Privacy

Who runs this

Loosh is a small independent service. For questions about this page, or any request about your own data, write to privacy@loosh-studio.com. A person reads it.

What is stored

Your account: an email address, and either a password stored only as a hash or the identifier of a Google account. A name, if you gave one.

Your albums: the photographs in them, how each page is arranged, any text you write, and the names you give to events and to people.

Photographs other people upload through a contributor link. They become part of the album the link belongs to.

Comments on an album: what was written, who wrote it and when. Yours and anybody else’s.

If you share an album: the address the invitation went to, which mode you chose, and whether it was accepted or taken back.

The photographs themselves

Photographs are kept in private storage with no public address. Each one is reached through a link that expires within the hour, and a link is issued only to someone who already has access to that album.

Two copies are kept. One is the file exactly as it was uploaded. The other is a smaller copy for the screen, with all camera metadata removed, including the location a phone records. The original keeps its metadata and is never sent to a browser. Only the server reads it, when it builds a PDF.

Importing from Google Photos

You can bring photographs in from Google Photos instead of uploading them. This is off until you use it, and starting it asks you to sign in to Google and agree separately from signing in here.

The photographs are chosen inside Google’s own picker, and only the ones you pick are sent to us. This app cannot see or list anything else in your Google account.

A short-lived credential from Google fetches those photographs. It is deleted the moment the import finishes, and automatically within a day if it does not.

Once a photograph arrives this way it is treated exactly like any other: stored privately, its metadata handled as described above. Google already leaves the location out before it reaches us.

Face recognition

Face recognition is off until you switch it on for a particular album. The date you switch it on is recorded.

The measuring happens in your own browser. No photograph is sent to a face recognition service. What reaches the server is a list of 128 numbers per face and the position of the box it was found in. It is not a picture. It is never sent back to any browser, and it is never compared with anything outside your album. When Loosh builds a book for you, the names you gave are read again, on the server, to decide which photographs share a page; nothing new is stored and nothing leaves.

You choose the names. Anybody you give full edit access to an album can see them and change them, because full edit means everything you can do with that album. Somebody invited only to comment cannot: they see the book and the remarks on it and nothing else.

Deleting a person, switching the feature off, or deleting the album also deletes the measurements.

What is never done

There is no advertising, no analytics, no tracking cookie and no third-party script. None of it is in the code.

Photographs are never used to train any model. Nothing is sold. Nothing is shared with anyone outside the infrastructure listed below, which only stores and serves it.

Cookies

Two, and both are needed for the site to work. One keeps you signed in. The other remembers whether you chose English or Hebrew. Neither tracks you, so there is no cookie banner here.

Where it is kept

The application runs on Vercel, the database is Neon in Frankfurt, and the photographs are in R2 at Cloudflare. Email is sent through Resend, which receives the address a message is going to. Upstash holds the counters that limit sign-in and upload attempts, which means an email address or an IP address for a short while. All of them only store and serve what the service needs to run, and none of them use it for anything of their own.

Two are different in kind, and are named separately for that reason. Both receive words, never pictures.

The button that adds nikud to a text box sends the text of that box to Dicta, an academic service that vocalizes Hebrew. It happens only when you press it, one box at a time, and neither we nor they keep the text afterwards.

The Creative Assistant in the editor works by words. When you write a request to it, the request is sent to Anthropic together with a description of the album in words: what is on each page and where, the text written on the pages, the names you gave to people, and how many photographs a search found. No photograph is sent, and nothing a photograph could be rebuilt from. It happens only when you write a request. A request that could not be carried out in full is kept by us for 90 days, without the account or the album it came from, so that we can see what is missing. Separately, we count how much each account uses the assistant, as numbers only and without what was asked.

No photograph is ever sent anywhere to be processed.

How long it is kept

Your albums and photographs are kept until you delete them. Deleting an album removes it from your albums at once, and its photographs, along with any face measurements, are erased from storage and from the database within 30 days.

You can close your account from your account settings. Closing it signs you out at once and schedules everything belonging to it for deletion. The message we send you names the date, which is 30 days later.

A question typed into the help in the editor that found no ready answer is kept for 90 days, without the account or the album it came from, so that we can write the answer.

Contributor links

A contributor link lets anyone holding it upload photographs to one album without an account. It expires, and it accepts a limited number of files and a limited number of megabytes. Its address is shown once and then stored only as a hash, so it cannot be shown again.

Treat it as a key. Anyone you pass it to can use it.

Sharing an album

You can invite somebody to an album by email. They need an account here, and the invitation works once: it is a link, shown to you once and stored only as a hash, so it cannot be shown again.

There are two modes. Comment means they can look through the book and write remarks on it, and nothing else: no photo library, no settings, no download. Full edit means everything you can do with that album, including changing every page, adding and deleting photographs, and deleting the album itself. You are told this before the invitation goes.

You can take their access away at any time. That stops them going further and undoes nothing they have already done. Nothing you share gives anyone access to your account or to your other albums, and only you can invite or remove people.

If you delete the album, or close your account, it goes for everyone it was shared with.

Your rights over your data

You can ask for a copy of everything held about you, a correction of anything wrong, deletion, or an export to take elsewhere. Write to the address above.

In the European Union and the United Kingdom these are the rights the GDPR gives you. This is how to use them.

Photographs of children

A family album is full of them. Whether to upload a photograph of a child is the decision of the person uploading it, and their responsibility. Once it is here it is treated like every other photograph: private, shown to nobody, and reachable only by the album’s owner and the people they invite.

Changes to this page

The date at the top says when this page last changed. If what is stored, or who can see it, changes in any material way, it will be stated here plainly.