Privacy — Gallery Earth

Gallery Earth ("Gallery Earth," "we," "us," or "our") provides a curated photography experience for televisions, web browsers, and companion devices. This policy explains what personal information we collect, why, how long we keep it, who we share it with, and the choices and rights you have. It applies to galleryearth.tv, the Gallery Earth apps for TV and web, and our companion sign-in pages.

Who we are

Gallery Earth is the data controller for the information described in this policy. You can reach us at support@galleryearth.tv for any privacy question or request.

Information we collect

Account information. If you sign in, we collect your name, email address, and profile picture as provided by your chosen sign-in method: Google, Apple, Facebook, or a one-time "magic link" sent to your email address. We do not collect or store passwords — Gallery Earth does not offer traditional email-and-password accounts.
Device and session information. Every installation of the Gallery Earth app (TV or web) creates an anonymous device identifier and session token so the app can load your gallery without requiring sign-in. If you sign in, that device is linked to your account. We also record device platform (e.g. Android TV, Apple TV, web), app version, and approximate timestamps of use.
Approximate location. We may infer a coarse, city-or-region-level location from your IP address at the time of a request (via Cloudflare's network) for security and abuse-prevention purposes. We do not collect precise GPS location.
Support and correspondence. If you contact support@galleryearth.tv or join our waitlist, we collect what you send us: your email address, message, preferred TV platforms, marketing email preferences, and any related correspondence.
Usage information. Basic technical logs (e.g. which API endpoints were called, response status, timestamps) generated by our Cloudflare-hosted infrastructure for reliability, security, and abuse prevention.

Sources of information

We receive information directly from you (sign-up, support requests), automatically from your device and our infrastructure, and from third-party identity providers when you choose to sign in with them:

Google — name, email address, and profile picture, if you sign in with Google.
Apple — name and email address (or Apple's private relay email address, at your choice) if you sign in with Sign In with Apple.
Facebook — name, email address, and profile picture, if you sign in with Facebook Login.

We only receive the specific profile fields these providers make available for sign-in; we do not receive your password or your activity on those platforms.

How we use information

Create and maintain your account, and keep you signed in across sessions;
Operate the device-pairing sign-in flow between your TV and your phone or computer;
Send transactional emails, such as magic-link sign-in emails and account notices, and product updates you requested;
Respond to support requests and waitlist sign-ups;
Detect, investigate, and prevent fraud, abuse, and security incidents;
Maintain and improve the reliability and performance of the service; and
Comply with legal obligations.

Legal basis for processing (EEA/UK users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (providing the account and sign-in you request), legitimate interests (security, fraud prevention, and service reliability), and consent (where you affirmatively opt in, such as marketing email or completing a sign-in flow). You may withdraw consent at any time by contacting support@galleryearth.tv.

Third parties and subprocessors

We do not sell your personal information. We share information with the following categories of service providers, who process it on our behalf or as independent controllers for their own sign-in service, strictly to provide the Gallery Earth service:

Google, Apple, and Facebook — as identity providers, when you choose to sign in using one of these services (acting as independent controllers for their own authentication service).
Resend — our transactional email provider, used to deliver magic-link sign-in emails and account notices, sent from no-reply@support.galleryearth.tv.
Loops — our email provider for waitlist and product updates you've requested.
Cloudflare — our hosting, database, storage, and network infrastructure provider for all Gallery Earth services.

We may also disclose information if required by law, to protect the rights and safety of Gallery Earth and its users, or in connection with a merger, acquisition, or sale of assets, subject to this policy.

International data transfers

Gallery Earth's infrastructure, and the third parties listed above, may process and store information outside your country of residence, including in the United States. Where we transfer personal information out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, as implemented by our infrastructure and service providers (including Cloudflare, Google, Apple, Facebook, Resend, and Loops), each of which maintains its own SCC and data-transfer commitments as part of its standard terms.

Data retention

Account data (name, email, sign-in provider links) is retained for as long as your account is active, plus a grace period of up to 30 days after deletion to allow for recovery, after which it is permanently deleted.
Device/session identifiers and tokens are retained only as long as needed to keep a device or sign-in session functional, and are revoked or expire automatically (see "Cookies, local storage, and session tokens" below).
Support correspondence and waitlist entries are retained for up to 24 months to allow us to respond to follow-up questions, unless you ask us to delete them sooner.
Security and abuse-prevention logs are retained for a limited period consistent with Cloudflare's standard log retention, typically no more than 30 days.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export a copy of your personal information, and to object to or restrict certain processing. To exercise any of these rights, email support@galleryearth.tv. We will respond within 30 days, or sooner where required by law. We may need to verify your identity before fulfilling a request.

California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion of your personal information, to correct inaccurate personal information, and to opt out of the "sale" or "sharing" of personal information. Gallery Earth does not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising any of these rights. To exercise your rights, email support@galleryearth.tv.

Children's privacy

Gallery Earth is not directed to, and does not knowingly collect personal information from, anyone under the age of 16. If you believe a child under 16 has provided us with personal information, please contact support@galleryearth.tv and we will delete it.

Cookies, local storage, and session tokens

Gallery Earth does not use third-party advertising or tracking cookies. We use the following first-party mechanisms strictly to make sign-in and the app itself work:

Browser session cookie. When you sign in on a web browser (including our companion sign-in page), we set a secure, HTTP-only session cookie scoped to galleryearth.tv and its subdomains, used only to keep you signed in.
TV and app local storage. The Gallery Earth TV and web apps store a device identifier and, once you sign in, a sign-in token in your browser's or device's local storage, so the app can load your gallery and remember your sign-in without repeating the pairing process every time. These values never leave your device except when sent to Gallery Earth's own API to authenticate a request.

You can clear these by signing out in the app, or by clearing your browser's local storage and cookies for galleryearth.tv, though doing so will require you to sign in again.

Security

We use industry-standard technical and organizational measures, including encryption in transit, to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date above, and where changes are material, we will provide additional notice (such as an email) before they take effect.

Contact

Questions about this policy or your personal information can be sent to support@galleryearth.tv.

Privacy Policy