Privacy Policy
Last updated: 15 November 2026
This policy explains what personal data Dearly ("we", "us") collects, why, who we share it with, how long we keep it and what you can do about it. It covers the web app at https://album.triptex.me and https://photo-album.triptex.me (the "Service").
1. Who we are
The Service is run by Afshin Nahian Tripto, an individual developer based in Bangladesh.
- Email: us (contact address coming soon)
- Post: Dhaka, Bangladesh
We are the "data controller" (in Bangladeshi law, the "data fiduciary") for the personal data described here.
2. The short version
- You sign in with Google. We get your name, email address, Google account ID and profile picture link. Nothing else from Google.
- We store the photos you choose to upload to host an album (up to 6 photos, 1 album per account in the current version).
- Most editing happens on your own device. Drafts can stay in your browser and never reach us.
- We don't sell your data, show ads, or use your photos to train AI.
- You can delete your album or your whole account at any time. Deleting your account deletes your photos from our storage.
3. What we collect and why
| Data | Where it comes from | Why we use it | Legal basis (GDPR terms, where GDPR applies) |
|---|---|---|---|
| Name, email address, Google account ID, profile picture URL | Google, when you sign in (scopes openid, email, profile) |
Create and secure your account, show who is signed in, contact you about your account | Performing our contract with you (Art. 6(1)(b)) |
| Photos you upload to host an album, plus album title, captions, layout and settings | You | Store, display and process them to build your album, web link, PDF and video | Performing our contract with you (Art. 6(1)(b)) |
| Album password (if you set one) | You | Restrict who can open a published album. Stored only as a secure hash | Performing our contract with you |
| Technical data: IP address, browser type, request logs, error logs | Your browser, our hosting providers | Run the Service, keep it secure, stop abuse, fix bugs | Our legitimate interest in a secure, working service (Art. 6(1)(f)) |
| Bot-check signals | Cloudflare Turnstile, when you sign in or submit forms | Tell people from bots | Legitimate interest in preventing abuse |
| Messages you send us, reports and takedown notices | You | Answer you, handle reports, keep records of what we did | Legitimate interest; legal obligation where one applies |
| [Analytics, if added later: anonymous page views, no cookies, no cross-site tracking] | Cloudflare Web Analytics | [Understand which features are used] | [Legitimate interest] |
What stays on your device. The editor works mostly in your browser. Photos you only edit, and drafts saved in your browser's storage (IndexedDB), stay on your device unless you upload them to host an album. Clearing your browser data deletes those drafts. We can't recover them.
Exports. PDFs and slideshow videos are created [in your browser / on our servers]. [If on servers: the files are deleted from our servers within [24 hours] after you download them.]
What we don't do. We don't use face recognition, we don't build profiles of you, we don't show ads, we don't sell or rent personal data, and we don't use your photos or your Google data to train AI models.
4. Google user data
We request only the basic sign-in scopes openid, email and profile. We use the data we receive from Google only
to sign you in and run your account, as described above. We don't share it with anyone except the service providers
in section 6 that host our app and database, and we don't use it for advertising. Our use of information received
from Google APIs follows the
Google API Services User Data Policy.
You can remove our access at any time at https://myaccount.google.com/permissions. That stops new sign-ins but does not delete your account with us; use "Delete account" in the app for that (section 9).
5. Photos of other people, including children
Albums often show other people: guests, family members and children. When you upload or publish such photos, you are responsible for having the right to share them and the consent of the people shown (or a parent or guardian for a child). See our Terms of Service and Content and Copyright Policy.
If you appear in an album and want it removed, email us (contact address coming soon) or use the "Report" link on the album. We will review and act on the request (see the Content and Copyright Policy).
6. Who we share data with
We use these service providers ("processors") to run the Service. They process data only on our instructions.
| Provider | What it does | Data involved | Where |
|---|---|---|---|
| Sign-in | Sign-in data | Global | |
| Railway | Hosts the app and the Postgres database | Account data, album data, logs | [Region, e.g. US/EU/Asia: confirm in Railway settings] |
| Cloudflare (R2, CDN, Turnstile) | Stores and delivers photos, protects against bots and attacks | Photos, IP address, technical data | Global network; R2 bucket in [region / location hint] |
| Resend | Sends account and service emails | Email address, email content | [United States: confirm] |
| Unsplash | Supplies stock photos shown in the editor and sample albums | Your browser loads images directly from Unsplash, so Unsplash sees your IP address | [United States] |
| Cloudflare Web Analytics | [Privacy-friendly analytics] | [Anonymous usage data] | Asia-Pacific |
We may also disclose data if the law requires it, to protect people from harm, or to enforce our Terms. If the Service is ever transferred to someone else, we will tell you before your data is handled under a different policy.
7. International transfers
We are based in Bangladesh and our providers store data in other countries, including [the United States]. Your data may be processed outside the country where you live. Where the law requires it, we rely on the transfer safeguards offered by our providers (for example the EU Standard Contractual Clauses in their data processing terms) and on your consent where Bangladeshi law requires consent for cross-border transfer. [Confirm once Bangladesh publishes its rules on data classification and approved transfer destinations.]
8. How long we keep data
| Data | How long |
|---|---|
| Account data | Until you delete your account |
| Uploaded photos and albums | Until you delete them or your account |
| Data after you delete your account | Removed from live systems within [30] days; from backups within [35] more days |
| Server and security logs | [30] days |
| Published album links | Stop working as soon as you unpublish or delete the album |
| Reports, takedown notices and our decisions | [3] years, to handle disputes and repeat infringers |
| Inactive accounts | [We may delete accounts with no sign-in for [24] months, after emailing you [30] days ahead] |
9. Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and get a copy (use "Download my data" in the app, or email us).
- Correct data that is wrong.
- Delete your data. "Delete account" in the app removes your account, albums and uploaded photos.
- Withdraw consent where we rely on consent, without affecting what we did before.
- Object to or restrict some processing, including processing based on legitimate interests.
- Data portability: get your photos and album data in a common format.
- Complain to a data protection authority. In Bangladesh that is the authority set up under the Personal Data Protection Act/Ordinance [confirm name]. In the EU/EEA or UK, you can complain to your local supervisory authority.
Email us (contact address coming soon) to use these rights. We will reply within [30] days and may need to confirm it is really you (for example, by asking you to write from the email address of your account).
10. Children
You must be at least [18] years old to use the Service. (See the note at the end of this document.) We don't knowingly collect data from younger users. If you think a child has an account, email us (contact address coming soon) and we will delete it.
Albums may contain photos of children uploaded by adults. We treat these with extra care: we never use them for profiling or advertising, and anyone can report an album that shows a child inappropriately.
11. Cookies and browser storage
We use only what the Service needs to work:
| Name / type | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you signed in | [Session / 30 days] |
| Security cookie | Protects sign-in from forgery (CSRF) | Session |
Cloudflare / Turnstile security cookies (e.g. cf_clearance, __cf_bm) |
Bot and attack protection | Short-lived |
| IndexedDB / local storage | Saves your drafts and editor settings on your device | Until you clear them |
We don't use advertising or tracking cookies. [If analytics is added: it is cookie-free.] Because we only use strictly necessary storage, we don't show a cookie consent banner. If that changes, we will ask for consent first.
12. Security
Data is encrypted in transit (HTTPS) and at rest by our hosting providers. Access to production systems is limited to the owner. Published album passwords are hashed. No service is perfectly secure; if a breach affects your data and puts you at risk, we will tell you and the relevant authority where the law requires it.
13. Changes to this policy
We will post changes here and update the date at the top. For important changes, we will email you or show a notice in the app at least [14] days before they take effect.
14. Contact
Afshin Nahian Tripto, Dhaka, Bangladesh, us (contact address coming soon).
Drafting notes for the owner (delete before publishing)
- Bangladesh law. The Personal Data Protection Ordinance, 2025 (Ordinance No. 61 of 2025) was gazetted on 6 Nov 2025, amended in Feb 2026, and reported as becoming the Personal Data Protection Act in April 2026 (sources differ on 10 vs 15 April and on the Act number). Some duties apply now; others are deferred about 18 months (around May 2027). Summaries agree on: informed, specific, withdrawable consent; notice of purpose, retention, transfers and how to withdraw; access/correction/deletion rights; a regulator; fines. A "child" is reportedly anyone under 18, and processing a child's data needs a parent's or guardian's consent. I could not read the official gazette text; confirm section numbers and current wording with a Bangladeshi lawyer.
- Minimum age: recommend 18+ for v1. GDPR Art. 8 sets 16 by default (states may lower to 13; e.g. France 15, Italy 14), but Bangladesh reportedly treats under-18s as children needing guardian consent. A single 18+ rule is the simplest safe choice for an album app (weddings, babies, anniversaries are adult use cases). If you want teens later, use 13+ outside the EEA/Bangladesh, 16+ in the EEA, and a parental-consent flow for Bangladesh.
- Consent vs contract. Bangladeshi law leans on consent. Add a short "I agree to the Terms and Privacy Policy" step at first sign-in and record when it happened (see README checklist). Under GDPR we rely on contract and legitimate interests instead, which is why the table above uses those bases.
- GDPR scope. The EDPB's own Example 14 is a non-EU photo-album website: offering EU languages, euro prices or EU delivery shows targeting, which brings it under GDPR Art. 3(2). Mere accessibility from the EU does not. v1 (English/Bangla, free, no EU targeting) is probably outside Art. 3(2), but this policy is written to GDPR standard anyway. If you later add EU languages, EUR prices or EU marketing, GDPR applies and you will very likely need an EU representative (Art. 27): the exemption needs processing to be "occasional", and the EDPB says that means outside the regular course of business, which a hosting service isn't. Same logic for a UK representative.