Privacy policy
Last updated: 19 October 2026
PicShelf is a photo gallery service for photographers. This policy explains what personal data we collect when you use picshelf.app or a gallery hosted by PicShelf on a photographer's own domain, why we collect it, who we share it with and what rights you have. We keep it short on purpose: we collect very little, and we never sell data or show advertising.
1. Who this policy covers
Two kinds of people use PicShelf:
- Photographers (account holders) who sign up, upload photos and publish galleries.
- Visitors who open a gallery link to view or download photos. Visitors never need an account.
PicShelf is the data controller for account data and for the technical data described below. For the photos themselves and the people who appear in them, the photographer decides what is uploaded and shared; PicShelf stores and displays that content on the photographer's behalf (see section 7).
2. What we collect
2.1 Account data (photographers)
| Data | Details |
|---|---|
| Username | Chosen by you at sign-up. It is used to log in and shown in your dashboard. |
| Password | Stored only as a salted hash. We cannot read your password. |
| Settings | Optional custom domain and the visual style you pick for your galleries. |
| Account dates | When the account and each album were created. |
We do not ask for your name, email address, phone number or payment details at this time.
2.2 Content you upload
- Photos, in the original file you upload plus resized copies we generate for fast display.
- Album names, titles, subtitles, hero images and the order of your photos.
Original photo files may contain embedded metadata (EXIF) such as the camera model, capture date or GPS location. We store originals exactly as uploaded, and the download button in a public gallery serves that original file. The resized display copies have this metadata removed. If you do not want metadata shared, strip it before uploading.
2.3 Gallery statistics (visitors)
When a visitor opens a gallery, opens a photo in full screen or downloads a photo, we record one event containing only the album, the photo (if any), the type of event and the time. These events let the photographer see how their gallery is doing. We do not store the visitor's IP address, device identifiers or any cookie with these events, so they cannot be traced back to an individual.
2.4 Technical data
Like any website, our servers and our network provider process the IP address, browser type and requested pages for every request. We use this to deliver pages, block abuse (for example rate limiting login attempts and upload requests) and diagnose errors. Server logs are kept for a short period and are not combined with gallery statistics or account data for any other purpose.
3. How we use it
- To create and secure your account and keep you signed in.
- To store, process and display your photos and galleries, including on your custom domain if you set one.
- To show photographers aggregate statistics about their galleries.
- To keep the service running, prevent abuse and fix problems.
- To respond when you contact us.
We do not use your data for advertising, profiling or automated decision-making, and we do not sell or rent it to anyone.
4. Legal basis
Where the General Data Protection Regulation (GDPR) or a similar law applies, we rely on:
- Performance of a contract for account data and uploaded content: we need it to provide the service you signed up for.
- Legitimate interests for technical data, abuse prevention and anonymous gallery statistics. These interests are limited to running a secure, working service and do not override your rights.
- Consent where we ask for it explicitly, for anything not covered above. You can withdraw consent at any time.
5. Cookies and local storage
We use no advertising or tracking cookies. The only items we place in your browser are:
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
token | Cookie (HttpOnly, Secure) | Keeps a photographer signed in to the dashboard. Set only after you log in. | 7 days |
lang | Cookie | Remembers the language you chose for the site. Set only when you pick a language. | 1 year |
ps-theme | Local storage | Remembers whether you chose light or dark mode. | Until you clear your browser data |
Our network and security provider may also set a strictly necessary cookie to protect the site against automated traffic. Such cookies are not used to identify or track you across sites. Gallery visitors who only view photos receive no PicShelf cookie at all.
6. Who we share data with
We share data only with the service providers we need to run PicShelf, and only to the extent required:
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application and database | European Union (Germany) |
| Cloudflare, Inc. | Network delivery, DNS, encryption and protection against attacks. All traffic to our sites passes through Cloudflare. | Global network; EU and US entities |
| Amazon Web Services, Inc. | Object storage for uploaded photos and generated copies | United States |
| Third-party web font service | Delivers the fonts used on picshelf.app. Your browser requests the font files directly, which exposes your IP address to that provider. | United States |
Each provider acts under a contract that limits how it may use the data. Where data leaves the European Economic Area, transfers rely on the provider's standard contractual clauses or an adequacy decision. We may also disclose data if the law requires it, or to protect the rights and safety of PicShelf, our users or others.
7. Public galleries and photos of other people
Galleries are published at an unlisted web address. Anyone who has the link can view and download the photos, and links can be forwarded or indexed by search engines if they are shared publicly. Photographers should treat a gallery link as public and should not upload content they are not entitled to share.
If you are a photographer, you are responsible for having the right to publish the photos you upload, including the consent of the people who appear in them where that is required.
If you appear in a photo hosted on PicShelf and want it removed, please contact the photographer who published the gallery first, as they control the content. If you cannot reach them, contact us with the gallery link and we will help.
8. How long we keep data
- Account data is kept as long as your account exists. When your account is deleted, your albums, photos and statistics are deleted with it.
- Photos and albums are kept until you delete them from your dashboard. Deleted photos are removed from storage, and disappear from backups when those backups expire.
- Gallery statistics are kept with the album they belong to and are deleted with it.
- Server logs are rotated automatically and kept for no more than a few weeks.
- Backups of the database are kept for a limited rolling period for disaster recovery.
9. Security
All connections to PicShelf use HTTPS. Passwords are hashed with a modern algorithm and never stored in clear text. Sign-in sessions use HttpOnly cookies that scripts cannot read, login and upload endpoints are rate-limited, and access to the storage bucket is restricted to the application. No system is perfectly secure, so please use a strong, unique password and sign out on shared devices.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- have your data deleted;
- restrict or object to certain processing;
- receive your data in a portable format;
- lodge a complaint with your local data protection authority.
Photographers can edit or delete their albums and photos at any time from the dashboard. To delete your account entirely, or to exercise any other right, contact us. We answer within one month. We may ask you to confirm you control the account before acting on a request.
11. Children
PicShelf accounts are intended for adults and professionals. We do not knowingly collect data from children under 16. If you believe a child has created an account, please contact us and we will delete it.
12. Changes to this policy
We may update this policy as the service evolves, for example when we add new sign-in options or features. The date at the top tells you when it last changed. For significant changes we will notify photographers in the dashboard.
13. Contact
Questions, requests or concerns about your data: [email protected].