Privacy Policy

The controller of your personal data is Sparing Interactive Adrian Holota, Al. Jerozolimskie 47/8, 00-697 Warszawa, Poland, NIP 7532358295 (“we”, “us”). For anything about your data, write to hello@theedit.one or to the address above. We have not appointed a data protection officer.

• Account data: your email address, your account ID, the name you choose to show with your albums (if any), and when you signed up and signed in.
• Your content: resized copies of the photographs you upload, and the titles, captions, texts, layouts, colours and settings of your albums. We never store your original files.
• Photo details: when you upload a photograph, your browser reads its technical details — camera, lens, film simulation, exposure, focal length and the date it was taken — so you can show them in your album. We do not read or store location (GPS) data, and the copies we store do not carry the original file’s embedded metadata.
• Sharing data: whether share links for your albums and library are on, and the random tokens that make up those links; and the email addresses of the people you invite to read an album, which we use only to send them the invitation and to let them open it.
• Technical data: IP address, browser and device information, the pages and resources requested and when, and error and security logs, recorded by our hosting providers when you or anyone else uses the service, including people viewing a shared album.
• Reader counts: to count the different people who read a shared or public album each day, and credit its owner for them, we keep the reader’s account ID or, for readers who aren’t signed in, a one-way code made from their IP address and browser that changes every day. These are deleted after two days; only the running total stays.
• Usage statistics: which pages are visited, from which referring site, country, browser, operating system and device type, and which buttons and links are used, counted without cookies and without identifying you.
• Session recordings, only if you accept cookies: how you move through the site — pages, clicks, taps, scrolling and mouse movement, screen size and device — linked to your account’s internal ID when you are signed in (never to your email). Your photographs, album texts, names and email addresses are hidden from these recordings, and none are made on share links.
• Conversations with the editor’s assistant: what you write to the assistant, its replies, the options it shows you and the changes it makes to your album, linked to your account and the album.
• Correspondence: what you send us by email — questions, complaints, reports of content — and our replies.
• Reports and moderation: if you report content through our form, the link, your reason and explanation, and the name and email address you give; and, for any account or album we act on, a record of what we decided and why.

You give us account data and content yourself. Providing your email address is necessary to create an account and sign in; everything else is up to you. Technical data and usage statistics are collected automatically; session recordings only with your consent.

• To provide the service — your account, signing in, storing and showing your albums, share links, and emails about the service such as sign-in links and notices of changes to our terms: performance of our agreement with you (Article 6(1)(b) GDPR).
• To help you get started and to hear from you — an occasional note from us, such as a single email if you have signed in but not yet started an album, asking whether everything is clear, or one after your first album, asking what you think of the service. You can stop these with one click at the foot of each email: our legitimate interest in helping you use the service and in improving it (Article 6(1)(f) GDPR).
• To keep the service secure and working — preventing abuse and attacks, fixing errors, keeping logs and backups: our legitimate interest in a secure, reliable service (Article 6(1)(f) GDPR).
• To handle your messages, complaints and reports of content, and to moderate content: our agreement with you, our legal obligations under consumer law and the EU Digital Services Act, and our legitimate interest in answering people who write to us (Article 6(1)(b), (c) and (f) GDPR).
• To run the editor’s assistant and learn from it — answering your messages and making the changes you ask for: performance of our agreement with you (Article 6(1)(b) GDPR); keeping and reading the conversations to see what people need and what the service lacks: our legitimate interest in improving it (Article 6(1)(f) GDPR).
• To understand how the service is used through cookieless usage statistics, so we can improve it: our legitimate interest in knowing which parts of the service people use (Article 6(1)(f) GDPR).
• To see where the service is hard to use through session recordings and the usage linked to your account: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time under “Cookie settings”, without affecting what was done before.
• To comply with the law — for example responding to lawful requests from authorities, and, once paid plans exist, accounting and tax: our legal obligations (Article 6(1)(c) GDPR).
• To establish, exercise or defend legal claims: our legitimate interest (Article 6(1)(f) GDPR).

We do not use your data for marketing, advertising, profiling or automated decision-making, and we do not use your photographs to train machine-learning models. Apart from session recordings, we do not rely on consent for any of the processing above.

We look at your account or content only when we need to: to handle a report or a suspected breach of our Terms, to help when you ask us to, to keep the service secure, or when the law requires it. For these purposes our administrators can open any album, including one you have not shared, read-only. We also read conversations with the editor’s assistant, to improve the service.

Your photographs and texts may show or mention other people. We store and display that content on your instructions, as part of the service you use. Where data protection law applies to what you do with it — in particular when you share it — you are responsible for having a legal basis for it, such as the consent of the people shown. If you appear in content on The Edit and object to it, write to hello@theedit.one and we will look into it as described in our Terms.

We do not sell or rent your data. We share it only with providers who process it on our behalf and on our instructions, under data processing agreements:

• Supabase (Supabase, Inc.) — database, file storage, sign-in and sign-in emails. Your account and content are stored in the European Union (Ireland).
• Resend (Resend, Inc., United States) — delivery of our emails, including sign-in links. It receives your email address and the content of each message, and keeps a contact entry with your email address and whether you have signed in and started an album, which decides when a note to help you get started is due.
• Vercel (Vercel, Inc.) — hosting of the application, with servers in the European Union (Frankfurt) and a global network that delivers pages close to the visitor.
• Adobe Fonts (Adobe) — the typefaces are loaded from Adobe’s servers, which receive your IP address, browser information and the address of the page, in order to deliver the fonts and count their use for licensing. Adobe does not set cookies for this.
• Vercel Web Analytics (Vercel, Inc.) — the usage statistics. It sets no cookies; visits are told apart by a short-lived hash that is discarded after 24 hours, and the random token of a share link is removed from the address before it is sent.
• PostHog (PostHog Inc., United States) — the usage statistics without cookies and, only after you accept cookies, session recordings, with your content hidden as described above. Data is stored in the European Union (Frankfurt), and the token of a share link is removed before anything is sent.
• Anthropic (Anthropic, PBC, United States) — only when you choose “Develop with AI” for an album: the frames of that roll, their technical details and the words you give the editor are sent to Anthropic’s Claude, which proposes the layout, captions and text; and when you write to the editor’s assistant: your messages and a written description of the album (its texts, layouts, colours, frame numbers and technical details, not the photographs). Anthropic does not use them to train its models and keeps them only for a limited time, for safety and abuse monitoring, as set out in its commercial terms.
• Other providers we may use for IT support, legal or accounting services, within what each of them needs.

The people you send a share link to, or invite to an album, can see the album or library it opens, including the name you show with your albums. We may also disclose data to courts, the police or other authorities when the law requires it, and to a successor if the service is transferred, in which case we will tell you in advance.

Our providers are companies based in the United States, and may access or process some data there, for example for support, security or delivery through their global networks. Such transfers are based on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, or on the standard contractual clauses approved by the European Commission, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards at hello@theedit.one.

• Account data and content — for as long as you have an account. Content you delete is removed from the service straight away. When your account is deleted, everything in it is deleted within 30 days.
• Conversations with the editor’s assistant — for as long as you have an account; they are deleted with it.
• Backups — deleted data may remain in encrypted backups for up to a further 30 days, until they are overwritten.
• Technical logs — for a limited time set by our hosting providers, no longer than 12 months.
• Usage statistics — as aggregate counts that do not identify you. Session recordings — up to 12 months.
• Correspondence, complaints, reports and moderation decisions — for as long as needed to handle them, and then until the end of the limitation period for related claims.
• Data we must keep by law, or need for a legal claim, is kept for as long as that obligation or claim requires.

Under the GDPR you have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we process it;
• receive the data you gave us in a portable format;
• object, on grounds relating to your particular situation, to processing based on our legitimate interests.

To use any of these rights, write to hello@theedit.one from the email address of your account. We will reply within one month; we may ask you to confirm your identity first. You can change your name and your albums yourself in the service at any time.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa — or with the authority in the EU country where you live or work.

We use only what the service needs to work. When you sign in, we set cookies that keep you signed in and protect your session; without them, signing in is not possible. Your browser’s local storage remembers display preferences, such as whether albums are shown one page at a time. If you arrive through a friend’s invitation link, a cookie (“edit_ref”, kept for up to 30 days) remembers whose link it was, so you both get the credits it promises when you join. This is strictly necessary storage, so it does not require your consent.

Our usage statistics (Vercel Web Analytics and PostHog) work without cookies. Only if you accept them in the banner, PostHog sets its own cookie and local storage (named “ph_…”, kept for up to a year) to record how the site is used; local storage remembers your answer. You can change your mind at any time with Cookie settings — if you decline, recording stops, its cookie is cleared and counting carries on without cookies. We use no advertising cookies.

You can delete cookies and local storage in your browser’s settings at any time; you will then be signed out.

Your albums and photographs are visible only to you unless you turn on a share link — and to our administrators in the cases described in section 3. Access is enforced in the database for every request, files are kept in private storage and served through short-lived signed links, and all traffic is encrypted. No system is perfectly secure, though; keep your email account safe, because it is the key to your The Edit account.

The Edit is not meant for anyone under 16, and we do not knowingly collect their data. If you believe a child under 16 has given us personal data, write to hello@theedit.one and we will delete it.

We may update this policy when the service, our providers or the law change. We will publish the new version here with its effective date, and tell you by email before any significant change takes effect. This policy is also available in Polish.