Privacy policy
The privacy policy of picsme is a separate public page: Privacy. If this summary and the policy ever differ, the policy applies.
Summary
Section titled “Summary”| Gallery clients | No accounts, names or emails. Only the gallery password. With a personal password the photographer sees opens, downloads and the client’s selection, kept while the gallery exists. IP address held in memory only, against password guessing; not recorded. |
| Photographers | Email, name, password hash (argon2id), portfolio contacts and profile photo if added; Google account ID and email for Google sign-in (no access to mail, contacts or files). Session cookie for 30 days. IP address not stored, except after a rejected burst of sign-in attempts: briefly, in a local security log that is size-limited and overwritten automatically. Daily aggregate account statistics, kept for 2 years. |
| Where | Servers: a data centre in the EU (France), which also protects the network against attacks. Encrypted daily database backup (no photos) in the EU, kept up to 30 days. |
| Deletion | A deleted gallery or account disappears from the service immediately; photo files are erased from storage within a day; backups expire within 30 days. |
| Cookies | Strictly necessary only. No analytics, no advertising. |
The photographer is the controller of the photos and of any client data they enter; picsme processes it on their behalf. See Privacy and GDPR and Data processing (DPA).