Privacy policy.

Your RAW files, local previews, culling decisions, and ordinary desktop work stay on your machine. Cullibrate does not upload them as part of culling.

When you deliberately create a Client Gallery, Cullibrate uploads one privacy-scrubbed source JPEG and four responsive JPEG renditions per photo, plus the small Gallery settings needed to deliver them. You choose open-link or shared-password access, whether downloads are off, web-size, or original, and when to delete the Gallery.

When you choose to publish to Instagram, Cullibrate temporarily uploads the selected prepared JPEGs and sends them, with your caption and any alternative text, to Meta for publication. Instagram drafts remain on your computer.

Account data: your email, profile, plan and entitlement state, and authentication-provider identifiers. Cullibrate does not receive your Clerk password.

Website analytics: aggregated page views, performance metrics, error reports. We do not sell or share this data.

Desktop app: ordinary culling does not transmit file paths, filenames, previews, RAW data, or photo contents. A Gallery upload sends only the selected completed JPEG content, its four prepared JPEG renditions, opaque identifiers, and the small settings required to publish it.

Instagram publishing: the desktop keeps drafts, prepared JPEGs, captions, and alternative text locally. If you connect Instagram, our website stores an encrypted access token and account identifiers. A publish attempt temporarily stores selected JPEGs and publication details, including captions and alternative text, so it can deliver and reconcile the post.

Gallery service: Cloudflare holds photo, object, upload, progress, delivery, and recovery material. Convex holds only the account-owned Gallery control record and aggregate counts or byte totals; it does not store per-photo or per-object material.

Editing features: a reduced-size copy of the photos you use them with, plus the edits you make. Location, IPTC and XMP descriptive metadata and original file names are removed.

Partner programme: if you participate, we collect registered promotion post URLs and notes, plus payout contact details and the legal and tax evidence needed to administer payouts.

To deliver builds and notify you of new releases.

To answer your support emails.

To create, secure, deliver, manage, recover, and delete the Client Galleries you request.

To connect the Instagram account you choose, publish the photographs you select, and show the outcome of a publication attempt.

To provide the editing features you use.

To improve editing models.

To improve the website experience (loading speed, broken pages, accessibility).

Before upload, Cullibrate applies orientation, converts display output to sRGB, and re-encodes a source JPEG plus 640, 1280, 2560, and 3840 pixel JPEG renditions. This removes EXIF, GPS, camera-owner, embedded thumbnail, editing, and comment metadata from the uploaded copies.

Gallery media is stored in private Cloudflare R2 storage and coordinated by Cloudflare Workers and Durable Objects. Clients receive only capability-checked, short-lived access through the Gallery media service; storage buckets and object listings are never public.

Anyone with the link can open an open-link Gallery and can forward that link. Shared-password Galleries require the separately supplied password. Search-engine directives are not treated as access control.

Clients do not need an account. After open-link or shared-password admission, the browser receives a separate random session for that Gallery only. It expires within seven days, grants no access by itself, and is not linked to an email address, Cullibrate account, IP address, User-Agent, or device fingerprint. A client may add reversible Favorites and plain-text Comments with a chosen display name to photographs. The photographer sees bounded page-open and download-start estimates, Favorite counts, and Comment content, display name, photograph position, date, and moderation state, but no client session identifier; page opens are not unique-client counts. The client can permanently erase the current browser session and its page-open history, download-start history, Favorites, and Comments; reopening creates a new unrelated session.

When the photographer enables downloads, a client can download a privacy-scrubbed 2560-pixel web-size JPEG or privacy-scrubbed source JPEG according to the Gallery policy. If the photographer separately enables Download all, Cullibrate can asynchronously prepare a Gallery ZIP from those permitted copies. A completed ZIP is available for 24 hours; partial and expired packages are not exposed.

Unpublish, expiry, and trash revoke client access. Trash retains a seven-day owner recovery window; permanent deletion removes active media and retains encrypted recovery copies only until their deletion deadline.

Connecting Instagram gives Cullibrate permission to publish only when you request it. Cullibrate sends the selected JPEGs, caption, and any alternative text to Meta. Published posts are then held by Instagram under its own terms and privacy policy; disconnecting Cullibrate does not remove posts already published there.

Netlify temporarily stores prepared JPEGs for a publish attempt. Their access links expire within 24 hours, whether or not background cleanup has removed the stored copies. Cleanup also removes abandoned composition details. Publication receipt details are scrubbed after 30 days; a minimal record remains to prevent an old request from publishing again.

Disconnecting Instagram removes the active connection and attempts to revoke its access token. Drafts and prepared JPEGs stored on your computer remain there until you delete them in the app or remove your local app data.

Clerk provides account authentication and identity sessions.

Netlify hosts the website and authenticated Gallery management shell. It temporarily stores Instagram publishing photos and stores publication records, including the minimal duplicate-prevention record described above.

Meta receives the photographs, caption, and any alternative text you choose to publish to Instagram, and operates the connected account and published posts.

Convex stores account ownership and thin Gallery control records with aggregate counts and byte totals only.

Cloudflare Workers, Durable Objects, and private R2 buckets own Gallery photo objects, upload progress, admission, delivery, deletion, and delayed recovery cleanup, and other photo uploads and their records.

Our analytics and error-monitoring providers receive bounded product, performance, and error events. We exclude Gallery passwords, signed links, photo contents, filenames, and unnecessary client identity.

You can request a copy of your account data, ask us to delete it, correct it, or object to how we use it at any time.

Gallery clients can ask the photographer or contact Cullibrate about Gallery access or deletion without creating an account.

Email contact@cullibrate.com and we'll respond directly.

contact@cullibrate.com for any privacy question, request, or complaint.