Privacy Policy

1. Information We Collect

Information You Provide

• Account information: When you sign in with Google, we receive your name, email address, and profile picture via Google OAuth.
• Photos and media: Images you upload to create photo albums, including any embedded metadata (such as EXIF data, including GPS location if present in the file).
• Album content: Text, captions, titles, and other content you add to your albums.
• Payment information: If you place a print order, payment is processed by Stripe. We do not store your credit card number or payment details — Stripe handles this directly and is subject to its own privacy policy.

Information Collected Automatically

• Usage data: Pages visited, features used, and actions taken within the Service.
• Device and browser information: Browser type, operating system, and IP address.
• Cookies and session data: We use cookies to keep you signed in and maintain your session.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity via Google OAuth
• Store and display your photos and albums
• Process print orders through our print-on-demand partner (Lulu Direct)
• Communicate with you about your account or orders
• Improve and develop new features
• Comply with legal obligations

3. How We Store Your Data

Your photos and album data are stored securely using Supabase, a cloud database and storage provider. Data is stored on servers located in the United States. We implement reasonable technical and organizational measures to protect your data, but no system is completely secure.

4. How We Share Your Information

We do not sell your personal information. We share data only in the following circumstances:

• Service providers: We share data with Supabase (storage and database), Stripe (payment processing), Lulu Direct (print fulfillment), and Vercel (hosting) solely to operate the Service.
• Google: When you authenticate via Google OAuth, Google's privacy policy governs the data Google collects during that process.
• Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of our users or the public.
• Business transfers: If Recollections is acquired or merged, your data may be transferred as part of that transaction.

5. Content Moderation

We use automated content moderation tools to screen photos uploaded to the Service for illegal content, including child sexual abuse material (CSAM). Uploaded images may be analyzed by third-party content moderation services (such as Google Cloud Vision SafeSearch) for this purpose. This screening occurs at the time of upload and does not result in human review of your photos except where illegal content is flagged.

We are required by law (18 U.S.C. § 2258A) to report any apparent CSAM to the National Center for Missing and Exploited Children (NCMEC). Accounts found to have uploaded illegal content will be immediately terminated and reported to the appropriate authorities.

6. No Use for AI Training

We do not use your photos, album content, or any other personal data for the purpose of training artificial intelligence or machine learning models. We will never sell, license, or share your content with third parties for AI training purposes.

7. Sharing Albums

If you choose to share an album using a share link, anyone with that link can view the contents of that album. Shared albums do not require the viewer to create an account. You can revoke a share link at any time from within the app.

8. Your Rights and Choices

You have the right to:

• Access the personal data we hold about you
• Delete your account and associated data by contacting us (see Section 12)
• Download your photos and album content at any time from within the app
• Revoke Google OAuth access at any time via your Google Account settings at myaccount.google.com

9. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your data within 30 days, except where we are required to retain it for legal or financial compliance purposes (for example, records of completed transactions).

10. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

11. Third-Party Links and Services

The Service integrates with third-party services including Google, Stripe, Supabase, Lulu Direct, and Vercel. Each of these services has its own privacy policy and we encourage you to review them. We are not responsible for the privacy practices of third parties.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Email: privacy@recollections.app

(If this address is not yet active, please use the contact method available in the app.)

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last Updated” date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.