Privacy Policy

Your photos stay in your own Google Drive or Dropbox — protected by Google's and Dropbox's own security. When a client opens a gallery, the images load straight from Google or Dropbox to their browser. You can password-protect any gallery so only the clients you share the password with can open it. We don't sell your data and we don't run ad trackers.

Filolio is designed so your photos are never copied to our servers — they stay protected by Google's or Dropbox's security. Account data is sent over HTTPS, and we keep the amount of data we store about you to a minimum.

Filolio doesn't host, copy, or back up your media. There's no second copy of your photos on our servers — nothing for us to leak, lose, or have breached.

We only ask for the access needed to show the photos you pick for your clients, and (for Dropbox) to upload new files into your own account when you choose to. We only ever touch the files you select — never the rest of your Drive or Dropbox.

For a selected photo to appear in your gallery, we set it to be reachable by an unlisted link — a long, unguessable web address. Filolio never publishes or shares that address; it's only used to load the image into the gallery you control, and you can revoke it any time by removing the photo or disconnecting.

Your refresh token is encrypted at rest. You can disconnect at any time from your account page — that immediately revokes the token with the provider and deletes it from our database. Filolio never stores, copies, or proxies your files; images and videos load directly from the provider's CDN to your viewer's browser. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

To run your account we store your email, your gallery settings (title, folder link, optional photographer name and links), and basic usage events so you can see whether galleries are being viewed. We may briefly process visitor IPs to prevent abuse.

We use a small number of strictly necessary cookies to keep you logged in and to remember when a visitor has unlocked a password-protected gallery. No third-party advertising or tracking cookies.

To run the service, we rely on a cloud hosting and database provider, a payment processor (for paid plans), and the cloud storage provider you connect (Google Drive or Dropbox). These providers process data only as needed to operate Filolio.

We may process your data outside your country, including in the United States, through the providers above.

You can request access to, correction of, or deletion of your data at any time. Contact support and we'll respond as required by applicable law.

We keep your account and gallery data until you delete it. Delete galleries any time from your dashboard; to delete your account, contact support.

We may update this policy. We'll change the date at the top when we do.

Questions? Contact support.