Privacy Policy

Unbound is a photo-hosting service operated by Unbound Works, LLC, a Delaware limited liability company (“Unbound,” “we,” “us”). If you have any question about your privacy, email privacy@unboundalbums.com and a person will answer.

We collect only what the service needs to work:

• Your account. Your email address, and your name if you choose to give one. If you sign in with Google, we receive your email and basic profile from Google — never your Google password.
• Your photos and galleries. The images you upload, their file names, capture dates and other embedded metadata, and the way you organize them — titles, scenes, order, cover choices.
• Payment information. When paid plans launch, payments are handled by Stripe. Card numbers go directly to Stripe; Unbound never sees or stores your full card details.
• Gallery visitors, only if you ask for them. If you turn on visitor sign-in for a gallery, we collect the name and email each guest enters. That switch is off by default and entirely yours to control.
• Basic technical logs. Standard server and security logs — IP address, browser type, timestamps — kept to operate the service and protect it from abuse.

We do not sell your data, we do not use your photographs to train AI models, and we do not run third-party advertising trackers on your galleries.

To create and secure your account, to store and serve your galleries, to process payments for paid plans, to send you service messages you need (like a notice before a gallery reaches its storage limit), and to keep the service safe and working. That is the whole list.

You decide. Every gallery is private by default. You can make one unlisted (anyone with the link) or public (shown on your profile and indexed). Private galleries can also be locked with a password.

Behind the scenes, files are served through short-lived signed links, so a URL cannot be shared to grant permanent access to something you meant to keep private. When you switch a gallery back to private, public access stops.

We use a small set of trusted providers, each handling one job. They process data on our behalf, under contract, and only for Unbound:

• Cloudflare R2 — stores your photo files.
• Supabase — accounts, sign-in, and the database that holds your gallery structure.
• Stripe — payment processing for paid plans.
• Resend — sends the service emails you receive from us.
• Vercel — runs and serves the website itself.

No online service can promise perfect security, but we take real, specific measures — and your photographs are private by default:

• All traffic runs over encrypted connections (HTTPS/TLS), and your files are encrypted at rest by our storage providers.
• Your photos are never public. They are served through short-lived signed links, checked on every request, so a URL cannot be reused to reach something you meant to keep private.
• Access controls mean your account can only ever reach its own data.
• Sign-in is protected by breach-checked passwords, email confirmation, limits on repeated password attempts, and a re-check before sensitive account changes.

Because no system is ever perfectly secure, keeping your own copies of irreplaceable photographs is always wise — we are a home for your work, not a substitute for a backup.

We keep your photos and galleries for as long as your account is active. Our core promise, which we hold ourselves to as a term of service: we never silently delete a gallery or lose your work to a missed payment. If a plan lapses or a free gallery goes over its limit, we freeze new uploads and warn you — repeatedly — with a clear chance to act before anything is removed.

When you delete a gallery or close your account, we hold it in a recoverable state for 30 days so a change of mind is never a disaster, then permanently delete it from our systems. A lapsed account left unresolved despite our warnings may have its data removed after at least 90 days. We keep your data for a finite, sensible time — never forever, and never without notice.

You can access and edit your account and galleries at any time from your dashboard. You can download your photographs whenever you like. And you can delete your account and its data yourself — in Account, under Close account, choose to permanently delete, and we remove your account, galleries, and personal information right away. Prefer we handle it? Email privacy@unboundalbums.com and we will take care of it.

Depending on where you live, you may have additional rights over your personal data — to access, correct, export, or erase it. Contact us and we will honor them.

Unbound is not directed to children under 13, and we do not knowingly collect their personal information. Photographs of children uploaded by an adult account holder are the content of that account, governed by these terms.

If we change how we handle your data in a meaningful way, we will update this page and, for significant changes, tell you directly. The “last updated” date above always reflects the current version.