What FotoSafe keeps, and what stays on your computer.

An account needs an email address. That email is the account name. If you create the account with a password, FotoSafe stores a salted hash of the password, not the password itself. The account stays closed until you open the confirmation link sent to that email. A forgotten password sends a reset link. Both links are stored only as a hash. A confirmation link expires after 24 hours, and a reset link expires after 1 hour. Those messages are sent from noreply@fotosafe.net. If you use Google, Google confirms the email and a Google account id. FotoSafe does not receive your Google password.

A sign-in lasts 30 days in an HttpOnly cookie named fotosafe_session. Starting a Google sign-in also sets a short-lived cookie named fotosafe_google so the return from Google can be matched to your browser. Signing out, or deleting the account, ends the session. FotoSafe also keeps, for each sign-in, the kind of device and browser it came from and when it was last used, so you can see your sign-ins and end them in Settings. If you add a name, it is stored with the account.

Email sign-in and account creation use Cloudflare Turnstile, which checks that the request comes from a person. That check can include the IP address of the request.

When you back up a photo, FotoSafe stores the file, a smaller preview, the file name, the size, a content hash, and details the camera wrote into the photo: when it was taken, the camera and lens, the camera settings, and the location if the photo has one. FotoSafe uses these details to sort, search and show your photos. A location is shown only to your account. Review choices, such as keep or hold, are stored with the account. The website can score blur and shake in the browser before a photo is uploaded. The Windows app does those checks, and any face check, on the computer that has the photos.

Face naming stays off until you turn it on in the Windows app. If you turn it on, the backup can store the names you gave, the boxes around faces, and the face data used to suggest a match. The website lists names that are already in the backup. It does not name faces in the browser. You can remove that face data from the computer and from the backup.

A photo that disappears from your computer stays in the backup. FotoSafe does not delete a backup because a local file is gone. Throwing away a local copy in the Windows app puts that copy in the Recycle Bin.

Albums and sharing. Albums and slideshows you make are stored with your account. When you share one, FotoSafe stores the link, the email addresses you invite, the link’s settings, and when and how often it was opened, and it emails the people you invite. An invite-only link opens only for someone signed in with an invited email; a link set to “anyone with the link” opens without an account. Photos opened through a link have their location removed first. A photo someone adds to your shared album stays in their own backup.

Family. If you join or start a family, the other members can see your name, your email and how much storage you use, so the family can share its 2 TB. They cannot see your photos, only what you add to a family album. When you leave a family, what you added to its albums leaves with you.

Legacy contact. If you add Legacy, FotoSafe stores the names and emails of the contacts you choose, when you last used FotoSafe, and any requests for access. We email your contacts when you add them and if you stop using FotoSafe for the time you chose. If a contact asks and you do not cancel within 14 days, they can view, download and copy your photos for one year, with the details stored inside them, and, if you allow it, the names you gave people. They never get your password, the face data used for matching, or the ability to delete anything.

Photo files and previews are stored in object storage in Amsterdam, operated by our storage provider. Account records and sessions are stored with Cloudflare. The website and the API run on Cloudflare. Those providers process the data only so FotoSafe can keep the account and the backup.

FotoSafe does not sell your account or your photos, and it does not use them to train a model for anyone else.

The account, the photos, and the related notes stay until you delete them, except that photos above your plan’s limit are deleted 90 days after the account stops being paid for, as the Terms explain. Delete account removes the account, the sessions, and the photos in that backup, including face data stored for it. A file another account still needs is left in storage. Logs of the service record that an action happened, such as a sign-in or an upload, and are not a copy of the photo.

• Sign out from the account menu.
• Delete the account from the account menu. A password account confirms with the password. A Google-only account confirms by typing delete.
• Turn face naming off, and delete face data, in the Windows app.
• Skip Google and use an email and password instead.

FotoSafe is not directed at children under 16, and an account should not be created for a child.

If this policy changes, the new date will appear at the top of this page. The Terms explain the rules for using the service. Questions about this policy go to the operator of fotosafe.net.