Privacy Policy

This policy explains what personal data CullTone handles, why, and your choices. CullTone is responsible for the data of CullTone account holders. For the people in a studio's photos (couples, guests, families) the studio is responsible, and we process that data only on the studio's behalf and instructions.

1. What we handle

• Account: your name, email, a scrambled form of your password (never the password itself), or Google's id for your account when you sign in with Google (section 4), workspace name, members and roles.
• Projects: small previews and thumbnails of your photos, their decisions, edit settings, finished photos you deliver, files you edited in another app and bring in, and the client galleries. Originals stay on your computer unless you choose a cloud project or upload finished photos to a project of finished photos.
• Faces (People): for projects with People on, a numeric fingerprint of each face, used only to group that project's photos by person.
• Photo locations: CullTone Desktop remembers where each project's originals are on your computer (a folder, a card copy or a camera copy). The folder paths stay on your computer (a crash report's log lines can include them, see section 5). The service gets only a short name for each location, such as the card or folder name, and whether it can be read right now.
• Crash reports from CullTone Desktop: when the app, one of its jobs or its window stops unexpectedly, it writes a crash report and sends it to us, unless you turned that off (see section 5).
• Client activity: what a client does in a gallery: favourites, approvals, redo requests, comments, the name they type, downloads.
• Security and use: sign-in sessions, your IP address for rate limiting sign-in attempts, and a log of actions in the workspace (who did what, when).
• Payments (when billing is live): handled by Stripe; we keep your plan and Stripe's customer reference, not your card details.
• Contact messages: what you send through the contact form: the name, email address, studio and message you type, the time, your browser's name and a scrambled form of your IP address used to limit messages per connection.

2. Why

To provide CullTone as you asked (the contract), to keep it secure and prevent abuse (our legitimate interest), and to meet legal duties such as tax records. We don't sell personal data, don't show ads, and don't use photos or faces to train AI models.

3. Faces

Face fingerprints are made per project, stored with that project, never compared across projects or workspaces, and deleted when People is turned off or the project is deleted. On CullTone Desktop they are kept in CullTone's own data folder on the project's main computer, not in your photo library, and are not sent to the service. Face fingerprints can be biometric data under laws such as the GDPR, Illinois' BIPA and India's DPDP Act; the studio must have the right to use face grouping for its photos and can turn it off per project.

4. Signing in with Google

You can sign up and sign in with a Google account instead of a password. CullTone then asks Google for your name, your email address and Google's id for your account (the "openid", "email" and "profile" permissions), and nothing else: no access to your Gmail, Drive, contacts, calendar or photos.

• What we use it for: to create your account and sign you in. The name becomes your account name, the email your sign-in email. If an account with that email already exists and has a password, we connect Google sign-in to it only after you sign in with that password once.
• What we keep: your name, your email address and Google's id for your account, stored with your account like the details in section 1. We don't keep Google's sign-in tokens after you are signed in, and we don't receive your Google password.
• Who sees it: it isn't sold, shared or used for advertising, and it isn't used to train AI models. It is processed by our hosting provider like the rest of your account (section 6).
• Removing it: you can remove CullTone's access in your Google Account under Security, Third-party apps and services. Deleting your CullTone account deletes the details above (section 9).

CullTone's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Crash reports from CullTone Desktop

A crash report helps us find and fix what went wrong. It holds the app and engine version, your operating system and processor type, the time, what crashed (the error message, where in the code it happened and the steps that led there, or the system's crash code), the job that was running and the page that was open (its address without anything after a question mark), this computer's id in your workspace and the CullTone server it is connected to, and the last 200 lines of the app's log. Log lines can include project ids, photo file names and folder paths. It never holds your photos.

Before a report leaves your computer, CullTone replaces sign-in tokens, passwords, keys and other secrets with "[redacted]" and shortens your home folder to "~". When the whole app was stopped by the system, CullTone Desktop turns the system's own crash report into one of these at its next start, cleaned the same way.

Reports are sent only to the CullTone service, at most 10 an hour, and kept in its private storage. Only CullTone support staff can read them, and each time one is opened it is written to our support log. Studios don't see them. We delete a report 180 days after it arrives. On your computer, a report that could not be sent is deleted after 30 days, and at most 50 are kept.

To stop sending them, turn off "Send crash reports to CullTone" in the CullTone menu bar icon or in Settings on the app's offline page. Reports are then still written and kept on your computer, next to the app's logs, and are not sent.

6. Who else processes data

• Google Cloud (United States): hosting, the database and file storage.
• Google sign-in: only when you choose Continue with Google (section 4).
• Google Analytics: visits to the public website only (section 8).
• Cloudflare R2: client gallery files.
• Google Gemini: only for the paid optional steps you approve; the photos for that step are sent for processing under Google's terms for paid API use.
• Stripe: payments, once billing is live.
• An email provider: account and gallery emails, once email is live.

Some of these providers may process data outside your country, under the safeguards the law requires.

7. How long we keep it

• Galleries: until they expire (6 months by default, extendable), then 30 more days, then the gallery copies are deleted.
• Cloud originals: deleted after the retention period the workspace sets, counted from the last delivery, after a warning.
• Archived projects: restorable for 30 days; deleted permanently when you choose.
• Face fingerprints: until People is turned off or the project is deleted.
• Crash reports: 180 days after they arrive.
• Your account: until you ask us to delete it.
• Contact form messages: no fixed period yet; ask us and we delete yours.

8. Cookies and storage in your browser

One cookie keeps you signed in. The app also remembers settings such as grid size and the current workspace in your browser's local storage. The app, client galleries and invite links have no analytics, advertising or tracking cookies.

The public website (culltone.com outside the app) uses Google Analytics to count visits and see which pages people read: the pages visited, the site that sent you, your browser, device and rough location. It sets the cookies _ga and _ga_*, kept up to two years. Visitors in the European Economic Area, the UK and Switzerland get no analytics cookies, only counts without them. Nothing is used for advertising. You can block these cookies in your browser or with Google's opt-out add-on.

9. Your rights

You can see and correct your account details in Settings, export your photos and decisions, and delete projects. You can ask us for a copy of your data, or to correct, restrict or delete it, and you can complain to your data protection authority. People in a studio's photos should contact the studio first; we will help the studio answer. Contact us through the contact form with the topic Privacy.

10. Changes

We'll show changes to this policy in the app before they take effect.

Terms of Service · Privacy Policy