is kept for [period], so that paying can open it again as it was.
• When you delete your account: the library's database is deleted at once. Copies in our backups are gone after [period]. Account and payment records that the law requires us to keep are kept for [period].
• Your Space: we never delete anything in it. It stays until you delete it at DigitalOcean.
• On-chain payments: permanent, and outside anyone's control.

Keeping it safe

Connections are encrypted with HTTPS. Passwords are stored as hashes made with Argon2id. Keys you give us are sealed before they are stored, and no page or API returns them. Each library has its own database, and the code serving a library is connected to that database only. Worker tokens are stored as hashes.

No system is perfectly safe. If a breach affects your data, we will tell you [within the time the law requires].

Your rights

Depending on where you live, the law gives you some or all of these. We honour them for everyone.

• See it. Ask for a copy of the personal data we hold about you.
• Correct it. Change your name, email and password on your account page. Change anything in your library in the library itself.
• Delete it. Delete your account on your account page. That deletes the library's database. Then delete your Space at DigitalOcean if you want the files gone too.
• Take it with you. Your files are already in your Space in a plain layout. For the database, see Leaving.
• Object or restrict. Ask us to stop or limit a use of your data.
• Withdraw consent where we rely on it, for example by turning people recognition off.
• Complain to the data protection authority where you live. [Name of the lead authority, if any.]

How to ask

Write to [contact email] from the email address of your account. We may ask a question to be sure it is you. We answer within [period].

Children

The service is not meant for anyone under [age], and we do not knowingly let them make an account. Pictures of children in a family's library are the responsibility of the owner of that library.

Changes to this page

When we change this page we change the date at the top. If a change matters, we email subscribers before it applies.

The agreement for using the service is in the terms.