1. Data We Collect
We collect your email address and password (stored as a salted hash) when you register. We collect the photos you upload, along with metadata such as file size, upload date, and EXIF data (if present — including GPS coordinates if your device embeds them). We collect the scene and object labels our mobile app generates on your device when you upload a photo (see section 4). We collect usage data (storage used, retrieval requests) to operate the service. We collect payment information via Stripe — we never store your card details directly.
2. Content Moderation
Every uploaded photo is automatically scanned for child sexual abuse material (CSAM) in two ways. First, we compute a Microsoft PhotoDNA perceptual hash of the image on our own servers and submit only that hash — never the image — to Microsoft's PhotoDNA matching service, which compares it against a database of known illegal material. Second, the image is checked with AWS Rekognition (machine-learning detection), which does receive the image content. When illegal content is detected, the content is quarantined, the account is flagged, and a report is submitted to the National Center for Missing & Exploited Children (NCMEC) as required by law. At share-link creation time, we additionally check content against StopNCII's non-consensual intimate imagery (NCII) hash database. All moderation is automated — no human reviews your photos unless an abuse report triggers a manual review. Moderation results are stored securely and not used for advertising.
3. Encryption
Photos are encrypted in transit using TLS/HTTPS for every upload, download, and API call. Photos at rest are protected by infrastructure-provider encryption on hot storage (Backblaze B2) and additionally encrypted at the application layer with AES-256-GCM in cold storage (the Archive), using a per-user encryption key. These keys are wrapped with a master key under our control, which means we can decrypt content when needed for restore operations and for the legally-required CSAM scanning. We never decrypt your content for profiling, advertising, AI training, or any purpose other than serving the product to you and meeting our legal obligations.
4. How We Use Your Data, and On-Device Labelling
Your photos are stored to provide the service. We do not scan them for advertising purposes, use them to train AI models, sell them to third parties, or allow employees to view them (except in response to a valid law enforcement request or a manual abuse-report review). Separately, our mobile app labels photos on your device as you upload them, using the image-classification framework built into your phone's operating system (Vision on iOS, ML Kit on Android). This produces short generic tags describing the scene or the objects in the frame — "beach", "dog", "birthday", "document". The image is not sent anywhere to be labelled and no third-party classification service is involved: the analysis happens on the device, and only the resulting text labels leave it. Those labels are sent to us with the upload and stored on the photo's record, where they are used to help you search and organise your library. They are returned only to your own devices and are not included in share links. We do not generate these labels on our servers — the only automated analysis we run on our own infrastructure is the moderation scanning described in section 2 — and we do not use them for advertising, profiling, or AI training. The labels describe scenes and objects only: they do not identify individual people, and neither the app nor our servers perform facial recognition or any other biometric processing on your photos.
5. EXIF Data and Shared Photos
When you upload a photo, any EXIF metadata embedded by your camera or phone (including GPS coordinates, camera model, and timestamp) is stored alongside your photo and used to organise your library — for example, to determine the date a photo was taken. Our servers also read that EXIF themselves and copy parts of it into structured fields on your photo record: the capture date, the camera, lens and exposure settings, and, where the file carries a GPS fix, the latitude and longitude as separate numeric coordinates. Our mobile app may additionally send coordinates read from your device for photos whose file carries none of its own; where both are available, the coordinates in the file are used. Those structured fields are returned only to your own devices and are not sent to share-link recipients. The original file is, however: when you share a photo via a share link, it is served with its EXIF data intact. If you do not want GPS or camera information to be visible to people you share with, please strip EXIF from your photos before uploading, using your phone's native tools or a third-party app.
6. Cookies
We use only essential cookies necessary to operate the service: a session authentication cookie, a terms-acceptance state cookie, and a short-lived invitation token cookie. We do not use advertising cookies, analytics trackers, or third-party tracking pixels. For the full list of cookies and their purposes, see our Cookie Policy at preserveforever.photos/cookies.
7. Data Retention
Your photos are retained as long as your account is active. If you delete your account, your photos are permanently deleted from our systems within 30 days. Archive (cold storage) photos may take up to 90 days to be fully purged from all backups.
8. Your Rights (GDPR / UK GDPR)
If you are in the EU, EEA, or United Kingdom, you have the following rights: (a) Right of access — request a copy of the personal data we hold about you; (b) Right to rectification — ask us to correct inaccurate data; (c) Right to erasure — delete your account and all associated data at any time via Account Settings → Delete Account; (d) Right to data portability — download a structured JSON export of your profile, photo metadata, and sharing history via Account Settings → Export Data, or by requesting it at privacy@preserveforever.photos; (e) Right to object — object to processing where we rely on legitimate interest; (f) Right to withdraw consent — where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. We will respond to all data subject access requests (DSARs) within 30 days of receipt. To exercise any of these rights, email privacy@preserveforever.photos.
9. Incident Response and Breach Notification
In the event of a personal data breach, Preserve Forever Ltd will notify the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, where it is likely to result in a risk to the rights and freedoms of individuals, as required by UK GDPR Article 33. Where a breach is likely to result in a high risk to affected individuals, we will also notify those individuals without undue delay. To report a suspected security incident, email security@preserveforever.photos.
10. Third-Party Services
We use the following third-party services: AWS (S3 Glacier Deep Archive for cold storage; Rekognition for mandatory content moderation; KMS for encryption key management); Microsoft PhotoDNA for CSAM hash matching at upload time; StopNCII for NCII hash matching at share time; NCMEC CyberTipline for mandatory CSAM reporting; Backblaze B2 for hot photo storage; Supabase for authentication and database; Stripe for payments; and Resend/SMTP for transactional emails. Each of these services has their own privacy policy. Only image hashes, never image content, are transmitted to Microsoft PhotoDNA and StopNCII, and only for child safety and NCII purposes respectively. AWS Rekognition is the one moderation provider that receives image content, because machine-learning detection cannot work on a hash.
11. Contact and Data Controller
The data controller is Preserve Forever Ltd, Company No. 17198569, 124–128 City Road, London, United Kingdom EC1V 2NX. For privacy questions, data requests, or to exercise your rights, email: privacy@preserveforever.photos. For security concerns, email: security@preserveforever.photos.