Privacy policy

Last updated: 2026-10-09

kee.cam is a closed platform where small groups of people - a family, a circle of friends - share photographs and videos with each other. Nothing on it is public. This page explains what the platform stores about you, why, who can see it and for how long.

Who is responsible

kee.cam is run by its operator, who decides what the platform stores and is the person to contact about it (see the end of this page). The platform is hosted on rented servers, whose provider has technical access to them as any hosting company does, and processes data only to keep the service running.

Your account

An account is created only by the operator or when you accept an invitation. Nothing creates one silently - not even signing in with Google. The account holds:

your e-mail address, which is how you are invited, sign in and receive messages from the platform;
your name as shown to the people you share albums with, and an optional username you may sign in with instead of the address;
for each group, the nickname you go by there, if you choose one or accept one suggested in your invitation - the others in the group see it instead of your name, and the group's managers see both;
a one-way hash of your password, if you set one - the password itself is never stored and cannot be recovered from it;
your language preference, the colour theme you chose, if any, whether the account is active, and when you last signed in;
the albums you can open and your role on each, and the groups whose member list you are on, with your usual role there.

You can see and change your name, nicknames, language and password on your profile page, and the theme in the account menu at the top of every page.

What you share

Everything you put into an album is seen by the people on that album's list and by the group's managers and owner, and by nobody else:

the photographs and videos you upload, with their captions, and the albums you create;
the album stories written together;
the comments you write on photographs and videos, and your replies, shown under the name you go by in the group and the time you sent them;
the marks you place on items - a heart, a request to remove, and the record that you have seen them - which the others on the album see as counts, and its moderators see by name for removal requests;
who uploaded each item and when.

A photograph carries information inside the file: usually the moment it was taken and, if the camera recorded it, the place. The platform reads both and stores them with the item, so that albums can be sorted by date and located items shown on a map. The original file is kept exactly as you uploaded it, including that embedded information, and everybody who can open the album can download it. The smaller copies shown in the grid and the lightbox have all embedded information removed.

If you add locations from a GPS track, the track is kept on the server for half an hour so that you can preview and confirm, and is then deleted. Only the positions you confirm are stored, on the items you chose.

Photographs of other people

Most photographs show people. By uploading one you confirm that the people in it would not object to its being shared with the people of that album. Anybody who can open an album can mark an item in it with a removal request; the album's moderators see these requests and can delete the item. If you find yourself in a picture you would rather not be in, that is the way to say so - or ask the person who uploaded it.

Who can see what

Every album has its own list of people. Those on it see the album's media and story and the names of the others on the list.
A group's managers and owner see every album of the group, and also the e-mail addresses of the people on its albums, because they invite and remove people. Being on a group's member list opens no album by itself.
If you can open an album but not the one above it, you see the name of the one above, so that you can find your way, and nothing else of it. Somebody on none of a group's albums sees nothing of the group - not even that it exists.
An album's moderators, and the person who created it, can ask the group's managers to add an e-mail address to the album. The managers see the address, the role asked for, an optional note and who asked; whether that address has an account is not shown to the person asking.
When somebody moves items to another album, they are shown the names of the people who would newly see the items.
Platform administrators manage accounts, groups and memberships. They see names and e-mail addresses. They cannot open any group's albums, media or stories: an administrator account holds no membership and is on no album's list.
The hosting provider has technical access to the servers and to the data on them.
Nobody else. There are no public pages, no share links, and search engines are given nothing to index.

Records kept for security

To keep the platform safe, and to explain what happened when something goes wrong, it records events such as signing in and out, failed sign-in attempts, password changes, links to Google, changes to groups, memberships, albums and media, and requests it refused. Each record holds the time, the kind of event, the account or address it concerned, the IP address the request came from and the browser it identified itself as. These records are deleted automatically after 365 days. The last ten events about your own account are shown on your profile page.

To slow down automated abuse the platform also counts requests per IP address over short windows - at most an hour. It keeps a one-way hash of the address, not the address itself, and only for as long as the window lasts.

Cookies

The platform sets one cookie, named kc_session. It identifies your session while you are signed in and holds nothing but a random identifier; what belongs to the session - who you are, your language and theme choices and the token that protects forms - is kept on the server. A session ends after thirty minutes without activity, and in any case twelve hours after signing in, and its record is then deleted.

There are no advertising, analytics or tracking cookies, and no scripts from other companies are loaded into the pages.

The map

When you open the map view of an album, your browser fetches the map background from tile.openstreetmap.org. That service receives your IP address and the area of the map you are looking at, and its own privacy policy applies to that request. Nothing is fetched until you open the map, and no photograph or its position ever leaves kee.cam - the pins are drawn by your browser.

E-mail

The platform sends e-mail only when there is something to deliver: an invitation, a notice that an album was shared with you, a sign-in link you asked for, a password reset you asked for, and - to a group's managers - a request to add somebody to an album. Messages go out through the operator's mail server. The link in a message is stored only as a one-way hash, works once and expires.

If you switch it on - in your profile, or for one album on that album's page - the platform also sends you at most one message a day about new uploads. It names the groups and albums that received something and how many items each, with a link to each album, and nothing else: no photographs and no names of who uploaded them. It counts only what other people uploaded, only in albums you can open when it is sent, and leaves out anything you have already seen. To know where to start the next message, the platform keeps, for you, the day it last sent one and the upload time it reached. It is off until you switch it on, and every message says how to switch it off.

Signing in with Google

Google sign-in is optional. If you link your Google account, the platform stores the identifier Google assigned to your account and the e-mail address Google reports, so that it can recognise you next time. It never sees your Google password, and it asks Google for nothing beyond your identity. Google, in turn, learns that you signed in to kee.cam, under Google's own privacy policy. You can unlink Google on your profile page at any time, as long as another way to sign in remains.

How long things are kept

Your account exists until it is removed, which the operator does on request (see below).
Photographs, videos, albums and stories stay until you or a moderator delete them, or until the group is deleted. Deleting an item removes the original and every copy from the platform's storage.
A comment stays until you delete it - which you can do until somebody replies - or until a moderator deletes it, which removes the replies beneath it too. Deleting an item, or the group, deletes its comments. The security record of a deleted comment says who deleted it and when, never what it said.
Security records are kept for 365 days, sessions end as described above, and sign-in and reset links expire within hours whether or not they were used.
An invitation that was never accepted expires, and the group's managers see it as expired until the group is deleted.
A request to add somebody to an album is kept, once decided, until the album is deleted.
Archives built for a download and GPS tracks uploaded for geotagging are temporary files and are deleted within an hour.
Backups the hosting provider keeps of the servers are outside the platform's reach and expire on that provider's schedule.

How your data is protected

Every connection is encrypted. Passwords and every link sent by e-mail are stored only as one-way hashes. Original files are kept outside the web server's reach and handed out only after your permission has been checked; the smaller copies are published under long random names that cannot be guessed or enumerated. Every change to a group or an item is recorded together with who made it.

Why the platform may do this

The platform processes your data because you asked to take part: you accepted an invitation to albums, or the operator created your account at your request, and sharing media with the people of those albums is the service you asked for. The security records and the rate limits serve the legitimate interest of keeping a private platform private. Signing in with Google, and adding a location to a photograph, happen only when you choose them.

Your rights

You can see and change your own account details on your profile page. For anything else, contact the operator, who will:

tell you what the platform holds about you and give you a copy;
correct what is wrong;
remove your account, together with the photographs and videos you uploaded and the comments you wrote, or take you off a group's albums while leaving the account;
explain anything on this page that is unclear.

If you live in the European Union, you also have the right to complain to your national data-protection authority.

Changes to this page

This page is updated when the platform changes in a way that matters to it. The date at the top says when that last happened.

Contact

Questions and requests about your data go to the operator of kee.cam. The person who invited you, or your group's manager, can put you in touch.