Privacy Policy

1. Who we are and what this covers

PicsGenics is a private photo and video album service operated by PicsGenics (“we”, “us”). This policy covers the website at https://picsgenics.com, the PicsGenics apps for iOS and Android (which show the same service inside an app), and the emails we send. We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, where they apply to you, the GDPR and UK GDPR.

2. What we collect

Account details

• When you sign up with an email address: your first and last name, a username, your email address and a password. We store only a salted hash of the password, never the password itself.
• When you sign in with Google: your name and email address as Google provides them. We never see your Google password. Google’s own privacy policy governs what Google does with the sign-in.
• Your account settings, plan and the permissions an administrator may enable (such as video uploads).

Photos and videos

• What you upload. The photos and videos you add to albums, their file names and sizes, and when you uploaded them. Photos are resized and re-encoded in your browser before upload, so the original file (including any camera RAW) never leaves your device; videos are uploaded as they are, together with a still frame captured in your browser that we use as the thumbnail.
• Album details. Album names, dates, who you share each album with and the role you give them, and the share links you create.
• Embedded metadata. A file you upload may carry metadata (such as the date it was taken). We don’t extract or use it beyond storing the file.

Face data

PicsGenics offers two optional face features, described in detail in section 4. They create face templates: numeric representations of a face that let us tell whether two faces look alike. A template is not a photo and cannot be viewed as one. Under Australian privacy law a face template is sensitive information, and we treat it that way.

Sharing and invitations

• The email addresses of people you invite to an album, so we can send the invitation.
• Which albums you have been given access to, by whom, and when.
• How many times a share link you created has been used.

Support

• The subject, category and messages of any support case you open, and our replies.

Security and technical information

• Two-step verification: if you turn it on, the secret for your authenticator app (stored encrypted), one-way hashes of email and backup codes, and a hash of the “trust this browser” cookie, so a trusted browser can skip the second step for 30 days.
• Sign-in times and the expiry of your session.
• Your IP address and browser type, used to limit abusive requests and kept in our server logs for a limited period. We don’t use them to build a profile of you.
• If an email we send bounces or is reported as spam, we record the address and the reason so we stop emailing it.

3. How we use information

• To provide the service: store your albums, show them to you and to the people you share them with.
• To run the optional face features you or an album owner have turned on (section 4).
• To keep the service safe: verify your email, protect your account, detect abuse, and screen uploads for explicit content (section 5).
• To send transactional email: verification, password resets, verification codes, invitations, support replies and notices about your account. We don’t send marketing email.
• To answer your support requests.
• To comply with the law and enforce our Terms of Service.

We don’t sell personal information, show advertising, or use third-party advertising or analytics trackers.

4. Face recognition

People grouping

If the owner of an album is on a plan that includes People grouping, photos uploaded to that album are scanned for faces. Each face becomes a template that is grouped with similar faces into “People” the album owner can browse. These groups are private to the album owner: they are never shared, never compared with another user’s library, and never used to identify a person to anyone. Face templates are deleted when the photo is permanently deleted and when the owner deletes their account.

“Find photos of me”

You can take a single selfie to find photos of yourself in albums shared with you. We derive one template from the selfie and store only that template; the selfie itself is discarded immediately. We create it only after you give explicit consent in the app, and you can delete it at any time from Account → Profile → Face profile. Deleting it stops the feature straight away.

We never use face data to train models, never share it with third parties, and never use it for any purpose other than the two features above. Faces are detected and templates are computed by software we operate ourselves on our own infrastructure, not by an external face-recognition service.

If you appear in someone else’s photos: an album owner who uses People grouping processes the faces in the photos they upload, which may include yours. Album owners are responsible for uploading photos they are entitled to share. If you would like your face removed from someone’s library, contact us at support@picsgenics.com and we will help.

5. Content moderation

Every uploaded photo is checked automatically for explicit nudity by software we run ourselves. Photos the check is confident about are blocked; photos it is unsure about are hidden until a member of our team reviews them. We only look at content that has been flagged or reported to us. Swimwear, art and ordinary family photos are not what the check is looking for; if a photo of yours is held back by mistake, open a support case.

6. Who can see your information

• People you share with. Anyone you invite to an album, or who opens a share link you made, can see that album’s photos and videos, your name and username, and the names of other members. Editors can also add photos. You can change roles or remove people at any time.
• Service providers that host and run PicsGenics on our behalf, under contracts that restrict what they can do with the data:

• When the law requires it, or to protect the rights, safety or property of our users or the public, we may disclose information to authorities. We will tell you when we are allowed to.
• If PicsGenics changes hands, your information may transfer to the new operator under this policy; we will let you know beforehand.

7. Where your data is stored

Photos, videos and the servers that process them are in Amazon Web Services’ Sydney region, in Australia. Google processes a Google sign-in wherever Google operates. If you use PicsGenics from outside Australia, your information is transferred to and stored in Australia.

8. How long we keep it

Deleted data may persist in encrypted backups for a limited period before those backups are rotated out.

9. How we protect it

• All traffic uses HTTPS. Uploads and downloads go directly between your device and our storage over short-lived, signed links.
• Passwords are stored as salted bcrypt hashes. Two-step verification is available on every account, and authenticator secrets are encrypted at rest.
• Every uploaded file is checked on the server to be a genuine photo or video before it is accepted.
• Albums are private by default; access requires an invitation or an unguessable, time-limited link.
• Access to production systems is limited to the people who operate the service.

No system is perfectly secure. If we learn of a breach that affects you, we will notify you and the regulator as the law requires.

10. Your choices and rights

• See and correct your details in Account → Profile. You can change your name, username and password there.
• Download your photos and videos from any album at any time, in their stored quality.
• Delete content from an album or from Trash, and revoke sharing for any person or link.
• Delete your face template in Account → Profile → Face profile.
• Delete your account in Account → Security → Delete account, or follow the steps on Delete your account. This removes your account, your face data, your albums and every photo and video you uploaded.
• Ask us for a copy of the personal information we hold about you, to correct it, or to delete it, by emailing support@picsgenics.com. We will answer within 30 days.
• If you are in the EU or UK you also have the rights to restrict or object to processing and to data portability, and you may complain to your local supervisory authority.
• If you are unhappy with how we handled your information, tell us first. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

11. Cookies and storage on your device

We use only what the service needs to work. There are no advertising or tracking cookies.

12. Children

PicsGenics is not directed at children under 13, and we don’t knowingly collect personal information from them. If you believe a child under 13 has an account, contact us and we will delete it.

13. Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your information, we will email the address on your account or show a notice in the app before it takes effect.

14. Contact

Questions, requests or complaints about privacy: support@picsgenics.com. You can also open a support case from Account → Help & Support.