Privacy Policy
Last updated: 16 October 2026
1. About this policy
OurChest is a private place to store and share photos and other uploaded media with people you invite. This Privacy Policy explains how OurChest handles personal information across getourchest.com, our apps, and related services. OurChest is responsible for the personal information it processes to operate these services. For privacy questions or requests, contact Tom at ourchestapp@gmail.com.
2. Information we collect
Account information: your email address, display name, account identifier, sign-in provider, and the records needed to manage your account and sessions. When you use Google or Apple sign-in, we receive the account identifier and email address supplied by that provider, and a name where provided. Apple may supply a private relay email address.
Uploaded content: the images and other media you choose to upload, previews, filenames, file types, sizes, dimensions or duration where available, upload times, and the account or guest that uploaded them. Original files can include embedded metadata, including the date or location recorded by your camera. Because we preserve originals, this metadata may remain in files that other authorised members download. We do not separately copy EXIF location into our database.
Sharing and service information: Chest names, memberships, invitations, access permissions, connected storage account identifiers, copy status, and your support messages. We also process technical information needed to run and protect the service, such as IP addresses, browser or app details, session and device registration records, errors, and limited usage events. We do not use advertising identifiers or hardware fingerprinting.
3. How and why we use information
We use this information to sign you in, store and display your uploads, generate previews, manage Chests and invitations, enforce access permissions, deliver copies you request, respond to support requests, and send essential account or service messages. We use limited operational and usage information to diagnose failures, prevent abuse, secure the service, and understand whether features work.
Where data protection law requires a legal basis, we rely on performing our agreement with you to provide the service; our legitimate interests in security, reliability, and support; compliance with legal obligations; or your consent where required. You can withdraw consent for optional processing without affecting processing already carried out lawfully. OurChest does not provide AI features or use your images to train AI models. We do not sell or rent personal information or use private uploads for targeted advertising.
4. Private storage and security
Original uploads and previews are stored in private Cloudflare R2 object storage. Account, Chest, membership, and file records are held separately in our application database, using Neon PostgreSQL. Cloudflare also helps deliver and protect our web services. Our marketing website is hosted with Framer.
We use encrypted connections, access controls, and time-limited signed file links to protect access to stored media. These links grant access to a particular file for a limited time, so you should treat them as private. OurChest is not end-to-end encrypted: our service can access stored files where necessary to deliver the features you request, maintain security, or comply with law. No online service can guarantee absolute security.
5. Sharing and service providers
Your uploads are made available to people who have access to the Chest, according to its permissions. A recipient may download or keep an independent copy. Removing a member or deleting an upload cannot recall copies that person has already saved.
We use providers to supply hosting, storage, database infrastructure, authentication, email delivery, and other service functions. They receive the information needed for their role. Our email delivery provider receives your email address and sign-in or service message when sending that message. Where enabled, notification and error-reporting providers process device routing details or technical diagnostics. We do not include file contents, filenames, session tokens, or signed media links in routine operational logs.
If you choose to connect Google Drive, Dropbox, or OneDrive for copies, Composio manages the provider authorisation on our behalf. We store its connected-account identifier and copy records rather than the cloud provider token. The selected provider receives the media and file information needed to save your requested copy. We may disclose information where required by law or necessary to investigate abuse or protect people and the service. External services have their own privacy policies.
6. Google sign-in and Google Drive
Google sign-in provides your Google account identifier, email address, and profile name where supplied, so we can authenticate you and maintain your OurChest account. Signing in does not by itself connect Google Drive.
If you separately connect Google Drive, we use the access you authorise to create or locate OurChest folders, upload copies you request, and check file identifiers, sizes, and available checksums to verify delivery. The connection is for copying your OurChest media to your Drive, not importing your Drive library. We do not request access to Gmail or Google Contacts for these features.
Google API Service User Data Policy
OurChest’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only for the disclosed features, not advertising, sale to data brokers, or AI training. Human access is limited to your affirmative agreement, security investigation, legal requirements, or other access permitted by that policy.
You can disconnect Drive in OurChest or revoke access through your Google Account connections. Revoking access stops future access through that authorisation. Copies already saved in Drive remain there until you delete them.
7. Retention and deletion
We keep account information and uploads for as long as needed to provide the service and for the purposes described in this policy. Retention depends on whether your account and Chest remain active, whether content has been deleted, and any applicable legal, security, or dispute-resolution requirements. Deleted media may pass through a temporary trash or recovery process before permanent removal. Backups and pending storage cleanup may take additional time to clear; retained information remains protected and is not used for new purposes.
You can remove content using the controls available for your role and request account or personal information deletion by emailing ourchestapp@gmail.com. Account deletion may require you to resolve Chests or content still associated with the account; contact us if you cannot complete it in the app. We may need to verify your identity and explain any information we must retain. Deleting an OurChest item or disconnecting a destination does not delete independent copies held by other members or in Google Drive, Dropbox, or OneDrive.
8. Cookies and device permissions
We use cookies and similar local storage to maintain browser sessions and support essential service functions. Native apps use secure device storage for session credentials. You can control cookies in your browser, although blocking essential cookies may prevent sign-in or guest access.
Camera and photo-library permissions let you capture or select the media you choose to upload. Notification permission, where offered, allows service notifications. You can change these permissions in your device settings. We do not access your entire photo library simply because you have an OurChest account. Where optional cookies or tracking require consent, they must be offered with an appropriate choice.
9. International processing
OurChest and its service providers may process information in countries other than where you live. Storage in Cloudflare R2 does not mean all account data or service processing occurs in a single country. Where applicable law requires safeguards for an international transfer, we use the safeguards required for that transfer, such as recognised contractual protections. Contact us for information about the arrangements relevant to your data.
10. Your privacy rights
Depending on where you live, you may have rights to access or receive a copy of your personal information, correct it, request deletion, restrict or object to processing, and receive information in a portable format. Where processing relies on consent, you may withdraw it. You may also complain to your local data protection authority.
To exercise a right, contact Tom at ourchestapp@gmail.com. We may ask for information needed to verify your identity and will respond within the time required by applicable law. We will explain if a request cannot be fully fulfilled or if a lawful exception applies.
11. Children’s privacy
OurChest is intended for adults and does not offer child accounts or direct its services to children. Adults may upload family images that include children and should only share content they have the right to share. If you believe a child has provided personal information through their own account, or you have a concern about a child’s image, contact ourchestapp@gmail.com so we can investigate and take appropriate action.
12. Changes and contact
We may update this policy as OurChest or its data practices change. The date at the top shows the latest revision. We will provide additional notice of material changes where required, and obtain consent before using Google user data for a new purpose where Google’s policies require it.
For questions about this policy, data handling, or deletion, contact Tom at ourchestapp@gmail.com.
© 2026 OurChest