Privacy policy

What we collect

When you make albums:

• Your email address, to sign you in, and the name and studio name you give us.
• The photos you upload and what you make with them: albums, pages, crops, film looks, stars, titles and notes.
• The details saved in your photo files, such as when they were taken and, if your camera recorded it, where.
• How you use Open Albums: signing up and in, making, uploading to, sharing, previewing and deleting albums, the film looks and settings you change, and the kind of device you use (phone, tablet or computer, and its system).

When you open an album:

• A cookie holding a random code that tells your browser apart, so the album remembers your cart, the delivery details you’ve started typing and, for 30 days, that you entered a private album’s code.
• The reactions you leave on photos.
• If you type a private album’s code, a scrambled (hashed) form of your IP address, to count wrong guesses for 15 minutes.
• What you do in it: opening it, how far you look through it, which photos you enlarge and for how long, wrong codes, sharing its link or photos, the photos you add to or take out of your cart and how far you get in checkout, with the kind of device. This is tied to the random code in the cookie above, never to your name.

When you order:

• Your name, phone number, email and delivery address, what you ordered and what you paid.
• You type your card or other payment details on Grow’s page. We never see or store them: Grow only tells us whether the payment went through.

When you visit our home page or the photographers’ page:

• That you visited, which sign-up or sign-in button you pressed, the kind of device, and the site or campaign link that sent you (for example, an email). No cookie is set for this; if this browser has opened an album before, the visit is tied to the random code in that cookie.

Like most websites, our hosting provider keeps short-lived technical logs (such as IP addresses and browser types) to keep the site running and secure.

How we use it

Only to run Open Albums: to sign you in, show your albums to the people you share them with, print and deliver orders, protect accounts and albums from abuse, and email you about your account, albums and orders (sign-in codes, an album about to close, an order paid or sent). We also look at how Open Albums is used, to improve it. We don’t send marketing emails.

Who can see what

• An album: anyone with its link, and its code if it’s private. The title and cover show to anyone with the link, including in link previews.
• The copies of your photos that people see in an album have their file details removed, location included. The full-size file kept for printing is reachable only by us, and print files never carry those details.
• Reactions: everyone who can open the album, with the name of whoever left them if they were signed in.
• We, Openthing Inc, can see orders and the photos in them, to make and send them, and can look at an account or album when needed to help you, fix a problem or follow the law.

Services we use

These companies handle information for us, only to provide their service:

• Supabase: our database, sign-in and photo storage, in Frankfurt, Germany.
• Vercel: hosts the website and runs its servers.
• Grow (formerly Meshulam): takes payments.
• Resend: sends our emails.
• The courier or postal service that delivers your order gets your name, phone number and address.
• Google: the animated emoji in reactions load from Google’s servers, so your browser asks Google for them.
• The Israeli government’s data service (data.gov.il) suggests cities and streets at checkout. We only ask it for a city’s streets, nothing about you.

Some of these are outside Israel, in the EU and the US. We also share information when the law requires it.

How long we keep it

• Albums and their photos: until the album closes after 90 days, or until you delete them, whichever comes first. They’re then deleted within a day.
• Print files for paid orders: until the order is sent, even if its album has closed.
• Your account: until you delete it, and 7 days more.
• The browser cookie, your cart and the delivery details you started: 90 days.
• Scrambled IP addresses from code guesses: deleted within a day.
• Records of how Open Albums is used: 12 months, or less if the account or album they belong to is deleted first.
• Orders: as long as tax and accounting law requires us to keep them.

Cookies

Open Albums only uses the cookies it needs to work:

• oa_locale: the language you picked, for a year.
• Sign-in cookies, to keep you signed in.
• oa_guest: the random code that lets an album remember your cart, for 90 days. We also use it, in our own records, to tell apart the browsers that open an album.

There are no advertising cookies, and no cookies from other companies.

Keeping it safe

Everything travels over encrypted connections, private albums’ codes are stored encrypted, and only we can reach the information behind Open Albums. No system is perfectly safe, though, so if we learn of a breach that affects you, we’ll tell you.

Your choices

• Change your name and studio name in Account.
• Delete a photo, an album or your whole account yourself, at any time.
• Ask us for a copy of your information, or to correct or delete it, at nani@openalbums.com. We’ll answer within 30 days.
• Depending on where you live, for example under Israel’s Privacy Protection Law or Europe’s GDPR, you may have more rights, including to complain to your data protection authority.

Children

Accounts and orders are for people 18 and over. Albums often have children in them: share those with people you trust, and think about making the album private.

Changes to this policy

If we change this policy, the date at the top changes too, and for changes that matter we’ll email account holders first.

Contact

Openthing Inc · nani@openalbums.com