Effective date: July 12, 2026
keeppix ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. It applies to photographers who create accounts ("Users") and to the clients who view galleries shared with them ("Gallery Visitors").
Account information: When you register, we collect your name, email address, and a hashed version of your password (if you sign up with email). If you sign in with Google, we receive your name, email, and profile photo from Google.
Photos and gallery content: Photos you upload, gallery titles, descriptions, and any captions or metadata you provide.
Payment information: Payments are processed by Stripe. We do not store your credit card number or bank details — Stripe handles all payment data under their own privacy policy. We store your Stripe customer ID and subscription status.
Client information: Email addresses of gallery clients that you enter manually or that clients provide when accessing a gallery. Client names, if provided.
Usage data: When galleries are viewed, we record a hashed (non-reversible) version of the viewer's IP address, country (derived from Cloudflare headers), browser user agent, and timestamp. We do not store raw IP addresses.
Branding and settings: Your brand logo URL, brand color, watermark preferences, and notification settings.
Face data (optional): If you enable facial recognition on a gallery, Amazon Rekognition processes photos to detect and group faces. We store face bounding boxes, confidence scores, and grouping identifiers. See Section 5 for more detail.
We use the information we collect to:
We do not use your photos for marketing, sell your data to third parties, or use your content to train AI models.
We use the following third-party services to operate keeppix. Each processes data as described:
Amazon Web Services S3 — stores all uploaded photos in a secure, access-controlled bucket. Photos are served via presigned URLs that expire automatically.
Amazon Rekognition — used only when you explicitly enable facial recognition on a gallery. Processes photos to detect faces and creates a private face collection scoped to your gallery. Data is stored in AWS and deleted when you disable the feature or delete the gallery.
Stripe — handles all payment processing for paid subscriptions. Stripe stores your payment method under their privacy policy (stripe.com/privacy). We only store your Stripe customer ID.
Resend — delivers transactional emails (gallery invites, password resets, notifications). Email addresses are shared with Resend only to send the specific email.
Neon — our managed PostgreSQL database provider, which stores all structured data (accounts, gallery metadata, favorites, comments, analytics). Data is stored in encrypted databases.
Cloudflare — provides our hosting infrastructure, CDN, and DDoS protection. Cloudflare may process request metadata (IP address, headers) as traffic passes through their network, per their privacy policy.
Google — if you sign in with Google OAuth, Google shares your name, email, and profile picture with us per Google's privacy policy. We also use Google Ads for advertising measurement (see Section 6).
We do not sell, rent, or trade your personal information. We share data only:
The facial recognition feature uses Amazon Rekognition to detect faces in photos and group them by identity. This processing may constitute biometric data collection under certain laws (e.g., BIPA in Illinois, GDPR in the EU, CCPA in California).
This feature is off by default and must be explicitly enabled per gallery by the photographer. By enabling it, you represent that you have obtained all legally required consents from individuals whose images will be processed.
Face data is isolated to your gallery's private AWS Rekognition collection and is never used to identify individuals across galleries or shared with any third party beyond AWS. You can delete all face data for a gallery by disabling the feature in gallery settings or deleting the gallery entirely.
We collect basic analytics on gallery views and downloads to help photographers understand how their galleries are used. This includes a hashed IP address (not reversible to identify individuals), country, browser type, and timestamp.
We use Google Ads(via the Google tag, gtag.js) for advertising conversion measurement and remarketing. This service may set cookies and collect your IP address, browser information, and the pages you visit in order to measure the performance of our ads and show relevant ads across Google's network. This data is processed by Google under its privacy policy. You can control or opt out of personalized advertising in your Google Ads settings. Aside from Google Ads, we do not use other third-party advertising or analytics trackers. Session authentication uses a secure HTTP-only cookie for logged-in photographers only.
We retain your account data and photos for as long as your account is active. If you delete your account, your data is permanently deleted within 30 days, except where we are required to retain it for legal or accounting purposes.
Gallery analytics (hashed view records) are retained for 24 months. Client email addresses associated with favorites and comments are retained until the gallery is deleted.
We take reasonable technical and organizational measures to protect your data, including encrypted storage, HTTPS-only access, presigned URLs for photo delivery, and hashed passwords. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
If we become aware of a data breach that affects your personal data, we will notify you within 72 hours as required by applicable law.
Depending on your location, you may have the following rights:
To exercise any of these rights, email us at info.keeppix@gmail.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.
keeppix is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly. If you believe we have collected information from a child, please contact us at info.keeppix@gmail.com.
Our infrastructure is primarily based in the United States. If you are located outside the US, your data will be transferred to and processed in the US. By using keeppix, you consent to this transfer. We rely on standard contractual clauses and the data processing agreements of our service providers to ensure appropriate protection of data transferred from the EU/EEA.
We may update this Privacy Policy from time to time. When we do, we will update the effective date above and notify you by email for material changes. Your continued use of keeppix after the effective date constitutes acceptance of the updated policy.
For privacy-related questions, requests, or concerns, contact us at: info.keeppix@gmail.com