Privacy Policy

Effective: October 24, 2026

This policy explains what AllPicture collects, how it is used, how connected photo sources work, and what privacy choices you have when using AllPicture.

1. Scope and controller

This Privacy Policy applies to AllPicture websites, waitlist and support forms, web and desktop apps, mobile apps, sync agents, cloud functions, connected-provider workflows, AI-assisted organization, sharing, publishing, billing, and related services.

AllPicture LLC is the controller for the public website, waitlist, support forms, and AllPicture services described here. AllPicture LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, can be reached at mail@allpicture.ai. The Imprint contains the same operator details.

AllPicture LLC has appointed IceBear Capital UG (haftungsbeschränkt), Friedrichstraße 155, 10117 Berlin, Germany (Local Court of Charlottenburg, HRB 198791 B) as its representative in the European Union under Article 27 GDPR. Data subjects and supervisory authorities in the EU can address the representative on all issues related to the processing of personal data; please write to mail@allpicture.ai and mark your message for the attention of the EU representative.

2. Information you provide

• Account and profile data, such as email address, authentication identifiers, display name, settings, consents, terms acceptance, recovery status, and account preferences.
• Waitlist and launch data, such as email address, approximate photo or video count, consent timestamp, source page, locale, and launch-credit metadata.
• Support data, such as email address, topic, subject, message, support consent, ticket number, troubleshooting context, and follow-up communications.
• Billing data, such as plan, credits, usage counters, invoices, payment status, tax or VAT information, processor identifiers, and purchase history. Full payment card details are handled by the payment processor, not stored directly by AllPicture.

3. Photos, videos, library records, and local data

• Media and library data you choose to upload, import, sync, preview, render, share, or publish, including originals where applicable, thumbnails, Smart Proxies, albums, folders, captions, favorites, trash state, edit history, export jobs, share records, and publishing jobs.
• Metadata and organization data, such as EXIF data, timestamps, camera data, approximate or embedded location, file names, file paths, local folder or NAS paths, provider paths, checksums, duplicate clusters, best-version decisions, tags, face clusters, person labels, embeddings, search indexes, and cleanup signals.
• Desktop and device data, such as install channel, app version, operating system, release/update state, sync health, local indexing status, storage availability, key-provisioning state, device identifiers used for sync, and diagnostic logs.

4. Connected-provider data

When you connect a provider, AllPicture receives and stores the tokens, scopes, account IDs, refresh status, provider labels, cursors, file IDs, media references, thumbnails, metadata, and API responses needed to run the connected workflow. This may include Google Photos, Google Drive, Dropbox, iCloud, OneDrive, Instagram, Facebook, TikTok, YouTube, local folders, NAS locations, and phone or WhatsApp media sources depending on what you connect.

Google API Services disclosure: AllPicture's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We use Google user data only to provide or improve user-facing AllPicture features you request, maintain security, troubleshoot, comply with law, or communicate with you about the service. We do not sell Google user data or use it for advertising.

4a. Google user data (Google Drive, Google Photos)

What we access: when you connect Google Drive or Google Photos, AllPicture accesses the files and folders you choose, including their contents and file metadata such as names, dates, sizes and file IDs. For Google Drive, AllPicture asks for full Drive access (shown by Google as "See, edit, create, and delete all of your Google Drive files"). We use it to read the folders you select, to write to Drive folders you set up as a mirror or upload target, and, only after you explicitly confirm it in Clean-Up or when you ask AllPicture to move files (the original is then moved to your Google Drive trash), to replace or delete original files.

What we store: encrypted access and refresh tokens, your Google account ID and email address, file IDs and metadata. Google Drive: we do not keep your original files. Exception: if you explicitly copy or move a file to AllPicture, AllPicture stores the original in encrypted form in your own AllPicture storage. To create a preview image, our server downloads the original temporarily (up to 20 MB), creates a preview of up to 2 MB in your own AllPicture storage and then discards the original. Because the server creates these previews, they are not end-to-end encrypted. Google Photos: for photos you pick in the Google Photos Picker, the photo passes through our server once (images up to 24 MiB; larger files are not imported) and is encrypted on your device before it is stored. AllPicture keeps the encrypted original and an encrypted preview in your own AllPicture storage.

How we use it: only for features you can see and request, such as showing, syncing, mirroring and optimizing your photos (Clean-Up replace in place). We do not sell Google user data, do not use it for advertising and do not use it to train AI models. Cloud image AI is switched off: no image content from Google Drive is sent to external AI providers. Photos from Google Drive or Google Photos, photos linked to one of these sources and photos whose origin cannot be determined are not used for any server-side AI text feature (album suggestions, AI captions, the assistant): their keywords, captions, places, dates and file names are removed before a request to an AI text model is built. Collection names generated from Google-derived photo metadata are not sent to external AI models. Files that the AllPicture desktop app reads from a folder on your computer count as local files, even if that folder is synchronized by Google Drive for desktop. Face recognition runs only if you switch it on for your account. People at AllPicture do not read your Google user data, except with your consent, for security or troubleshooting, or where the law requires it.

Deletion and revocation: when you disconnect the source, AllPicture deletes its tokens immediately. Photos for which that connection is the only source are hidden when teardown processes the disconnect. Without temporary severing, teardown deletes their photo records and stored copies directly. Google Photos Picker imports follow the same deletion rule when that connection is their only source. With temporary severing, cleanup runs every hour: it can permanently delete after one quiet hour when no source remains; otherwise the photo stays restorable for at least 24 hours before cleanup. Processing failures or backlogs can delay deletion. A photo that is also available from another source stays, and only its link to the disconnected source is removed. A photo added to an album or collection stays only if AllPicture already stores its original. A Drive photo in an album or collection without a stored original is hidden and later deleted by orphan cleanup, which runs every six hours after at least 24 hours without activity. If you delete your account, all data is deleted in every storage region after a 30-day grace period; financial records are kept as the law requires. Deleted data remains in database backups for at most 14 days. You can also revoke AllPicture's access at any time in your Google account at https://myaccount.google.com/permissions.

5. Information collected automatically

• Technical data, such as IP address, user agent, device and browser information, operating system, language, time zone, referring page, source page, session metadata, and approximate location derived from technical data.
• Usage and security data, such as feature interactions, sync events, import/export status, storage consumption, credit consumption, errors, audit events, rate-limit signals, fraud-prevention signals, and crash or diagnostic data.
• Cookie and similar-technology data needed to run the website and apps, remember choices, protect forms, and route sessions. Optional Google Tag Manager and Google Analytics technologies load only after you allow analytics: on the website in the preference dialog, in the web app in the prompt shown after sign-in or under Settings → Privacy. The iOS app asks separately and measures usage only after you opt in. The AllPicture desktop app for macOS and Windows and the Android app do not use analytics. See the Cookie Policy for the current inventory, consent signal, and retention rule.

5a. Operational and error data (feature health)

To detect outages quickly and run the app reliably, our servers log technical operating data for each call to a feature (for example sign-in, upload processing, opening an original, synchronization or a purchase): the feature name, whether the call succeeded or the error class it ended with, its duration, the server region, the platform and the app version. When you are signed in, a pseudonymous identifier derived by a one-way function from your account ID is added, so that errors can be matched to a call history without identifying you directly. Photos, file, album, place or person names, search texts, e-mail addresses and IP addresses are not part of this data.

These logs are deleted after 30 days. Daily summaries (number of calls, error rates, response times and the number of distinct identifiers as a plain count) are kept for 400 days and contain no identifiers and no content.

The legal basis is our legitimate interest in stable and secure operation (Article 6(1)(f) GDPR). You may object on grounds relating to your particular situation (Article 21 GDPR). The recipient is our infrastructure provider Google Cloud as processor. This is separate from optional usage analytics (Google Analytics 4), which runs only with your consent.

6. How we use information

• Provide, secure, troubleshoot, and improve AllPicture, including sync, storage, encrypted vaults, previews, search, duplicate detection, AI organization, face recognition, Family Hub, sharing, publishing, billing, support, and account recovery.
• Authenticate users, maintain sessions, provision keys, detect abuse, enforce terms, protect infrastructure, maintain audit trails, and comply with legal, tax, accounting, provider, and security obligations.
• Send service messages, waitlist updates, beta access notices, support replies, billing notices, security alerts, product availability messages, and marketing emails where you have consented or where law allows. You can opt out of marketing emails.
• With your consent, tell you by email about new features, in particular when something you told us was missing becomes available. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Analyze aggregate reliability, performance, feature usage, plan usage, and support trends so we can improve the product and operate the service.
• With your consent, measure how the web and iOS apps are used — for example whether signing up, setting up encryption, connecting a photo source, or the first sync works — so we can find where people get stuck. These measurements contain categories and ranges only (such as the sign-in method, the type of source, a coarse error class, a library size range, the platform, app version, plan, storage region, and whether encryption is on), never your photos, file or album names, places, faces, search text, email address, or name. To recognize the same person across sessions, we send Google a pseudonymous identifier that our server computes from your account ID with a secret key; Google cannot derive your account ID from it. You can withdraw consent at any time under Settings → Privacy; we then send no further measurements.

7. Legal bases for EEA, UK, and similar users

Where data-protection law requires a legal basis, we rely on performance of a contract to provide the service you request, consent for optional waitlist, marketing, connected-provider, cookie, analytics, cloud AI, server AI, or device-permission flows where required, legitimate interests for security, fraud prevention, service improvement, diagnostics, support handling, and basic business operations, and legal obligation for tax, accounting, compliance, and lawful requests.

Face recognition processes biometric data. We perform it only with your explicit consent (Article 9(2)(a) GDPR), which you give or refuse in the app and can withdraw at any time.

You may withdraw consent where processing is based on consent. Withdrawal does not affect processing that happened before withdrawal or processing based on another legal basis.

8. AI, face recognition, and sensitive media

Photos and videos can reveal sensitive information about people, places, relationships, children, health, beliefs, or private events. AllPicture is designed to keep private-library processing local or encrypted where possible, but specific features may create derived data such as embeddings, face clusters, person labels, AI tags, transcript cues, render prompts, review signals, or moderation/safety results. AI features run on your devices first; the cloud and server features described below are used only as stated.

Face recognition (People) is offered only if and when the feature is available in your app; where it is offered, it is off until you switch it on. We record your decision, the version of the consent text, and the time by the server clock. Faces are detected and facial features (the numeric face descriptors used to recognize a person) are computed on your device (web, desktop, or iOS app), not by AllPicture servers. These facial features stay on your device and are not uploaded to your account. Your account stores the results so that your devices can show them: the people recognized or created by you, the names you give them, which people appear in which photos (as opaque identifiers), and the position of faces in a photo together with on-device estimates such as a smile score or an age estimate. If your library is end-to-end encrypted and the server AI index is off, the face positions and estimates of encrypted photos and the names you give people are stored end-to-end encrypted; otherwise, and for records created before this encryption was available, they are stored in a form our servers can read. The identifiers that link people to photos are stored in readable form in every case; they do not contain names. If you switch face recognition off, the facial features on your device and the face positions, estimates, and person assignments on your photos are deleted; the people entries themselves, including names you gave them, are kept until you delete them.

Face recognition and private analysis are intended to help you organize your own library. They are not used to identify people outside your account. AI outputs may be inaccurate, and you can correct labels, disable supported features, delete generated data where available, or request help through support.

When you search your library by describing a photo in words, the text you type is sent to AllPicture servers to be converted into a numeric search vector. This conversion runs on our cloud infrastructure (Google Cloud, in the United States for every storage region), takes place only for that search, and the text is not stored, logged, or used for any other purpose. Your photos and the vectors computed from them stay on your device or in your encrypted library; the comparison that finds matching photos happens on your device.

Cloud AI for smart search and album suggestions is off until you switch it on (during setup or under Settings → Privacy). When it is on, AllPicture servers send an AI text model your search request or the album name and rule concerned, together with metadata of the photos concerned: up to eight keywords, opaque person identifiers, the place, and the capture year. Photos from Google Drive or Google Photos are never part of these requests (see section 4a). Person names, image files, file names, and account data are not sent. The model runs on AllPicture's own servers where available and otherwise on third-party models accessed through OpenRouter, Inc. (USA); some of these model providers may retain or log requests under their own terms. Album names and album rules are sent as you wrote them. These requests may be processed outside your storage region. AllPicture does not currently send image files to third-party cloud AI providers; a feature that would do so will ask for your separate consent first. If you send product feedback, its text may be evaluated by the same AI text service.

Where AllPicture has enabled it for your account and you have switched on the server AI index under Settings → Privacy, AllPicture's own AI server in Germany analyzes previews of your photos to create descriptions, tags, and album suggestions. It receives previews only, never your originals, through a link that is valid for 15 minutes; it keeps them in memory for the duration of the analysis and does not store them. End-to-end encrypted photos are not sent to it. If your account is held in our US or Asia-Pacific region, previews are sent to Germany only after you have additionally agreed to this in the same settings. Without the server AI index, photo analysis runs on your device only. You can switch the server AI index off at any time; descriptions and tags already created stay in your library until you delete them.

Where this feature is enabled, AllPicture's own AI server may read the subject, text, topic, and language of a support request to suggest a category, a priority, and an answer draft for our support team. It does not receive your email address, name, or account data, and it never answers you automatically: a member of the team reviews every reply. The suggestion is stored with the ticket and deleted with it.

9. Encryption and security

AllPicture uses technical and organizational safeguards such as transport encryption, access controls, token protection, encrypted provider-token storage, audit controls, and encrypted storage modes. Secure Vault uploads and desktop encrypted sync paths use client-side encryption before cloud storage when enabled. Standard or legacy upload paths may not be zero-knowledge unless an encrypted mode is explicitly active. Depending on the features you use, derived data such as AI tags, descriptions, face data, and person labels may be stored in a form our servers can read so that those features work.

No system is perfectly secure. Keep your account credentials, devices, recovery keys, and provider accounts protected. If client-held keys are lost, AllPicture may not be able to recover encrypted originals.

10. Sharing with service providers and third parties

• Infrastructure providers that host, store, transmit, process, secure, monitor, or deliver the service, including Firebase, Google Cloud, and related hosting, storage, database, auth, and functions infrastructure.
• Connected providers you authorize, such as Google Photos, Google Drive, Dropbox, iCloud, OneDrive, Meta services, TikTok, YouTube, local folders, NAS devices, or platform APIs needed for import, sync, preview, revocation, or publishing.
• Payment and sales: Paddle.com Market Limited (United Kingdom) is the merchant of record for web purchases. Paddle sells the subscription to you and handles payment, tax, invoicing, and refunds as an independent controller; it receives your email address, name, and an account reference that links the purchase to your AllPicture account, and collects your payment details itself. For in-app purchases, Apple (App Store) or Google (Google Play) is the seller under its own terms; we receive the purchase and subscription status linked to a pseudonymous account reference derived from your account ID, not your payment details.
• Customer communication and support: Zoho (Zoho CRM, Zoho Billing, Zoho Desk, Zoho Marketing Automation, and Zoho Campaigns, operated in Zoho's EU data centre). When you create an account, a customer record with your email address, name, account ID, plan, storage use, and account status is created in Zoho CRM and kept up to date with your subscription status; Zoho Billing holds subscription records; Zoho Desk holds support tickets and product feedback (email address, subject, message, topic, and language); Zoho Marketing Automation sends product emails triggered by milestones in your use of AllPicture, such as the size of your library; Zoho Campaigns holds waitlist sign-ups and their consent records and, if you have agreed to receive new features by email, your email address, language, plan, lifecycle stage, date of last activity, the types of connected sources and devices you use, the missing features you selected, and the time and version of your consent. It never receives photos, file, folder or album names, places, faces or search text. Transactional emails such as waitlist confirmations, pricing-change notices, and feedback confirmations are sent from our Google Workspace account through the Gmail API (Google LLC) and contain your email address and the content of the message.
• Other operational providers: Google (Google Analytics and Google Tag Manager, and Google Analytics for Firebase in the iOS app) for usage measurement where you have consented; Google Maps Platform to turn photo coordinates into place names, which receives only the coordinates through our servers, not your IP address or account data; and Cloudflare Turnstile to protect forms against automated abuse, which processes technical request data including your IP address.
• AI, rendering, safety, or media-processing providers only where needed for a feature you use, for security review, or for operational processing. For cloud AI text features this is OpenRouter, Inc. and the model providers it routes to (see section 8). Where the AllPicture assistant, AI collection suggestions, or AI video rendering are offered, the prompts and media you submit to them are processed by Google LLC through the Gemini API. The applicable feature notice will identify additional processing that requires separate information or permission.
• Authorities, courts, advisors, payment networks, or counterparties where required to comply with law, enforce terms, prevent harm, handle disputes, or complete a corporate transaction such as financing, merger, acquisition, or asset transfer.

11. Storage regions and international transfers

AllPicture stores your library — photos, videos, library records, and the data derived from them — in one storage region: United States (Iowa), European Union (Belgium), or Asia-Pacific (Singapore), each on Google Cloud. At sign-up we assign the region from the country of your IP address, which we look up in a local database without sending your IP address to a third party; if the country is unknown, we use your language region, and otherwise the United States. EU, EEA, Swiss, and UK countries map to the European Union region. Regions are introduced gradually; if the region for your country is not yet available, your account is held in the United States region. You can choose another region before your first upload; after that, a change requires a migration.

Some data is held centrally in the United States for every region: your sign-in account (Firebase Authentication), an account directory entry with your storage region and country, billing and purchase records, sharing, family, and team records, waitlist and support records, and operational logs. The search-text conversion and cloud AI text requests described in section 8 may also be processed outside your storage region. Photo previews for the server AI index are processed on AllPicture's own server in Germany; for accounts held in our US or Asia-Pacific region this happens only with your additional consent.

Recipients outside the EU/EEA: Google LLC (Google Cloud and Firebase infrastructure, Google Analytics where you have consented, Gmail API for transactional emails, Gemini API and Google Maps Platform where those features are used) and its US processing are covered by Google's certification under the EU-U.S. Data Privacy Framework and its data processing terms. OpenRouter, Inc. (USA) and the model providers it routes to receive cloud AI text requests only if you have switched cloud AI on. Paddle.com Market Limited is established in the United Kingdom, for which an EU adequacy decision applies. Apple and Google act under their own terms for in-app purchases. Zoho processes customer, support, and email data in its EU data centre. Where personal data is transferred to a recipient outside the EU/EEA that is not covered by an adequacy decision, we use an applicable transfer safeguard, such as contractual protections, the provider's data processing terms, or another lawful transfer method. You may request the applicable safeguard and relevant transfer information by writing to mail@allpicture.ai.

12. Retention and deletion

We retain each data type only for the period needed for its stated purpose: account and library data until you delete it or close the account; provider tokens until disconnection or account deletion, subject to security and legal records; waitlist data until you unsubscribe, request deletion, or the beta outreach purpose ends; support tickets until the request and any dispute or legal need is resolved; security and audit logs for a proportionate security and compliance period; and backups until their normal replacement cycle or a verified restoration need ends. Legal, tax, fraud, dispute, and backup requirements can extend a limited record.

You can withdraw your consent to emails about new features at any time under Settings → Account or with the unsubscribe link in every such email; we then remove you from the mailing list. We keep the consent record (time, version, withdrawal) as proof until your account is deleted.

Fixed periods: items in the trash are deleted automatically after 180 days (30 days for items replaced or removed by a cleanup); a data export stays available for download for 7 days; temporary processing files are deleted after 24 hours; photo previews sent to the server AI are kept only for the duration of the analysis; usage measurements in Google Analytics are retained for 14 months and then deleted by Google. When you delete your account, deletion takes effect after a 30-day waiting period in which you can cancel it; your library, derived data, support tickets, and sign-in account are then deleted, while accounting and tax records are kept for the statutory retention periods.

Deletion requests can be made without logging in by contacting the address below. We verify identity proportionately. Deletion may not immediately remove copies held by a connected provider, recipient, cache, or backup, but we apply the relevant deletion or suppression process and explain any remaining retention.

13. Your rights and choices

• Access, correct, export, or delete account information where the app provides controls.
• Disconnect providers, revoke third-party permissions, delete imported media, remove share links, adjust privacy settings, switch off analytics, cloud AI, the server AI index, or face recognition under Settings → Privacy, and unsubscribe from marketing emails.
• Request access, correction, deletion, portability, restriction, objection, or withdrawal of consent where applicable law gives you those rights.
• EEA, UK, Swiss, and similar users may lodge a complaint with a data-protection authority. California and other US state residents may have rights to know, access, correct, delete, opt out of sale or sharing, limit certain sensitive-data uses, and avoid discrimination for exercising privacy rights. AllPicture does not sell personal information or share it for cross-context behavioral advertising as those terms are commonly used in US state privacy laws.

14. Children

AllPicture is not intended for children under the minimum age applicable where they live. Do not create an account or submit personal information if you are below that age. If you upload a family or group photo, you must have a lawful basis and any required permission to process identifiable people, including children; do not upload a child’s image for a feature that you are not authorized to use. Contact us if you believe a child’s information was submitted improperly.

15. Changes and contact

We may update this Privacy Policy as AllPicture, providers, infrastructure, laws, and launch plans change. If changes are material, we will provide notice through the website, app, email, account flow, or another reasonable method.

Questions, privacy requests, and deletion requests can be sent to mail@allpicture.ai.