Privacy Policy
Last updated:
This policy explains what information Gallkit collects, why we collect it, who we share it with, and what you can do about it. It covers the gallkit.com website and waitlist, and the Gallkit app.
Who we are
Gallkit is run by Ward Williams, doing business as Gallkit, based in Colorado, USA. In this policy, “Gallkit”, “we” and “us” mean that operator. Gallkit helps photographers and videographers deliver client galleries from their own Dropbox, Google Drive or OneDrive.
What we collect and why
The waitlist
If you join the waitlist, we collect your email address. Signups are handled by Kit (formerly ConvertKit) and use double opt-in: you're only added once you confirm from the email Kit sends you. We use your address only to send you launch and beta updates about Gallkit. Every email has an unsubscribe link.
Gallkit accounts
Gallkit has three kinds of user:
- Owners: the photography or videography business that runs a Gallkit account.
- Admins: staff an Owner adds to help run their account.
- Clients: people an Owner invites to view and download galleries.
Sign-in runs on Gallkit's own login system, not a third-party sign-in provider. For each account we store your name, email address, role and company name, plus any logo or profile picture (avatar) you upload. Logos and avatars are stored in Cloudflare R2. We use this information to run your account, show your branding to your clients, and send the emails the service depends on, such as invitations and delivery notices.
If you subscribe to a paid plan, payment is handled by Stripe. We never see your full card number.
Cookies and browser storage
The Gallkit app sets one cookie: a sign-in session cookie, which is cleared when you close your browser or log out. The login pages, which run on Gallkit's own login server, set their own cookies to manage sign-in.
The app also saves display preferences in your browser's local storage, such as your theme, the sidebar, and the last company and gallery you viewed. These stay on your device.
We don't use analytics, advertising or error-tracking tools, on the website or in the app.
Server logs
Our servers log requests, including IP addresses, for security and troubleshooting. We keep these logs for no longer than 30 days.
Cloud storage connections
Owners connect Dropbox, Google Drive or OneDrive to Gallkit with OAuth: the standard “allow access” screen from your storage provider. Gallkit never sees your storage password. We store the access tokens your provider gives us.
Gallkit creates a folder in your storage and works inside it. It creates folders, uploads the photos and videos you add through Gallkit, reads them to show galleries to your clients, and deletes them when you delete photos or galleries in Gallkit. It also saves the thumbnails, preview clips and video versions it makes into a folder in your own storage. Gallkit keeps no copies of your files on its own servers. Files you upload, and the video versions Gallkit makes, are held on our servers only temporarily while they're processed, then deleted.
What Gallkit can access depends on the provider:
- Google Drive: only files Gallkit created (Google's “drive.file” permission).
- Dropbox: only Gallkit's own app folder in your Dropbox. Gallkit can't see anything else.
- OneDrive: Microsoft's permission lets Gallkit read and write files anywhere in your OneDrive, but Gallkit only works in its “Gallkit” folder.
Google Drive and Dropbox files are streamed to viewers through Gallkit's servers, and may be held briefly in server memory (a few minutes) so they load faster. They're never saved to our disks. OneDrive files are served directly by Microsoft.
When a client downloads a whole gallery as a zip, the zip passes through Gallkit's servers as it's sent: Gallkit builds it for Google Drive and OneDrive, and Dropbox builds its own. Either way, it isn't saved to our disks.
When you delete a gallery, its original files are deleted from your storage; when you delete a photo, its original is deleted. The thumbnails, previews and video versions Gallkit made are kept in a separate folder that isn't cleaned up automatically yet, so you can delete it yourself. Files deleted from your storage may stay in your provider's trash, according to the provider's own rules.
Google user data
When an Owner connects Google Drive, Gallkit uses that access to create folders and files in the Owner's Drive, upload the photos and videos the Owner adds, read them, and stream them to the clients the Owner has invited. It also saves the thumbnails and previews it makes in the Owner's Drive, and deletes files when the Owner deletes them in Gallkit. We store the access tokens Google provides. We don't sell Google user data or use it for advertising.
Gallkit's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Client data
Owners add their clients to Gallkit, so we store each client's name and email address. When a client uses a gallery, we record their favorites, comments and downloads so the Owner can see them.
We handle client data on behalf of the photographer or videographer who invited the client, and that Owner decides who can see each gallery. If you're a client and want your information changed or removed, contact the photographer who invited you, or email us at privacy@gallkit.com.
Who we share information with
We don't sell your personal information. We share it only with the service providers that help us run Gallkit:
- Kit: waitlist email.
- SendGrid: transactional email, such as invitations, “photos delivered” notices and alerts.
- Stripe: subscription billing.
- DigitalOcean: hosting and databases, in New York, USA.
- Cloudflare: DNS, and R2 storage for uploaded logos and avatars.
When an Owner connects cloud storage, Gallkit also exchanges data with that provider (Dropbox, Google or Microsoft) as described above.
How long we keep information
- Waitlist: until you unsubscribe or ask us to delete it.
- Account information: while your account is active. Gallkit doesn't have an in-app option to delete your account yet; email privacy@gallkit.com and we'll delete your account information within 30 days.
- Galleries and client activity (favorites, comments and downloads): for as long as the Owner keeps the gallery.
- Storage connection tokens: removed from our database when you disconnect the provider or your account is deleted. Disconnecting in Gallkit may not revoke access on Google's or Microsoft's side, so revoke it in your Google or Microsoft account settings too.
- Server logs: up to 30 days.
- Backups: deleted information may remain in database backups for up to 30 days.
Your choices
- Unsubscribe: every waitlist email has an unsubscribe link.
- Access and correction: email privacy@gallkit.com to ask for a copy of the information we hold about you, or to correct it.
- Deletion: email privacy@gallkit.com to ask us to delete your information. There's no in-app option yet.
- Cloud storage access: you can revoke Gallkit's access at any time from your Dropbox, Google or Microsoft account settings.
Children
Gallkit isn't intended for anyone under 16, and we don't knowingly collect information from children under 16. If you think a child has given us information, email privacy@gallkit.com and we'll delete it.
Changes to this policy
If we change this policy, we'll post the new version on this page and update the date at the top.
Contact
Questions about this policy or your information: privacy@gallkit.com
Ward Williams, doing business as Gallkit
Colorado, USA
https://gallkit.com