Privacy Policy

Effective August 28, 2026

This policy covers what Image Depot actually collects and does today, as a new, early-access platform. We'd rather tell you plainly what's true now than paste in boilerplate that overpromises.

1. Information we collect

Account information: your studio name, email address, and password. Passwords are never stored in plain text -- we store a salted PBKDF2-SHA256 hash, not the password itself.
Content you upload: photos and the gallery metadata you create (names, event dates).
Waitlist signups: if you join our early-access list before creating an account, we store your email address and signup time.
Automatically collected data: your IP address (used for account security and abuse/rate-limit prevention) and a single session cookie that keeps you logged in. We don't run third-party analytics or ad-tracking scripts.

2. How we use it

To operate the Service: authenticate your account, store and deliver your galleries, secure the platform against abuse, and communicate with you about your account or the Service. We don't sell your personal information, and we don't use your photos for anything beyond delivering them through the Service on your behalf.

3. Cookies

We use one functional cookie (id_session) to keep you logged in. It's set to HttpOnly, Secure, and SameSite=Lax, meaning it can't be read by page scripts and isn't sent on cross-site requests. We don't use tracking or advertising cookies.

4. Photos and the people in them

Studios -- not Image Depot -- are responsible for obtaining any consent required to photograph and distribute images of the people in their Content, including additional consent that may be required for minors. Image Depot acts as infrastructure that stores and delivers Content on a Studio's behalf; we don't independently collect information from, or about, the people depicted in uploaded photos.

5. Who we share information with

We use Cloudflare for hosting, storage, and content delivery -- your data lives on their infrastructure, governed by our arrangement with them. Once paid plans launch, a payment processor will handle transaction data under its own privacy terms, which we'll link here before that happens. We don't sell personal information to anyone, and we don't share it with other third parties except where required by law.

6. Data retention, export, and deletion

We keep your account and Content for as long as your account is active. You can request a full export of your library, or deletion of your account and its data, at any time by emailing us -- we don't auto-archive galleries or restrict access without telling you first.

7. Security

All traffic to the Service is encrypted in transit (HTTPS). Passwords are hashed, never stored in plain text. Login and signup are rate-limited against brute-force attempts. No system is perfectly secure, and we can't guarantee absolute security, but we treat it as a first-class requirement, not an afterthought.

8. Children's privacy

The Service is intended for photography businesses, not for use by children. We don't knowingly collect personal information directly from anyone under 13. (This is distinct from photo subjects, covered in Section 4 above -- see that section for how consent for photographing minors is handled.)

9. Your rights

Wherever you're located, you can ask us to access, correct, export, or delete your personal information by emailing hello@imagedepot.net. If you're in a jurisdiction with specific data-protection laws (such as the EU, UK, or California) that grant additional rights, tell us and we'll do our best to honor them, even where we haven't yet built a fully automated process for it.

10. Changes to this policy

We'll post updates here with a new effective date, and make a reasonable effort to notify active accounts of material changes directly.

11. Contact

Questions about this policy? Email hello@imagedepot.net.