Privacy policy

PhotoMagic is a tool that helps you triage photos that already live in your Google Drive or Google Photos. We do not retain original Drive photos. New-event forms show private photo analysis as a visible, default-on choice that the owner can uncheck before creating the event. When left on, our server temporarily reads downscaled previews to group people, assess quality, and find scene details; those previews stay in memory and their temporary URLs are removed when the job ends. We store the derived event-scoped results needed for review and smart selection.

When you sign in with Google, we request the following OAuth scopes:

• openid email profile — to identify your account and show your name and avatar.
• drive.file — to access only the folders/files you choose through Google Picker, read their thumbnails for triage and optional analysis, and (only when you click those buttons) create a destination folder and copy/shortcut selected files or apply lossless EXIF rotation.
• photoslibrary.appendonly — only used if you click Send to Photos. Lets us add your picks to a new Google Photos album we create. We cannot read your existing Photos library.

The following lives in our Supabase database:

• Your Google user id, email, name, and avatar URL.
• A row per Drive folder you’ve opened, with the folder’s id and name.
• Per-photo selection state (pick / maybe / reject) referenced by Drive file id — never the file contents.
• An append-only event log of selection changes so you can scrub through your history.
• Small per-file metadata when the event owner leaves background analysis on (or enables it later): perceptual/duplicate hash, sharpness and quality scores, scene tags, image dimensions, and capture time. For Drive events we do not retain the photo itself.
• Only when private analysis is enabled: face “embeddings” (numeric faceprints), face positions, person groups, and any names or VIP choices you add — all scoped to that event. The new-event checkbox is on by default but can be unchecked before creation; the owner can also turn analysis off and delete this data later.
• If you publish a lookbook, we store the layout spec and the thumbnail URLs (already-public Google-hosted thumbnails) so anyone with the link can view the page.
• Direct photo uploads (the “Upload Photos” on-ramp, for events without Drive): we downscale each photo in your browser to two JPEG copies — a small grid thumbnail and a lightbox-size display image — and store only those in Cloudflare R2. We never receive or store the original, full-resolution file. These are deleted automatically 6 months after upload; see “How we protect your data” below.
• An encrypted Google refresh token, when Google provides one, so we can keep your Drive connection working without asking you to re-consent every hour. It is encrypted at rest and only used to mint short-lived Google access tokens for the features you choose to run.

• Your original, full-resolution photos. For Drive events Google continues to host them. Normal selection loads thumbnails directly; optional private analysis reads only downscaled, short-lived previews. For direct uploads (see above) we receive only the downscaled JPEG copies created in your browser; the original file never leaves your device.
• Unencrypted Google access or refresh tokens. Access tokens are short-lived and used only to call Google APIs on your behalf.
• Any face or biometric data when the owner unchecks private analysis before creating the event. When analysis remains enabled, biometric results stay event-scoped, are not a shared identity index, and are deletable at any time (see the next section).
• Third-party advertising trackers or marketing pixels.

PhotoMagic can group an event’s photos by who appears in them, so you can make sure everyone is covered and quickly find a specific person. It can also score photo quality and suggest scene/detail tags for a target-sized smart selection. Because this includes biometric processing, the choice is shown directly in event creation and works like this:

• On by default for new events, with an opt-out. The creation form explains the processing and includes a checked control. The owner can uncheck it before creating the event. By leaving it on and creating the event, the owner confirms they have authority for the people shown, including any minors.
• It runs on a private PhotoMagic worker in India. The worker securely fetches downscaled, short-lived previews, keeps image bytes in memory only, and does not write them to disk. Source URLs are cleared from its queue as soon as the job completes, fails, or is cancelled; terminal job metadata is removed after its short retention window (normally 24 hours).
• Find someone’s photos. You can upload a single clear photo of one person to pull every shot they appear in. That photo is matched against the event’s faceprints entirely in your browser and discarded immediately — it is never uploaded to us or stored.
• What we store: per-face embeddings and positions, person groups, names/VIP choices, and per-photo quality, duplicate and scene/detail signals — all scoped to that event in our Supabase database and readable only by event members. In-progress worker results stay in service-only staging tables and become visible atomically when a complete job succeeds.
• Not a cross-user index. We never build a cross-user identity database. Analysis uses self-hosted InsightFace/ArcFace and, when enabled, self-hosted OpenCLIP models. We do not send event previews or faceprints to an external AI provider, sell them, or use them to train a model.
• Remembered people (optional, your account only). You can choose to “remember” a person you’ve named so we can suggest their name at your future events. When you do, we save that name and their face embedding to a private library scoped to your account — never shared with other users. Suggestions are always yours to confirm (never auto-applied). You can forget one person, or your whole library, anytime from the People panel; deleting your account removes it.
• Suggestions only. Groupings are suggestions you review and correct. Smart selection produces a preview and waits for you to apply it; it never auto-hides, skips, or deletes a person or photo. We do not infer age, gender, race, emotion, or any other demographic attribute.
• Delete anytime.One click — “Turn off & delete face data” — cancels active processing and permanently deletes every event embedding, person group, quality/scene result, job, and smart-selection run. Deleting the event deletes them too, and you can email us to request erasure.

We treat the data you connect through Google — your Drive file metadata, your profile, and especially your Google OAuth tokens — as sensitive, and protect it with the following safeguards:

• Encryption in transit.Every request to our app and to Google’s APIs travels over HTTPS (TLS 1.2+). Your photos stream from Google to your browser and, when the event’s analysis choice is enabled, from Google to the private analysis worker over encrypted connections.
• Encryption at rest. Our database (Supabase Postgres) and all backups are encrypted at rest with AES-256 by the cloud provider.
• Extra encryption for your Google refresh token. The single most sensitive item we hold is the Google refresh token. Before it is written to the database it is encrypted a second time, in our application layer, using AES-256-GCM with a key that lives only in server environment variables and never in the database. So even with database access, the token cannot be read without that separate key. It is decrypted only in memory, on the server, to mint a short-lived access token for an action you initiated.
• Strict access control. Every row is protected by Supabase row-level security: you can only read or write your own selections, and collaborators can only read sessions they were explicitly invited to. Privileged database keys are used only in server-side code, never exposed to the browser.
• Data minimization. We request the narrowest Google access our features need, and we store only lightweight metadata (file ids, selection state, and small derived values). Analysis previews are downscaled, processed in memory, and not retained by the worker.
• Trusted infrastructure. Data is hosted on Google, Supabase, Vercel, Cloudflare R2 (direct uploads), and Oracle Cloud Infrastructure in Mumbai (private analysis). Access to production systems is limited to the app’s operator.
• Retention & deletion. You can revoke access at any time (see below). On request we delete your stored data — including the encrypted refresh token, selections, and event history — within 7 days. Revoking the app in your Google account immediately invalidates any token we hold.
• Uploaded event photos expire automatically. Direct-upload events (see “What we store”) are deleted — the downscaled photos, the event, and its selection history — 180 days (about 6 months) after upload, whether or not you ask. A countdown is shown in the event while it’s active.

No method of transmission or storage is ever 100% secure, but we work to protect your data using the measures above and review them as the app evolves.

Only you and any collaborators you explicitly invite to a session (by sharing the session URL). We enforce this with Supabase row-level security — collaborators can only read sessions they’re a member of.

Public lookbooks are the one exception: when you click Share as web page, anyone who has the unguessable slug URL can view the assembled book (and grab the PDF). They cannot see your other sessions or pick state.

To understand how PhotoMagic is used and where it can be improved, we record first-party product events — for example “a session was created”, “a first pick was made”, or “the export dialog was opened”. These individual event records land in our own database; we do not sell them or share them with advertisers.

Signed-out browser events use a random in-browser id (no analytics cookie, name, or email). Signed-in events may include the account's internal user id, and workflow events may include an event/session id. Records can also contain event properties, the current path and referrer, a coarse device class (mobile/desktop), and country/region derived at the edge — we never store your IP address. If your browser sends a Do Not Track signal, we skip browser-side product-event tracking; server-side operational events may still be recorded as described below.

We also use Vercel's cookieless Analytics and Speed Insights for aggregate traffic and performance.

For a Find My Photossearch, the raw selfie remains in the browser. The request sends its numeric face embedding plus the selected file's MIME type, byte size, dimensions, and last-modified time. We store that file metadata, the event session id, whether its source is Drive or direct upload, the match count, and returned-result count with the guest_selfie_search product analytics event; we do not store the raw selfie or its embedding in that event.

We set a single first-party cookie to keep you signed in (the Supabase auth session). No third-party cookies, no marketing cookies, and no cookie-based analytics.

You can revoke PhotoMagic’s access at any time:

• Go to myaccount.google.com/permissions → find PhotoMagic → Remove access.
• To also delete your data on our side, email hello@photomagic.live from the account address. We delete your row(s), session memberships, and event history within 7 days.

Database: Supabase (Postgres) in the Northeast Asia (Tokyo) region. Web hosting: Vercel. Optional analysis runs on PhotoMagic’s Oracle Cloud worker in Mumbai, India; it processes downscaled previews in memory without retaining image bytes. Originals remain in Google Drive. Downscaled copies from direct photo uploads are stored in Cloudflare R2.

If we change anything substantive we’ll update the date at the top and, for existing users, surface the change on next sign-in.

Questions? Reach out at hello@photomagic.live.