Privacy
Your photographs stay in a folder on your computer. The server holds a preview of a photo only when you share or publish it, and an email address and a few counters if you sign in. The tables below list what is stored, who sees it, and when it goes.
On this computer
The library is a folder you pick. The catalogue is a text file inside it, and previews and edits sit in the browser's private storage on this machine. The film tool at /film-look decodes and renders the photograph in the tab. Neither uploads anything.
Four things are counted. None of them sets a cookie or holds an identifier.
| Counter | Carries | Never carries |
|---|---|---|
| Page views (Vercel Web Analytics) | the page path, the referrer, the browser and device type | share ids or sign-in tokens, which are stripped from the path first |
| Milestones | an event name: first visit or return, folder connected, photos imported, book made, each step of the film tool, a mailed link opened on another device | anything else. First visit or return is one boolean in local storage |
| Print checkout | the step reached, the shop's words for the order (binding, paper, page count), a refusal's code | the book, its title, anything you typed |
| Crash reports | app version, browser and graphics adapter names, screen size, photo counts, storage usage, the names of the last twenty actions | filenames, folder names, pixels |
Load any page with ?noanalytics=1 to switch the first three off in that
browser. The choice latches in local storage, and ?noanalytics=0 lifts it.
Crash reports post to our server, which forwards them to Sentry, at most eight per
session and with no Sentry script on the page. Copy report on the crash card shows the
exact bytes, and localStorage['abney.errorReports'] = 'off' stops them.
With an account
Sign-in is a six-digit code or a magic link mailed to you. There is no password. One
cookie, abney_session, keeps you signed in. It is HttpOnly, Secure and
SameSite=Lax, and there are no other cookies.
| Store | Holds | Kept |
|---|---|---|
| Account | email address, display name, and if you fill them in a first and last name (shown to nobody but you), a bio and social handles | until you delete the account |
| Sign-in codes | a SHA-256 hash of the code or link with a server secret | 15 minutes, or five wrong tries |
| Session | a SHA-256 hash of the cookie, when it was created and last used | 90 days from your last request |
| Usage | one date per day you used Abney, and one timestamp per visit, where a visit is a session's first request or a return after half an hour away. No page, no action, no address | until you delete the account |
| Project list | each project's name, folder name, photo count and desk names. Never a preview or a pixel | until you delete the account |
| Mail log | the kind of mail, the recipient, the time, to cap how much mail one address can trigger | indefinitely |
The usage rows exist to answer whether people come back after their first week, and how often. Nothing else reads them.
When you share or publish
Both kinds of share upload a preview JPEG of each photo, never the original.
| Share | Uploads | Who sees it | Deleted |
|---|---|---|---|
| Desk share | previews, each photo's edit settings without its file path, the desk arrangement, the books and their pages, comments as plain text, and each member's selection and cursor while they have the desk open | signed-in members of that share. Members see your display name. The owner and editors see members' email addresses | when you stop sharing |
| Public link | one preview, the title you gave it, and your name and social links only if you switch them on | anyone holding the address, with no sign-in | when you take it down |
A public page is frozen at publish until you push a new version. It carries a no-index header, and our robots file disallows the image files. Neither is a lock: a badly behaved crawler can ignore both, and what a person or a chat preview has already fetched is beyond our reach. Each link counts views, and so does your user page if you turn one on. Both skip your own visits and known crawlers.
When you order a print
| Who | Gets | Kept |
|---|---|---|
| Stripe Checkout | the card and the delivery address | card numbers never touch our server |
| The order row | your email address, the delivery address, Stripe's payment ids, the shop's order number | street, company and phone are wiped once the shop dispatches |
| The print shop | the PDF and the delivery address, which it needs to print and ship | under the shop's own policy |
Where you came from
The first page a browser opens here writes one line to local storage: the referring host, the landing path, and any campaign tags in the address. If that browser later makes an account, the line is stored with the account, once, capped at 200 characters. A browser that never signs up never sends it.
Abney buys ads in ChatGPT. A click on one lands here with OpenAI's click id in the address, and the line keeps it. When an account is made from that click, our server sends OpenAI one registration event: the click id, the landing URL, the time, and our account id so the same sign-up cannot count twice. No email, no name, and no OpenAI script on any page.
Providers
Each one processes the data to run the service and for nothing else. We do not sell data or carry ads, and we do not open your desks and links unless you send one to us to debug.
| Provider | Does |
|---|---|
| Vercel | runs the functions and holds the uploaded previews. Public-link images stream through abney.cc, and the storage itself is never exposed |
| Neon | Postgres, in Frankfurt (eu-central-1) |
| Resend | sign-in codes and invites |
| Stripe | payments for print orders |
| Sentry | crash reports and feedback, via our server |
| OpenAI | one registration event per sign-up from a ChatGPT ad |
Deleting your data
Stop sharing a desk or take a link down and its files are deleted from storage there and then. Deleting the account, from the account dialog in the app, removes the account row and everything keyed to it: sessions, usage, the project list, your memberships. Stop sharing your own desks first and take your public links down first: deleting the account closes the links but does not yet clear the files behind them. That gap is on the list. If deletion refuses, or you want everything removed by hand, send feedback and we will do it.
Questions
Use Send feedback inside the app and leave your address. The message and the address reach us through Sentry, the same road as a crash report. If this policy changes, this page changes, with the date below.
Last updated 5 September 2026.