Privacy Policy

1. Introduction & Scope

PhotosByBugs, a division of the ByBugs family ("PhotosByBugs," "we," "us," or "our"), is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect information when you access or use our platform located at https://www.photosbybugs.com, including all associated services, features, and applications (collectively, the "Platform").

This Privacy Policy is incorporated into and forms part of our Terms of Service. By creating an account, signing in, or using the Platform, you consent to the collection, use, and processing of your information as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Platform.

We encourage you to read this Privacy Policy in full, but here is a brief overview of key points:

• We access only a dedicated "PhotosByBugs" folder in your Google Drive - never your other files;
• Payment processing is handled entirely by Stripe - we do not store your credit card or bank account details;
• We collect only the information necessary to operate the Platform and provide you with our services;
• We will never sell your personal information to third parties for marketing purposes.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information from Third Parties

• Google: When you sign in via Google OAuth, we receive your name, email address, and profile photo from Google. We also access file metadata within your designated "PhotosByBugs" Google Drive folder.
• Stripe: We receive transaction confirmations, payment status, and limited transaction identifiers from Stripe. We do not receive or store your full credit card number, bank account details, or other sensitive payment credentials.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Core Platform Operations

• Creating and managing your account;
• Authenticating your identity and maintaining session security;
• Facilitating Content upload, management, sharing, and sales;
• Processing transactions and purchases through Stripe;
• Generating QR codes for your Content and folders;
• Managing folder sharing and email invitations;
• Operating the Marketplace and Listings features.

3.2 Communication

• Sending service-related notifications (account confirmations, purchase receipts, sharing invitations);
• Responding to your inquiries and support requests;
• Notifying you of changes to our Terms of Service or Privacy Policy.

3.3 Platform Improvement & Analytics

• Analyzing usage patterns to improve Platform features and user experience;
• Monitoring Platform performance and diagnosing technical issues;
• Generating aggregated, anonymized analytics and reports.

3.4 Legal & Safety

• Enforcing our Terms of Service and Content Standards;
• Detecting, preventing, and responding to fraud, abuse, security incidents, and illegal activity;
• Complying with applicable laws, regulations, legal processes, and governmental requests;
• Establishing, exercising, or defending legal claims.

4. Google Drive Access & Data Handling

4.1 What We Access

• Dedicated Folder Only: We create and access a single folder named "PhotosByBugs" in your Google Drive. We never access, read, browse, index, or interact with any files or folders outside of this dedicated folder.
• File Operations: Within the "PhotosByBugs" folder, we read file metadata (name, type, size, creation date), generate thumbnails and previews for display, and manage subfolders you create through the Platform.
• OAuth Tokens: We store encrypted Google OAuth access tokens and refresh tokens to maintain your authenticated connection to Google Drive. These tokens are encrypted and stored securely in our database.

4.2 What We Do NOT Do

• We do NOT access your Google Drive files outside the "PhotosByBugs" folder;
• We do NOT read your Gmail, Google Calendar, Google Contacts, or any other Google service;
• We do NOT share your Google Drive data with third parties for advertising or marketing purposes;
• We do NOT sell or monetize your Google account data in any way.

4.3 Revoking Google Access

You may revoke PhotosByBugs' access to your Google account at any time by visiting your Google Account permissions page and removing PhotosByBugs. Note that revoking Google access will prevent the Platform from functioning correctly and may result in loss of access to your Content on the Platform.

4.4 Google's Privacy Policy

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. For details about how Google handles your data, please refer to Google's Privacy Policy.

5. Payment Data & Stripe

5.1 What Stripe Handles

All payment processing is conducted by Stripe, Inc. When you make a purchase or receive a payout, your payment details (credit card number, billing address, bank account information) are submitted directly to Stripe and are never transmitted to, processed by, or stored on PhotosByBugs servers.

5.2 What We Store

We store only the following transaction-related information:

• Stripe payment/session IDs (for record-keeping and dispute resolution);
• Transaction amounts;
• Purchase timestamps;
• Buyer and Seller identifiers (linking transactions to Platform accounts).

5.3 Stripe's Privacy Policy

For information about how Stripe collects, uses, and protects your payment data, please review Stripe's Privacy Policy.

6. Cookies & Tracking Technologies

6.1 Session Cookies

We use session cookies to maintain your authenticated session while you are logged in to the Platform. These cookies are essential for the Platform to function and cannot be disabled. Session cookies are stored in our SQLite database and expire after 30 days of inactivity.

6.2 What We Do NOT Use

We do NOT currently use:

• Third-party advertising cookies;
• Cross-site tracking pixels or beacons;
• Social media tracking widgets;
• Analytics cookies from third-party providers (e.g., Google Analytics).

If we introduce any of these technologies in the future, we will update this Privacy Policy and, where required by law, obtain your consent before deploying them.

7. Information Sharing & Disclosure

7.1 We Do NOT Sell Your Data

PhotosByBugs does not sell, rent, or trade your personal information to third parties for marketing, advertising, or any other commercial purpose.

7.2 When We Share Information

We may share your information in the following limited circumstances:

• With Other Users: Your public profile information (username, display name, avatar, bio) is visible to other Platform users. Content you publish is visible to users who access it through purchase, sharing, or public browsing. Contact information you choose to make public is visible on your profile and comp card.
• With Service Providers: We share information with third-party service providers who assist us in operating the Platform, including Google (Drive storage), Stripe (payment processing), and Railway (hosting). These providers are contractually obligated to use your information solely for the purpose of providing services to us.
• For Legal Compliance: We may disclose your information if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that such disclosure is necessary to: (a) comply with applicable law; (b) protect the rights, property, or safety of PhotosByBugs, our users, or the public; (c) detect, prevent, or address fraud, security, or technical issues; or (d) respond to an emergency involving danger of death or serious physical injury.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.
• With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.

8. Data Storage & Security

8.1 Where We Store Data

Platform data is stored on servers hosted by Railway in the United States. Your Content files are stored in your own Google Drive account. Payment data is stored on Stripe's secure servers.

8.2 Security Measures

We implement reasonable administrative, technical, and physical safeguards to protect your information, including:

• OAuth 2.0 authentication (no passwords stored on our servers);
• Encrypted storage of Google OAuth tokens;
• Secure, httpOnly session cookies in production;
• Database stored on an encrypted Railway volume;
• HTTPS encryption for all data in transit;
• Access controls limiting data access to authorized personnel only.

8.3 No Guarantee of Absolute Security

While we take reasonable steps to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee the absolute security of your information. You are responsible for maintaining the security of your Google account credentials and for any activity that occurs through your account.

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

• Account Data: Retained for the duration of your account. Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes.
• Transaction Records: Retained for a minimum of seven (7) years for tax, accounting, and legal compliance purposes.
• Consent Records: Retained indefinitely as evidence of consent for legal compliance.
• Activity Logs: Retained for twelve (12) months for security and analytics purposes, then automatically deleted or anonymized.
• Content: Your Content resides in your own Google Drive and is under your control. Content that has been sold, shared, or downloaded by other users prior to account deletion cannot be recalled or deleted from those users' access.

10. Children's Privacy

We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a Minor has created an account or submitted personal information to us, we will take immediate steps to:

• Terminate the Minor's account;
• Delete all personal information associated with that account;
• Remove any Content uploaded by the Minor.

If you are a parent or legal guardian and believe that your child has created an account or submitted personal information on the Platform without your consent, please contact us immediately at photosbybugs@gmail.com and we will promptly delete the information.

Regarding Content depicting Minors: Content uploaded by adult Creators may depict Minors (e.g., family photos, event photography). The upload, sharing, and sale of such Content is governed by the Model Release and Parental/Guardian Consent provisions set forth in Sections 4 and 5 of our Terms of Service. Creators who upload Content depicting Minors represent and warrant that they have obtained all necessary parental/guardian consents. Content depicting Minors in any sexual, exploitative, or inappropriate manner is absolutely prohibited and will be reported to the authorities.

11. Your Rights & Choices

11.1 Access & Correction

You may access and update your personal information at any time through your account settings on the Platform. This includes your display name, bio, contact information, and privacy settings.

11.2 Account Deletion

You may request deletion of your account by contacting us at photosbybugs@gmail.com. Upon receiving your request, we will delete your account and associated personal data within 30 days, subject to our data retention requirements described in Section 9.

11.3 Google Drive Access

You may revoke our access to your Google Drive at any time through your Google Account permissions.

11.4 Privacy Settings

The Platform provides privacy controls that allow you to manage the visibility of your profile and Content:

• Public Profile: Controls whether your profile is visible to non-logged-in visitors;
• Internal Profile: Controls whether your profile is visible to logged-in Platform users;
• Public Images: Controls whether your Content appears in public feeds and search results.

11.5 Communication Preferences

We send only essential service-related communications. We do not currently send marketing emails. If we introduce marketing communications in the future, you will have the ability to opt out.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting the information, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. If we ever change this practice, we will provide a "Do Not Sell My Personal Information" link on our website.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your California privacy rights, please contact us at photosbybugs@gmail.com with the subject line "CCPA Request." We will verify your identity before processing your request.

13. International Users & Data Transfers

The Platform is operated from the United States. If you are accessing the Platform from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.

By using the Platform, you consent to the transfer of your information to the United States and the processing of your information in accordance with this Privacy Policy. If you do not consent to this transfer, please do not use the Platform.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the "Effective Date" at the top of this page;
• Update the version number;
• Require re-consent from all Users upon their next login, where the changes are material.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the posting of changes constitutes your acceptance of such changes.

15. Photographs & Likeness

PhotosByBugs is a platform where photographers upload, share, and sell photographs. If your likeness appears in photographs uploaded by another user, that content is owned by the photographer who created it.

PhotosByBugs does not independently collect, store, or process biometric data or facial recognition data. Photographs are stored in the uploading photographer’s own Google Drive account and are served through our platform for viewing and purchase.

We do not sell or share photographs with third parties — all transactions occur between the photographer (seller) and the buyer through Stripe.

If you believe your likeness has been used without appropriate authorization, you may request removal by contacting support@photosbybugs.com. Removal requests are processed within 48 hours.

16. Referral Tracking & Cookies

When a user shares a folder link containing a referral parameter (?ref=), we store a referral identifier in the recipient’s browser session and a 30-day cookie. This cookie is used solely to attribute purchases to the referring user for commission purposes.

The cookie contains only a numeric user ID and is not used for advertising, tracking across sites, or any purpose other than referral attribution. Users may clear this cookie at any time through their browser settings.

17. Payment Data

PhotosByBugs does not store credit card numbers, bank account details, or other sensitive financial information. All payment processing is handled by Stripe, Inc.

When a user connects a Stripe account for payouts, we store only the Stripe account ID and connection status — not the underlying bank or card information. Stripe’s privacy policy governs the handling of all financial data.

18. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

We will respond to your inquiry within thirty (30) days.