Where your photos go, and what we still owe you
Your RAW files stay on your computer. We receive previews, the decisions, the finished JPEGs you deliver and the client galleries. Below: what protects that today, and the gaps we know about.
| Data | Sent to us? |
|---|---|
| RAW originals | No. They stay on your computer. |
| Thumbnails and review previews | Yes, so you and your team can cull on the web and on a phone |
| Decisions, reasons and edit settings | Yes |
| Finished JPEGs | Only the ones you deliver or approve |
| People groups and small face crops | Yes, when People is on for that project |
| Face fingerprints (the numbers used to compare faces) | No. They stay in CullTone's own data folder on the project's main computer, never in your photo library. |
| Photos you edited in another app and bring in | Yes, the files you choose, so CullTone can match them and deliver them |
Two kinds of project are the exception. In a cloud project the browser uploads the originals; cloud projects are switched off for the beta. In a project of finished photos you upload the finished JPEG, PNG or TIFF files yourself, and they are stored with us for the galleries.
Paid extras and the outside AI service
Two optional steps are done for us by an outside AI service (our privacy policy names it): the tie-break for bursts CullTone couldn't separate on its own, and prompt changes to a single photo. Each shows its price first and runs only after you say yes. They are paid from the AI credit that comes with your plan, each project has an allowance ($1 to start, which the owner can change), and a step that doesn't fit what's left doesn't run.
For a tie-break, a few previews of that one burst go to that service. Your photos go there only for a paid step you approved, never for routine culling or editing. CullTone Desktop holds no key or account for it.
Faces stay inside one project
People groups the faces in a project so you can check that every guest who matters was photographed. It compares faces within that project only, never across projects or studios. It is on by default, and you can switch it off per project, which deletes that project's face fingerprints from our side.
A project export (Project settings, Export this project) never includes face fingerprints or any other face data. It has only the names you gave in People, and only when People is on. Team email addresses go in only when the workspace owner asks for them.
On CullTone Desktop the fingerprints stay on the project's main computer, in CullTone's own data folder rather than next to your photos, and they are never uploaded. When you switch People off or delete the project for good, the desktop app deletes them there too, the next time it checks in.
Who can see what
- We never store your password in a form we can read back. After 5 failed sign-ins for one email in 15 minutes, that email is paused until the window passes.
- You stay signed in for up to 30 days. Changes are accepted only from our own site.
- Each workspace has four roles: owner, editor, reviewer and client. Someone outside the workspace gets "not found", so they can't even learn that a project exists.
- Photo addresses expire, so a copied image link stops working after a while.
- A client gallery link is long and random. Gallery pages ask search engines not to list them and don't pass their address on to other sites. Galleries close after six months by default, and you can revoke one at any time. A gallery can also ask for a PIN, and wrong guesses are limited.
- CullTone never changes your original files, and Archive is reversible. Nothing is deleted unless you delete it.
Not done yet
Better you read this list here than find it later, mid-season.
- No SOC 2 report, no ISO 27001 certificate, and no independent security audit or penetration test.
- CullTone is not deployed. We haven't chosen where it will be hosted, and backups with a tested restore don't exist yet.
- The Mac app is not signed or notarised by Apple, so macOS warns before opening it.
- No email check at sign-up, no password reset and no two-step sign-in. CullTone sends no email at all yet.
- A Mac you connected stays connected until you remove it in Settings.
To report a problem, use the contact form with the topic Privacy.