Privacy policy

• Your account. Your email address, and your password stored only as a one-way hash if you chose one. If you sign in with a code we email you, the code is kept for five minutes or until it is used, whichever comes first. If you sign in with Google, we receive your name, email address, profile picture and Google account identifier instead of a password.
• Your profile. The first and last name and the username you give when you first sign in, and a profile picture if you add one — redrawn in your browser as a small square before it is uploaded, so nothing from the original file, location included, reaches us. Whether you keep a library of your own or only view what a photographer shares with you.
• Sign-in activity. When you signed in and were last active, and for each session the IP address and browser it came from. When a sign-in code is asked for, the IP address that asked and how many times, for an hour, so nobody can use Peak to flood an inbox.
• Your photographs and videos. The originals exactly as you upload them, including the metadata inside the file — camera settings and, if your camera recorded it, the GPS location where the photograph was taken. We also keep a smaller preview of each one, which carries no metadata: for a video, a still frame from it and a 720p copy to play, both made by your browser as you upload it. Of a video’s own metadata Peak reads only its length and when it was recorded; the rest, location included, stays in the original.
• What you add. Ratings, picks and rejects, tags, captions and collections.
• Rooms. When a photographer shares photographs with you in a room: the rooms you enter, when, how often you come back, the stars, picks and rejects you give, the comments you write and the photographs they mention, and what you download. When you share a room: its settings, the addresses you invite, and a copy of every photograph in it.
• What Peak works out. For each photograph — and for a video, from its still frame — its dominant colours, a short fingerprint used to spot duplicates, and a numerical description of what it shows, used to find similar pictures. These are computed in your browser or on our own server; no photograph is sent to an AI provider, and none is used to train a model.
• Your plan. If you pay for one: the identifiers Stripe gives your customer record and your subscription, which plan and how much storage you pay for, monthly or yearly, in which currency, its status, and when the period paid for ends or renews. Your card, billing address and VAT number are kept by Stripe, not by us — see Paying for a plan below.
• Messages you send us through the feedback button: the text, its category, the page you wrote it from, and your name and email so we can reply.
• How the site is used. Pages visited, clicks, errors, and recordings of sessions in the app — see Analytics below.

A room is a selection of photographs a photographer shares with the people they invite, or with anybody who has its link and an account.

• What the photographer sees. Your username, your name and your profile picture; your email address; when you entered the room, when you were last there and how many times you came; which photographs you picked, rejected and rated, and the stars you gave; your comments; and which files you downloaded and whether you downloaded the whole room. Not which photographs you looked at.
• What the others in the room see. That depends on the room, and the photographer sets it: in a private room, nothing of you; in a conversation, your comments with your username and picture; in a collaborative room, your comments and your picks and stars too. Never your email address. A room can be made more private at any time, but never more open once a client has rated or commented in it.
• The photographs in it. A room keeps its own copy of every photograph, counted in its photographer’s storage. It is deleted with the room, or a week after the room expires. A photograph deleted from the library stays in the rooms that hold it until then.
• Its link. Pasted into a message, the link of a room open to anybody who has it shows a preview — the room’s name, its photographer’s name and its cover photograph, at preview size and without its location — to whoever can see that message, account or not. The link of a room by invitation shows only that it is a room on Peak. Neither is indexed by search engines.
• Email. An invitation carries a link that signs the invited address in, for seven days, once. A client who has not sent their selection is reminded by email once, two days before the room closes, and told when the photographer reopens it. The photographer is told by email when somebody enters a room for the first time or writes in it — at most one email an hour for each room — and at once when a client sends their selection.

Paid plans are paid through Stripe, which processes payments for us. The first time you open checkout, we send Stripe your account’s email address and name, to make you a customer record there. At checkout you give Stripe your card details, your billing address and, for a business, your VAT number; Stripe works out the VAT from them and keeps them, and it holds your invoices. We never see or store your card number.

Prices are in US dollars in the United States and in euros elsewhere. To know which to show you, our pages read the country your connection comes from, as Vercel works it out from your IP address; it is used for that page and kept nowhere.

From Stripe we keep only what tells Peak what you are entitled to — see Your plan above. Stripe also acts as a controller of the payment data it needs for its own legal duties, such as preventing fraud and keeping financial records; its privacy policy says how.

If you choose to sign in with Google, Peak asks Google only for your basic profile: name, email address and profile picture. We use them to create your account and sign you in, and for nothing else. We do not read your Gmail, Drive, Photos or any other Google data, we do not use Google data for advertising, and we do not sell it or pass it on beyond the providers listed below that run Peak.

Peak’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Peak from your Google account at any time from your Google account’s security settings. To delete the Peak account itself, write to us (see Deleting your data).

• To run Peak: store your photographs and videos, show them back to you, search them and keep your edits.
• To bill a paid plan, and to apply the limits of the plan you are on.
• To send you email about your account — the code that signs you in, confirming your address, resetting your password when you ask, and telling you if somebody tries to register it again. No newsletters, no marketing.
• To keep Peak working and secure, and to answer you when you write in. When you report a problem, Peak’s administrator can look at your account as you see it — signed in as you, for at most an hour — to find what is wrong.
• To understand how Peak is used, so we know what to fix and build next.

Under the GDPR, we rely on the contract between us (running the service you signed up for), and on our legitimate interest in keeping Peak secure and improving it.

We use PostHog, hosted in the EU, to measure how Peak is used and to catch errors. It records pages visited and clicks, and can record sessions in the app — a replay of where you clicked and scrolled, in which every piece of text is masked and no photograph or video is shown. The events we send ourselves carry counts and durations only, never anything taken from a photograph: no file names, captions, tags, colours or location — and nothing of a room but counts and settings: never its name, a comment or who is in it.

These providers run parts of Peak for us and process data only on our instructions:

• Cloudflare R2 (EU jurisdiction) — stores your originals and previews.
• Cloudflare Workers — builds a room’s “Download all” zip as it is downloaded, reading the files straight from storage; nothing is kept.
• Convex — the database: your account, photo details and everything Peak works out.
• Vercel — serves the website.
• Fly.io (Paris) — runs our own visual indexing, which reads each photograph — or a video’s still frame — through a short-lived link and keeps no copy.
• PostHog (EU) — analytics, session recordings and error reports.
• Resend — sends our email.
• Stripe — takes payment for paid plans, works out VAT and issues invoices; it receives your email address and name, and the card, billing address and VAT number you enter at checkout.
• Google — only if you sign in with it.
• Hugging Face — if you index your library from your browser, it downloads the model from Hugging Face, which sees your IP address. No photograph goes to it.

Some of these companies are based in the United States. Where data leaves the EU, the transfer is covered by the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

We do not sell your data, show you ads, or share your photographs with anyone. We would disclose data only if the law required it.

• Everything between your browser, Peak and the providers above travels encrypted (HTTPS). Data reaches a provider only through its own interface, over those encrypted connections.
• Your files are never public. Each one is reached through a signed link that expires within twelve hours, made for somebody allowed to see it; an upload goes through a link that works for an hour. Cloudflare encrypts every file it stores.
• Every request is checked on our server against who is signed in — hiding a button is never the only lock. A room is found only by a long random link, and only by the people its photographer let in.
• Passwords are kept only as a one-way hash, sign-in codes expire after five minutes, and the number of codes an address on the internet can ask for is limited.
• Only Peak’s administrator can see across accounts, and signs in as you only to look into a problem, for at most an hour.
• If a breach ever puts your data at risk, we will tell you and the CNIL, as the GDPR requires.

When you download an original from your library, you get the file exactly as you uploaded it — GPS location included. That is deliberate: it is your file. Bear it in mind before you pass one on.

A room delivers the same: if its photographer allows downloads, the people in it get the original, location included, unless the photographer switched on Remove location. Then the GPS and place names are taken out of every file the room delivers — without touching the picture, and keeping the copyright, camera and date — along with any Content Credentials, which can repeat the location; and a file whose location cannot be removed (HEIC, camera raw, any video) is not downloadable from that room at all. Without downloads, people in a room only ever receive a small preview, which carries no metadata — for a video, a 720p copy your browser makes as you upload it, with none of the original’s metadata, location included. That copy is what people in the room watch, whatever the download setting.

Peak sets cookies that keep you signed in; without them the app cannot work. PostHog stores an identifier in a cookie and in your browser’s storage to recognise return visits.

Your account and photographs are kept for as long as you have an account. Deleting the account cancels any plan on it and removes what we keep about the plan; the invoices themselves stay with Stripe, because French accounting law requires us to keep them for ten years. Deleting a photograph removes the original and its preview from storage straight away — except the copies in rooms you shared, which go with the room, or a week after it expires. Messages you send us are kept while they are useful for answering you and improving Peak.

Write to contact@sorbey.co from your account’s address to have your account, photographs and everything derived from them deleted; we will do it within 30 days. You can also ask for a copy of your data, have it corrected, object to how we use it, or ask us to restrict it.

If you are unhappy with our answer, you can complain to your data protection authority — in France, the CNIL.

Peak is not meant for anyone under 16, and we do not knowingly hold their data.

When this policy changes, the date at the top changes with it. If a change matters to how your data is used, we will tell you by email before it applies. See also the terms of service.