Privacy policy

1. Controller

The controller responsible for data processing on this website is Jakob Tewes. Address and contact details are in the imprint.

2. Principles

Picdrop uses no tracking, advertising, analytics or embedded third-party content (such as fonts or scripts). We only process what is needed to run the service, and delete it as early as possible.

3. Hosting and server logs

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, under a data processing agreement (Art. 28 GDPR). When you visit the website, the server necessarily processes your IP address, date and time, the requested address and your browser identifier in server log files, to deliver the website and keep it secure (Art. 6(1)(f) GDPR). The host deletes or anonymizes these log files after a short time.

4. Account and sign-in

For an account we store your email address, when you registered and when you accepted the terms of use. To sign in, we email you a single-use link valid for 120 minutes. The legal basis is providing the service (Art. 6(1)(b) GDPR). The data is kept until you delete your account – you can do so at any time under “My galleries”, which also immediately deletes all your galleries and photos.

5. Galleries and photos

We store a gallery's title and the uploaded photos with upload time and image size. Every photo is re-encoded on upload, which removes all metadata (e.g. GPS location, camera model, capture time). So you can delete your own photo later, your browser receives a random deletion key; we only store an irreversible hash of it. A gallery is visible to anyone who knows its link or code.

A gallery and all its photos are deleted automatically 7 days after the last upload; its creator can delete it earlier at any time, and uploaders can delete their own photos. The legal basis is providing the service (Art. 6(1)(b) GDPR). Photos may show other people – whoever uploads them is responsible for having their consent.

6. Abuse prevention

To prevent guessing of gallery codes, mass sign-in emails and spam reports, we briefly store your IP address with a timestamp for such requests. These entries are deleted automatically after up to about 24 hours. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

7. Content reports

If you report content, we store the gallery or photo concerned, the reason, your explanation and – if given – your email address, to handle the report and send you a confirmation. Reports are kept for 12 months as a record of how they were handled, then deleted. The legal basis is our obligations as a hosting provider under the Digital Services Act (Art. 6(1)(c) GDPR with Art. 16 DSA) and our legitimate interest (Art. 6(1)(f) GDPR).

8. Emails

Sign-in links, report confirmations and notices about removed content are sent through our host's mail server. We do not send newsletters or advertising.

9. Cookies and local storage

• picdrop_sid: session cookie that enables sign-in and protects forms. After signing in it stays valid for 7 days, otherwise until you close the browser.
• picdrop_lang: remembers the language you picked with the DE/EN switch for one year (only after you click it).
• Browser local storage: the deletion keys of your own photos, and that you confirmed the notice before uploading. This data only leaves your device when you delete one of your own photos.

All of this is strictly necessary to provide the service you asked for (§ 25(2) no. 2 TDDDG); no consent is required.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Write to the address in the imprint. You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

11. Other

There is no automated decision-making or profiling. Data is not transferred to countries outside the EU.