Privacy Policy

Effective date: October 27, 2026
Last updated: October 27, 2026
Document version: 2026-10-27

1 Who we are and what this policy covers

Photodepot LLC, a New Jersey limited liability company ("Photodepot," "we," "us," or "our"), provides the Photodepot desktop application and the website at photodepot.app. This Privacy Policy explains how we handle personal information in connection with our website, accounts, licensing, subscriptions and billing where available, software updates, access requests, local collaboration, and correspondence you send us (together, the "Services").

Photodepot LLC is responsible for the personal information we handle for these purposes. Where applicable law uses the term, we act as a controller for our account, website, billing, and business operations. The roles of photographers, their organizations, collaborators, and service providers depend on the processing they actually carry out. Providing local software does not by itself make us the processor of every photograph or video you use with it.

For privacy questions or requests, contact [email protected]. Our business contact details appear in Section 17.

Ordinary importing, reviewing, organizing, and exporting of media takes place on your devices and storage. Account access, license verification, software downloads, and updates involve online communications. Sharing a project with collaborators also makes information available to their devices. These activities are described separately below.

2 Your media and local processing

Photodepot processes your photos, videos, project information, previews, and image-analysis results on your computer and storage you choose. Ordinary importing, reviewing, organizing, and exporting does not upload this content to Photodepot or send it to us for AI training. Local analysis assesses similarity, sharpness, exposure, and faces or eye state to assist review; it is not designed to identify people by name.

The app also stores local settings and caches. Media can retain identifying metadata, including embedded location information, when copied or exported. Review what you share and obtain the permissions needed for your projects.

Enabling collaboration shares relevant content with participating devices (Section 4). If you send us files for support, we receive what you send (Section 3). Cloud storage and backup services you choose operate under their own settings (Section 15). Account, licensing, and update communications are separate and described below.

3 Personal information we receive

Information you provide and information from account services

• Accounts and authentication: name, email address, account identifiers, email-verification status, authentication and session information, and information returned by the sign-in method you choose. Our authentication provider handles sign-in credentials and verification procedures.
• Account profile: the first name, last name, and contact email address you enter on your account page, and a phone number if you choose to add one. You must save a first name, last name, and email address before downloading the Photodepot application; the phone number is optional. Your contact email address can differ from the address you use to sign in.
• Access invitations: your email address, account identifiers, and records of invitations, offers, or access you receive or redeem, including eligibility restrictions, redemption status, and related timestamps. If someone supplies your contact details for an invitation, we receive those details from that person.
• Billing and entitlement services, when used: account email and user identifiers, Stripe customer and checkout identifiers, selected plan or offer, subscription and trial status, entitlement checks, billing request records, and related transaction or invoice references. If you use a payment checkout, Stripe collects the applicable payment, billing-address, and tax information. Our normal hosted checkout does not give us your full payment-card number or card security code. Not every invitation or account-access flow requires a payment.
• Agreement and consent records: the account identifier, accepted Terms and Privacy Policy versions, acceptance timestamp, and records of any separate recurring-charge consent. We use these records to document the agreement and required billing permissions.
• Correspondence, if you contact us: your contact information, messages, questions, feedback, attachments, and information you choose to provide about a problem. Screenshots, recordings, sample media, or logs you choose to send can contain personal information about you, clients, or other people. The application does not automatically submit these materials to a support platform.

Please send only the information needed for your request. Avoid sending passwords, full payment-card details, unnecessary sensitive information, or client media you are not authorized to disclose.

Information collected through operation of the Services

• Device and licensing information: installation and device identifiers, device public keys and verification information, computer name, account and device-session identifiers, entitlement status, and activation, verification, and last-use timestamps. Your computer name may contain your name if you included it when naming your Mac.
• Update information: a persistent, installation-specific update identifier, requested update and download URLs, and associated network and request information. Those requests can reveal the requested platform, architecture, and update or archive versions. Supported release builds check for updates after launch and periodically; downloading an update requires your action.
• Website and network requests: hosting and authentication providers receive the IP address and request information needed to deliver pages, sign-in, downloads, and account services. This can include requested URLs, request times, headers, and security-related information. Our account endpoints use an IP-derived security identifier to limit abusive requests. The website does not implement collection of a persistent page-by-page browsing history, referral tracking, or IP-based geolocation analytics.

The current desktop application and website do not include third-party product-analytics collection, automatic crash-report uploads, advertising pixels, or marketing-email engagement tracking. The desktop application can write errors, file paths, and other diagnostic details to its local console. Those console messages are not automatically uploaded to us by the application. Operating-system and provider diagnostics are governed by their own settings and practices.

We receive information directly from you and your devices, from the authentication and billing providers supporting the Services, and from people who contact us or supply your details for an access invitation. Network requests also pass through our hosting provider.

4 Local collaboration and information visible to others

When you enable project hosting, Photodepot advertises project discovery information on your local network. Devices able to discover or reach the host can learn limited information before a reviewer is approved, including the project label, host or computer name, technical project and device identifiers, connection information, and account or session identifiers used to verify the host's access entitlement. Avoid including confidential information in public project labels or computer names.

After approval, reviewers can receive the shared project's media previews, video content, file and camera metadata, automated assessments, selections, ratings, organization, and other information needed for collaboration. The host can see the reviewer's chosen display name, connection information such as an IP address, and shared actions. Shared changes can become part of the project's history.

Reviewer devices can retain cached previews or other copies they received. Leaving a session or revoking access does not necessarily erase those copies, screenshots, or another person's backups. Use trusted devices and networks, obtain any necessary permissions, and share only with people authorized to receive the material.

This collaboration is a connection between participating devices. The fact that media is shared locally does not prevent separate account, license, or update communications with our online services.

5 How we use personal information

We use personal information for the following purposes:

• Provide and administer the Services: create accounts, authenticate users, connect and manage devices, verify entitlements, administer subscriptions and invitations, and deliver software updates.
• Administer billing and access: maintain customer and checkout references, check entitlements, reconcile subscriptions or invitations, and process transactions when an enabled checkout requires payment.
• Record requests and respond: maintain invitation records, review account information, and respond if you contact us about access, a problem, or privacy.
• Service communications: send necessary account, billing, security, and legal notices, and contact you about your account or a request using the profile details you provide. We do not use your profile phone number for marketing messages.
• Investigate technical issues: use information you choose to send us about a problem and operational account or security records relevant to that problem. We do not receive automatic feature-use analytics or application crash-report submissions.
• Protect people and the Services: detect misuse, enforce access limits, secure accounts, prevent fraud, investigate incidents, and establish or defend legal claims.
• Meet legal obligations: maintain required business and transaction records, respond to lawful requests, and exercise or protect legal rights.

6 Cookies local storage and browser choices

Our website uses cookies for account sessions, sign-in, and interface preferences. The desktop application stores local settings, credentials, caches, and installation identifiers for its functions. These technologies serve different purposes.

Necessary technologies. Authentication cookies help maintain your signed-in session and complete login. We also use security and preference storage. Our account-session cookies currently last up to seven days and temporary login cookies up to ten minutes, subject to renewal and earlier removal. A sidebar preference cookie, where used, lasts up to seven days. Providers may set additional cookies on their own hosted sign-in or checkout pages.

Browser controls. You can manage or remove cookies through your browser. Blocking necessary cookies may prevent sign-in or other requested functions. Photodepot does not currently provide a separate website cookie-preferences panel or an in-app analytics opt-out setting.

Browser privacy signals. Our website does not currently implement a distinct response to Do Not Track or Global Privacy Control signals. It also does not include advertising pixels, cross-site advertising trackers, or a personal-data sale function. This description does not limit any rights or duties under applicable law. Contact [email protected] to make an applicable privacy request.

7 Service providers and other disclosures

We disclose relevant information to providers that help operate the Services. The information disclosed depends on the function they perform. Our providers include:

Providers may act on our instructions for some activities and have independent responsibilities for others, such as payment-network compliance or fraud prevention. Their own notices explain their independent handling of information. We remain responsible for obligations that applicable law places on us when we engage providers.

We may also disclose information where reasonably necessary to comply with law or valid legal process, protect safety and security, investigate unlawful activity, or establish, exercise, or defend legal claims, subject to applicable law.

Information shared with collaborators at your direction is described in Section 4. We may otherwise disclose information when you specifically direct us to do so or give any permission required by law.

8 Retention and deletion

We retain essential account information while your account remains open. Canceling a subscription, signing out, or removing a connected Mac does not itself close your account or erase all related records. Our standard schedule for online business records we control is:

Short-lived authentication and rate-limit records have separate operational expiry periods. Some expired records are removed during later service requests. We retain them for their configured validity period and the limited period needed to complete cleanup, prevent replay or abuse, and investigate a related security issue. We remove expired temporary records through routine maintenance or the next relevant service request; records needed for continuing account security follow the security-record criteria above. Expiration of a temporary code does not itself erase related account or security history.

Backup copies may remain after deletion from active systems until they are overwritten or expire under the relevant provider's backup cycle. The applicable period depends on the service, record type, backup configuration, and any legal or security hold. We handle deletion from copies we control and make provider deletion requests where available and required; we do not promise a uniform expiry period across providers. If a backup is restored, information previously marked for deletion must be removed again before ordinary use, unless a lawful exception applies. Cookie durations in Section 6 do not describe server-log or backup retention.

We may retain specific records longer when required by law or reasonably necessary for an active dispute, legal hold, investigation, or security incident. We limit such retention to the relevant records and delete them when the reason for retaining them ends, unless another stated retention period still applies. Applicable deletion rights may require earlier deletion; we handle those requests as described below and in Section 10.

You can request deletion of personal information we hold by emailing [email protected]. We handle these requests manually and will evaluate and act on them as required by applicable law, including any lawful exceptions, and explain a refusal where required. Sending a request does not automatically erase your information. Deletion of information held by a provider or in backups is subject to applicable legal requirements and the relevant service's retention arrangements; we do not promise immediate erasure of all copies.

Your media and project files on your devices, collaborator caches, and copies held by other people are separate from account records we hold. Uninstalling Photodepot, signing out, or closing an account does not necessarily remove those files. You control deletion from your storage and should check application-data folders, project locations, caches, and backups when removing local information. We cannot delete a file held only on your device through an account-data request.

9 Security

We use safeguards intended to protect the personal information we handle, including account and access controls and protected connections for online account services. Certain local authentication records use operating-system protection. This does not mean that every project file, preview, cache, or export is encrypted by Photodepot.

No storage system or transmission method can be guaranteed completely secure. Protect your devices, account, networks, and backups, and limit access to people you trust. Contact [email protected] if you believe there has been a privacy or security incident involving the Services. Nothing in this policy excludes a security, breach-notification, or other duty imposed on us by law.

10 Your choices and privacy requests

You can view and correct your account profile, manage available account and billing settings, disconnect devices, choose whether to host or join collaboration, and control which files you select or share. To request review or correction of information you cannot change yourself, or to ask for access or deletion, contact [email protected].

Browser cookie controls and the current handling of privacy signals are described in Section 6. Signing out, disconnecting a device, and canceling a subscription affect access or billing; they are not requests to erase all personal information.

Depending on where you are and which laws apply, you may have rights to confirm whether we process your personal information; access it; correct inaccuracies; request deletion; obtain a portable copy; restrict or object to particular processing; withdraw consent; and opt out of covered sales, targeted advertising, or profiling. You may also have a right to limit certain uses of sensitive personal information or use an authorized agent. These rights have legal conditions and exceptions.

Send requests to [email protected], describe the request, and identify the account or interaction involved where relevant. Where permitted by applicable law, we may ask for information reasonably necessary to verify your identity, authority, and request. We do not require authentication for an opt-out request where the law prohibits that requirement. Do not send a password or unnecessary identification documents. We will respond within the period required by applicable law and explain any permitted extension or denial. We will not unlawfully discriminate against you for exercising a privacy right.

If applicable law gives you an appeal right, email [email protected] with the subject "Privacy Appeal" and explain what you would like reconsidered. We will review and respond within the legally required period. You can also complain to the regulator responsible for your location, including the New Jersey Division of Consumer Affairs where appropriate. These contact and appeal procedures do not restrict a right to contact a regulator directly.

11 New Jersey California and other United States residents

State privacy rights depend on the law's coverage, exceptions, and the circumstances of the processing. Being a New Jersey company does not mean that every provision of every state privacy law applies to every interaction. Where a state law applies to us and your information, we will honor its requirements and the rights described in Section 10.

The categories of information, sources, purposes, recipients, and retention criteria in Sections 2 through 8 describe the current Services. The application and website do not include product-analytics integrations, targeted-advertising integrations, or functionality for selling personal information. Account and subscription checks determine access entitlements; image assessments assist your local media review.

If the New Jersey Data Privacy Law applies, you may exercise the applicable access, correction, deletion, portability, opt-out, and appeal rights through the methods above. If the California Consumer Privacy Act applies, those methods are also available for applicable rights to know, access, correct, delete, opt out, limit covered uses of sensitive information, and act through an authorized agent. The availability of a statutory right does not depend on whether the application has a dedicated button for it.

12 People in the EEA United Kingdom and Switzerland

This section applies to the extent the relevant data-protection law governs our processing. For the account, website, billing, invitation, and correspondence activities we control, Photodepot LLC is the controller. Contact details are in Section 17.

Where a lawful basis is required, we rely on:

• Performance of a contract or steps you request before a contract: providing an individual account, keeping the account profile needed to download the application, verifying licensed access, administering a purchase, and responding to a request necessary to provide the Services.
• Legitimate interests, where available and not overridden by your rights: securing and maintaining the Services, preventing fraud, managing business and access requests, resolving problems you report, and establishing or defending legal claims.
• Legal obligations: accounting, tax, regulatory, and other obligations that qualify for this basis under the applicable data-protection law. Under the GDPR, this means an obligation grounded in applicable European Union or Member State law; the corresponding UK rules apply under the UK GDPR. Other legal and compliance needs may be addressed under an appropriate alternative basis, such as legitimate interests where available and subject to your rights.
• Consent, if required for a particular request or disclosure: we must obtain any consent required by applicable law for that activity. This does not mean that the current Services include an optional tracking or marketing-consent system. You may withdraw consent without affecting the lawfulness of processing before withdrawal.

Information needed to create or authenticate an account, verify an entitlement, complete a transaction, or meet a legal obligation may be necessary for us to provide that function. If you do not supply it, the relevant function may be unavailable.

Subject to applicable law, you may exercise access, correction, deletion, restriction, portability, objection, and consent-withdrawal rights through Section 10. You can object to processing based on legitimate interests on grounds relating to your situation. You may complain to your local supervisory authority. The automated functions described in this policy are account and entitlement verification and local media analysis; the current Services do not include a separate personal-profiling service.

13 International processing and transfers

Photodepot LLC is based in the United States. Information received by our online services can be processed in the United States and other countries where our providers or their authorized subprocessors operate. Applicable protections and government-access rules may differ from those in your location. This does not mean that media held only on your devices is uploaded to those countries.

Processing locations depend on the provider service, account configuration, and authorized subprocessors used for the relevant function. The provider notices linked in Section 7 describe their international operations. Contact [email protected] for information about the locations relevant to your request.

If a transfer is subject to EEA, UK, or Swiss restrictions, we must establish a legally available transfer mechanism before making that transfer. Depending on the actual recipient and data flow, that may involve an applicable adequacy decision or an appropriate contractual safeguard. We do not represent that any particular mechanism applies to every transfer. Contact [email protected] for information about the mechanism applicable to a relevant transfer and how to obtain a copy of any applicable safeguards.

This policy does not itself establish a transfer mechanism or represent that Photodepot is enrolled in a certification program.

14 Children and information in customer projects

The Services are intended for adults aged 18 or older. We do not knowingly collect children's personal information directly for a child to create an account or use the Services independently. If you believe a child provided personal information to us through an account, form, or communication, contact [email protected] so we can investigate and take action as required by law.

Photographers may lawfully work with images of children or other sensitive subject matter. The presence of such material in a locally processed project is different from a child submitting information to us. The person or organization directing that work is responsible for the permissions, notices, and protections applicable to it. Do not send us unnecessary children's or sensitive information in correspondence or attachments.

15 Other services

Our Services can link to or open independently operated services, including hosted sign-in and payment pages. Those operators' policies describe their own processing. Your operating system, device-management tools, cloud-synced folders, and backup services may also process information independently of Photodepot. Review their settings and notices when deciding where to store or share media.

16 Changes to this policy

We will update this policy when our practices or applicable requirements change and revise the "Last updated" date. For material changes, we will provide additional notice where required, such as through the website, application, or email. Where a new use, provider integration, or tracking activity requires consent or an opt-out opportunity, we will provide it before the relevant processing begins.

A policy update does not by itself authorize a new use of previously collected information that conflicts with the commitments made when it was collected. We will obtain any permission and provide any choices required by applicable law. Acknowledgment of this policy is not a waiver of privacy rights or a substitute for any separate consent required by law.

17 Contact us

Photodepot LLC
Mailing address: PO Box 10012
Edison, NJ 08906
Privacy questions and requests: [email protected]
Customer support: [email protected]

If you are asking about information held by a photographer, employer, project host, or collaborator, contact that person or organization as well. We can respond about information we hold or processing for which we are responsible; we may not have access to information held only in their projects or systems.