PICLEY

Privacy Policy

Effective date: May 8, 2026 · Last updated: May 9, 2026

This Privacy Policy explains how Picley ("Picley", "we", "our") collects, uses, shares, and protects your information when you use our mobile app and website at getpicley.com (together, the "Service"). Picley is operated as a sole‑developer service based in the United States.

1. Information we collect

You give us

• Account information. Email address, first and last name, and password (stored as a salted hash by our authentication provider — we never see your plaintext password).
• Event content. Photos and videos you upload, the album name, codeword, event date and time, and any text you provide such as captions or comments.
• Communications. Messages you send us when you contact support or submit feedback.

We collect automatically

• Photo metadata (EXIF). When you upload a photo, the file's embedded metadata — including capture time and, if your phone added it, GPS coordinates — is read so we can sort photos chronologically and group them by location. You can strip EXIF using your phone's photo settings before uploading.
• Device information. Operating system version, device model, app version, language, time zone, and a stable device identifier used only to deliver push notifications.
• Service logs. IP address, request timestamps, response codes, and basic event data (e.g., "album created", "photo upload failed") used for debugging, abuse prevention, and rate limiting. Logs are retained for up to 30 days unless required for security investigations.

We do not collect

• Phone numbers — Picley uses email only.
• Bank or credit card details — Picley is currently free.
• Data from third‑party social networks — we do not connect to Facebook, X, Instagram, etc.
• Advertising identifiers (IDFA, GAID) — we do not advertise and we do not track across other apps or websites.

2. How we use information

We use the information described above to:

• Create and operate your account and your event albums.
• Receive, store, process, and serve the photos you and other album members upload.
• Run the automated processing described in section 3 to remove duplicates, score quality, and curate a "Story" view.
• Send transactional emails: email confirmation, magic links, claim codes, "your album is ready," "event ending soon," etc.
• Send push notifications when significant events happen in your album, if you have granted notification permission.
• Maintain security: detect abuse, enforce rate limits, prevent unauthorised access, and respond to legal requests.
• Improve the Service: aggregate, non‑identifying statistics on which features are used.

We do not use your information for advertising, do not "sell" or "share" personal information as those terms are defined under California law, and do not engage in cross‑context behavioural advertising.

3. AI processing of photos

Picley runs every uploaded photo through a server‑side processing pipeline that is essential to the product. This pipeline:

• Safety check — flags explicit / unsafe content using NudeNet and CLIP. Photos that fail this check are rejected and not visible in the album.
• Duplicate detection — perceptual hashing identifies near‑duplicate uploads.
• Quality scoring — the photo is scored on aesthetic and technical quality (blur, exposure, composition).
• Face detection and clustering — to group photos that contain the same person inside one album. Picley extracts a numeric face signature ("embedding"). It does not identify who the person is, does not match them against any external database, and does not share these signatures outside of your album.
• Reverse geocoding — if a photo's EXIF includes GPS, we look up the place name (e.g., "Brooklyn, NY") so the album can be browsed by location. We do not store the original coordinates beyond what is needed to compute the place name.
• Story selection — a curation algorithm picks a subset of photos for the "Story" view.
• Reel rendering — Picley creates short video "reels" from album photos, either automatically (auto‑highlights, auto‑people, auto‑full) or when a member assembles their own. Rendering happens on Picley's servers using ffmpeg; photos are downloaded from storage, composited into a 720×1280 video with crossfades and an audio track, and uploaded back to storage as an .mp4. Once rendered, the .mp4 is a self‑contained file: it embeds the photos used. See section 7 for how long reels are kept and how reel deletion behaves.

All processing happens on Picley's own servers in the European Union. Your photos, face data, and reel videos are never used to train AI models, are never sent to OpenAI, Anthropic, Google AI, or any other third‑party AI provider, and are never made available to anyone outside the album members.

4. How information is shared

Photos and album content are shared only with people you grant access to:

• Album members. When you join an album, your first name, last name, and uploaded photos are visible to other members of that album. The organiser additionally sees your email address.
• Web viewers. If the album organiser shares a public view link, anyone with that link can view (but not download originals or contribute) the curated Story. They cannot see member identities or contact details.
• Service providers. See section 5.
• Legal compliance. If we receive a valid court order, subpoena, or law‑enforcement request, we may disclose information to comply. We will give you notice unless legally prohibited.
• Safety. We may report content to NCMEC (the National Center for Missing & Exploited Children) if it appears to involve child sexual abuse material, as required by US law.
• Business transfers. If Picley is acquired or merged, your information may be transferred to the new operator, who will be bound by a privacy policy at least as protective as this one.

5. Service providers we use

Picley uses a small set of trusted vendors. Each is contractually limited to processing your data only on Picley's instructions.

6. International data transfers

Picley primarily stores data in the European Union. Some service providers in section 5 are based in the United States, which means data may be transferred outside the EU/UK. Where that happens, transfers are protected by the European Commission's Standard Contractual Clauses (SCCs) and the providers' own certifications under the EU‑US Data Privacy Framework.

7. How long we keep data

• Original photos: kept for 45 days after the event ends, then deleted from primary storage. Compressed (1200‑pixel) versions remain available for browsing.
• Compressed photos and album content: kept for the life of the album. Album organisers can delete an album at any time; deletion removes all associated photos within 30 days.
• Reels (rendered video memories): kept for 45 days after the event ends, then automatically expired. When you delete a reel from inside the app, the rendered video and its thumbnail are removed from storage immediately (within seconds). When a reel's database row is removed by other means (account deletion, album deletion, etc.), the underlying video and thumbnail files are removed by an automated nightly sweep within 24 hours.
• Account data: kept while your account exists. You can delete your account from Settings → Delete my account; we permanently delete your account within 30 days. Photos you uploaded to other people's albums are not deleted automatically — see section 9 for how to remove them.
• Storage files (orphan cleanup): when a database row is deleted but the underlying photo or video file remains in storage, an automated nightly job removes the file within 24 hours. Where it matters for privacy (e.g. you tap "Delete photo" or "Delete reel"), Picley removes the file immediately rather than waiting for the nightly sweep.
• Log data: up to 30 days, except entries needed for security or fraud investigations.
• Email addresses on rejected/expired guest invites: deleted within 30 days if the invite is never claimed.

8. Security

We protect your information using industry‑standard measures: TLS 1.2+ in transit, encrypted databases at rest, hashed passwords, principle‑of‑least‑privilege access controls, and audit logging. No system is perfectly secure, however, and we cannot guarantee absolute security. If we discover a breach involving your personal information, we will notify you and the appropriate regulators as required by law.

9. Your rights and choices

• Access. Request a copy of the personal information we hold about you.
• Correction. Edit your name and email from inside the app, or ask us.
• Portability. Download your photos at any time using the in‑app "Save" feature (Camera Roll, Google Photos, or Dropbox).
• Push notifications. Turn off in your device's Settings.
• Email. Picley only sends transactional email. There is no marketing email to unsubscribe from.

Picley provides four levels of deletion, in increasing scope:

• Delete a single photo — open the photo and tap the delete icon. The photo and its rendered files are removed immediately.
• Delete reels I created (Manage tab inside an album) — removes every reel you created in that album, including the rendered videos and thumbnails. Auto‑generated reels and reels created by other members are not affected. Photos used inside the deleted reels are not affected.
• Delete all my photos (Manage tab inside an album) — removes every photo you uploaded to that album. Reels by other members or auto‑generated reels that include those photos are not automatically deleted: the rendered video files contain the photos as part of the video and continue to be visible to other album members until the reel expires (45 days after the event ends) or until the reel's creator (or the organiser, in the case of public reels) deletes it. If you want a reel removed sooner, ask the album organiser (for public reels) or the reel's creator (for private reels created by another member) to delete it. Picley plans to add a "rebuild this reel without these photos" feature; until then, this is the practical limit of what the system can do.
• Delete my account (Settings → Delete my account) — permanently removes your account, your push tokens, your contributor stats, your starred photos, and your reel rows across all albums. Photos you uploaded to other people's albums are kept in those albums (with the link to your identity removed) so that the organiser's event memories survive. To remove your photos from a specific album before deleting your account, use "Delete all my photos" inside that album first.

Web‑only guests (who joined an album via web link without installing the app) can request deletion of their data by emailing [email protected].

10. California (CCPA / CPRA) rights

If you are a California resident, you have the right to (i) know what personal information we collect, (ii) request deletion, (iii) request correction, and (iv) opt out of the "sale" or "sharing" of your personal information. We do not sell or share your personal information for cross‑context behavioural advertising. To exercise any right, email [email protected]. We will not discriminate against you for exercising these rights. We use no "financial incentives" within the meaning of California law.

11. UK / EU (GDPR) rights

If you are in the UK or EEA, the General Data Protection Regulation gives you rights to access, rectify, erase, restrict, port, and object to processing of your personal data, and to lodge a complaint with your supervisory authority. Our legal bases are:

• Contract — to provide the Service you signed up for (most processing).
• Legitimate interests — for security, abuse prevention, and product improvement, balanced against your rights.
• Consent — for push notifications and any optional integration you connect (Google Photos, Dropbox).
• Legal obligation — for tax, accounting, and law‑enforcement compliance.

You can exercise any right by emailing [email protected]. Picley does not have an EU representative because the developer operates as a sole individual; if this changes, this section will be updated.

12. Children's privacy

Picley is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has used Picley, please email [email protected] and we will delete the account. In jurisdictions where the digital age of consent is higher (such as the EU, where it can be 16), the same applies.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. If we make a material change, we will notify you in the app or by email at least 30 days before it takes effect.

14. Contact us

Privacy questions or requests:
[email protected]

General support:
[email protected]