Privacy Policy

Controller

The controller in charge of data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is:

1. Login with Google

PicSpot only supports login with Google. When you log in, we read and store your Google account's name and email address used for authentication.

We also ask you to provide an email address that we can use to contact you. By default, this is your Google account's email. This address is used exclusively for important service-related notifications. No spam. No marketing.

The legal basis for processing this data is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in providing secure user login).

2. Google Drive File Access

When you connect a Google Drive storage (to select photos for your gallery), we request the following permission:

https://www.googleapis.com/auth/drive.file

This allows PicSpot to see, edit, create, and delete only the specific files and folders you choose to use with the app. We do not access or manage any other files in your Google Drive.

Importantly, we do not download, copy, or permanently store images selected via PicSpot. Files remain in your Google Drive. However, to improve performance, we implement caching of image content.

Our infrastructure provider, Cloudflare, may cache these images. By default, Cloudflare caches content for up to 2 hours (120 minutes), unless overridden. Cached content is temporary and automatically expires.

You can revoke permission at any time via your Google account dashboard: https://myaccount.google.com/permissions

3. Hosting & Infrastructure

Our entire infrastructure is hosted with Cloudflare, which powers our frontend, backend, and database through edge networks.

Our database is deployed in a Cloudflare EU Workers cluster to ensure compliance with GDPR and local data processing.

When visiting our site, technical information (such as IP address, browser type, and time of access) may be collected by Cloudflare to maintain operational security. This is based on our legitimate interest under Art. 6(1)(f) GDPR.

Our site uses SSL/TLS encryption (indicated by the padlock icon and https://) to secure all data transmissions.

4. Analytics with Ahrefs

We use Ahrefs to collect anonymous analytics to help us understand general traffic patterns. No cookies or personal data are used for this tracking.

• IP address
• Pages visited
• Device and browser info

5. Live Chat with Crisp

We use Crisp.Chat for real-time communication. When using the chat feature, the following data may be processed:

• IP address
• Browser/device info
• Chat content
• Optional email address (if you enter it)

6. Emails and Customer Communication

If you contact us via email, your message (including your email address, name, headers, and any attachments) will be processed and stored in the EU.

The legal basis is Art. 6(1)(a) GDPR (consent) or Art. 6(1)(b) GDPR (fulfilling a request).

Email records are stored as long as necessary to respond and fulfill any legal obligations.

7. Your Rights

You have the right to:

• Access or correct your personal data
• Request deletion of your data
• Withdraw consent where applicable
• Object to processing based on legitimate interest

To exercise your rights, please contact us at [email protected].

8. Changes to This Privacy Policy

We may update this policy to reflect legal, operational, or functional changes. Any updates will be posted here and, where appropriate, communicated via email.