Privacy notice

What is stored, and why

• Name, username, email address and a scrambled form of your passwordAbout: Registered usersWhy: To give you an account, sign you in, and send you account emails (activation, new password)Legal basis: Agreement: the terms you accept (art. 6(1)(b))
• Email address and the name you chooseAbout: GuestsWhy: To send you your personal link and sign-in codes, and to show your name in the albumLegal basis: Agreement (art. 6(1)(b))
• Photos, their captions and their technical details (EXIF), including where a photo was taken if the camera recorded itAbout: Everyone who uploadsWhy: To show, share and let others download the photos in the albumLegal basis: Agreement (art. 6(1)(b))
• Comments and likesAbout: Everyone who writes or likesWhy: To show them in the albumLegal basis: Agreement (art. 6(1)(b))
• Albums you are in, your access in them, invitationsAbout: EveryoneWhy: To decide who sees and does whatLegal basis: Agreement (art. 6(1)(b))
• Your choice of theme and languageAbout: EveryoneWhy: To show the app the way you choseLegal basis: Agreement (art. 6(1)(b))
• When you accepted the terms, and which versionAbout: EveryoneWhy: To show that you accepted themLegal basis: Legal obligation and legitimate interest (art. 6(1)(c), (f))
• Sign-in sessions with the IP address and browser of the deviceAbout: Registered usersWhy: To keep you signed in and to spot misuseLegal basis: Legitimate interest (art. 6(1)(f))
• Reports about content, and the decisions on themAbout: Reporters and the people reportedWhy: To handle content that should not be thereLegal basis: Legitimate interest (art. 6(1)(f))
• Feedback you sendAbout: Registered usersWhy: To improve the appLegal basis: Legitimate interest (art. 6(1)(f))
• Messages through the contact form: name, email address, topic and messageAbout: Everyone who writesWhy: To answer you, and to handle requests about your dataLegal basis: Legitimate interest (art. 6(1)(f)); for requests about your data, legal obligation (art. 6(1)(c))
• A log of what admins and their helpers doAbout: Admins and people with permissionsWhy: Security and accountabilityLegal basis: Legitimate interest (art. 6(1)(f))

Location in photos: the photo you upload is kept as it is. When the album is set to remove location (the default), nobody sees where it was taken in the app, and location is removed from every download.

Lysbilde has no ads, no tracking and no third-party analytics. It sends no newsletters: only the account and guest emails described above.

Who else handles the data

• netcup (Germany, EU) runs the server Lysbilde runs on, in a data centre in Nuremberg. Everything Lysbilde stores is kept there; photos are stored encrypted.
• Scaleway (France, EU) sends Lysbilde's emails. It sees the email address, the subject and the content of each email it sends.
• Cloudflare carries the traffic between your browser and Lysbilde, and so sees your IP address and the pages you request. Cloudflare is a US company; transfers are covered by the EU–US Data Privacy Framework and the EU standard contractual clauses in Cloudflare's data processing agreement.

They handle the data only on the controller's behalf, under data processing agreements. Nothing is sold or shared for marketing.

Backups are kept on the server and copied every night to a computer in Oslo, Norway; photos stay encrypted there too.

How long it is kept

Albums with their photos, captions, comments and likes

30 days from creation, unless an admin extends the album; then 14 more days where only the owner sees it; then deleted for good

Backups

At most two weeks after the data was deleted in the app

Whole-album zips and data exports

24 hours

Sign-in sessions

7 days without use, 30 days at most

Guests' email address and name

Until the guest is in no album any more

Your account

Until you delete it, or an admin does

Reports, and the admin log

6 months

Feedback

6 months after it has been handled

Messages through the contact form

6 months after they have been handled

Addresses that bounced

Until removed by an admin

Your rights

You can ask to see the data about you, have it corrected or deleted, restrict or object to its use, and get it in a machine-readable form. Much of this you can do yourself:

• Registered users download everything Lysbilde holds about them, and delete their account, on their profile page.
• Guests change their name on their guest profile, and leave an album themselves, choosing whether their photos stay or are deleted. When they are in no album any more, their email address and name are deleted.
• Everyone can delete their own photos, comments and likes.

Lysbilde is run privately as a hobby project; the person responsible for the data in it can be reached through the contact form.

For anything else, write through the contact form. You may also complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no).

Cookies and storage in your browser

Lysbilde uses only what it needs to work: a cookie that keeps you signed in (or, for guests, keeps the device signed in to the album), a cookie for your language, and your theme choice saved in the browser. There are no tracking or advertising cookies.

Changes

When this notice changes, you are asked to read it again the next time you use Lysbilde.