Legal
Privacy policy
What we collect, what we set in your browser, who else is involved, and the parts of your account that are readable to us. Written to be checked rather than agreed to unread.
The short version
No email, no password
An account is a username, a display name and a public key. We never ask for an email address, a phone number or a password, so there is nothing of that kind to store, leak or hand over.
Content we cannot read
Images, video, posts, comments, messages, filenames and tome names arrive already encrypted by your browser. We hold ciphertext. There is no key on our side that opens it.
Two cookies, both essential
A session cookie and a CSRF token, both first-party, both required for the site to work securely. No analytics cookies, no advertising cookies, no third-party cookies at all.
No trackers
No Google Analytics, no Meta pixel, no Hotjar, no A/B testing tool, no session recorder, no advertising network, no fingerprinting. Fonts and scripts are self-hosted, so a page load contacts nobody but us.
What we hold on our servers
Every category of personal data on our side, why we are allowed to hold it, and how long it stays. "Ciphertext" throughout means bytes we cannot decrypt.
| Category | What it is | Lawful basis | How long |
|---|---|---|---|
| Account | What it is Username, display name, RSA-4096 public key, account creation date, and an avatar image if you upload one. | Lawful basis Performance of our contract with you | How long Until you delete the account |
| Content | What it is Encrypted images, video, thumbnails, post bodies, comments and messages, their initialisation vectors, tome keys wrapped for each member, plus file sizes, timestamps and which account uploaded what. | Lawful basis Performance of our contract with you | How long Until you or another member deletes it, or you delete the account |
| Devices | What it is One record per browser you sign in from: a hashed token, a device name derived from the user agent, the IP address and user agent seen at sign-in, the city and country that IP resolves to, and the time it was last used. | Lawful basis Contract, and our legitimate interest in account security and in showing you your own sessions | How long Tokens expire after 90 days; the record goes when you revoke the device or delete the account |
| Error reports | What it is JavaScript errors the application catches: message, stack, file, line, page URL, user agent, IP address, and your account identifier if you were signed in. | Lawful basis Our legitimate interest in finding out that the software is broken | How long Kept until manually cleared. There is no automatic expiry today |
| Administrator actions | What it is What an administrator did, to what, when, and from which IP address. | Lawful basis Our legitimate interest in holding our own staff accountable | How long Retained as an audit record |
| Deletion records | What it is That an item was deleted, when, and from which tome, so other members' devices can remove it too. No content, no filenames. | Lawful basis Performance of our contract with you | How long Retained as sync tombstones |
| Server logs | What it is Standard web and application logs, which include IP addresses and requested paths. | Lawful basis Our legitimate interest in keeping the service running and abuse-free | How long Rotated after 14 days |
Your avatar is the one thing you upload that is not encrypted. It is stored in the clear and served from a public URL, because it has to be visible to people who hold none of your keys. Choose one accordingly.
Third parties
One, and it receives an IP address rather than anything you uploaded. Every font, stylesheet, script and image on this site is served from this domain, so loading a page here contacts nobody else - no font CDN, no script CDN, nothing your browser has to be told to trust.
| Who | What they receive | Why | Cookies set |
|---|---|---|---|
| freeipapi.com | What they receive Your IP address, and nothing else: no username, no account identifier, no content. Sent when you register a device or sign in on a new one. | Why To turn the address into a city and country, so the device list on your profile reads "London, United Kingdom" rather than a row of numbers you cannot place. The result is cached for 24 hours. | Cookies set None |
Beyond this one, the servers and the network that run the site are operated by our hosting provider, which processes data on our instructions only. We do not sell personal data, we do not share it for advertising, and there is no marketing list to be added to, since we hold no email addresses.
What we cannot see, and why that is structural
Encryption and decryption happen in your browser through the Web Crypto API. A tome has one AES-256-GCM key; every member holds a copy wrapped with their own RSA-4096 public key; the unwrapped key never exists on our side. Images, video, thumbnails, post bodies, comments, messages, filenames, tome names and tome descriptions are all encrypted before upload.
This is not a policy commitment we could quietly reverse. There is no administrative override, no support tool that decrypts an account, and no key escrow. If we wanted to read your tome tomorrow we would have to ship different code to your browser and hope you did not look - which is the honest limit of browser-delivered cryptography, and is described in full on the security page.
What remains visible to us is structural metadata: that an account exists, that it has tomes, how many items those hold, how large they are, when they were uploaded and which account uploaded them. That residue is real, it is informative, and we are not going to describe it away.
Your rights
You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have it erased, to receive it in a portable form, to restrict or object to processing carried out under legitimate interests, and to complain to a supervisory authority.
Erasure you can exercise yourself, immediately, from your profile: deleting your account removes your account record, your devices, your avatar and any tome no other member remains in. Posts, images and comments in tomes that other people still belong to are detached from you rather than destroyed, because they are also those members' content and are encrypted under a key they hold.
For access or portability, email privacy@imagetome.com. We will respond within one month. Be aware of what the copy consists of: account and device records in the clear, and everything else as ciphertext, which only your private key can open. We cannot produce your photographs for you, and a request that we do is a request we are structurally unable to satisfy.
If you think we have handled your data badly, tell us first and we will try to fix it. You can also complain directly to the Information Commissioner's Office (ICO), whose decision does not depend on us agreeing with you.
Where the data is, and where it goes
The application, its database and the encrypted media are held on servers operated by our hosting provider, on our behalf and on our instructions.
The single third party above is sent your IP address deliberately, and depending on the route that request may be handled outside the United Kingdom. It carries no content, no account identifier and no username. Nothing else on this site reaches out anywhere: the fonts and the small amount of JavaScript the public pages use are served from this domain rather than from a CDN, specifically so that reading a page here is not observable by anybody but us.
Children
ImageTome is not intended for children. You must be at least 16 to create an account, as the terms of service state. We do not knowingly hold data belonging to anyone younger, and because we ask for no date of birth we rely on that statement rather than on verification. If you believe a child holds an account, email abuse@imagetome.com and we will close it.
Changes to this policy
If this policy changes, the date at the top changes with it, and a change that materially affects what we collect or who receives it will be flagged in the application before it takes effect rather than after.
We would rather this document stay short and stay true. The best way to keep it that way is to keep collecting almost nothing, which remains the plan.
Questions about privacy
Because consent is only required for cookies that are not strictly necessary, and we do not set any. The two cookies we do set carry the session and the anti-forgery token that make the site work securely, which is exactly the exemption in regulation 6(4) of the Privacy and Electronic Communications Regulations. A banner asking you to consent to something you cannot decline without breaking the site would be theatre.
No. There is no analytics tool, no tag manager, no advertising pixel, no session recorder and no A/B testing script on any page. You can confirm this in your browser's network tab in under a minute, which is a better assurance than this sentence.
That an encrypted object exists, how large it is, when it was uploaded, which tome it belongs to and which account uploaded it. Not the image, not the filename, not the title, not the tome name. All of those are encrypted by your browser before upload.
No, and this is the one deliberate exception. Your avatar is stored unencrypted and served from a public URL, because it has to render for people who do not hold any of your keys. Treat it as public. Everything else you upload is not.
We can hand over what we hold, and we would comply with a lawful order. What we hold is your username, your public key, device records including IP addresses, and ciphertext. There is no key on our side to hand over with it, because there never was one.
Deletion you can do yourself, from your profile, and it is immediate and final. For a copy, email privacy@imagetome.com from the account you want it for. Note that the copy we can produce is ciphertext plus the account and device records above; only your device can turn the ciphertext back into photographs.
ImageTome is the controller for the data described on this page. Questions, requests and complaints go to privacy@imagetome.com. If you are not satisfied with our response you can complain to the Information Commissioner's Office (ICO).
The claims above are checkable in a browser tab.
Open the network panel, upload something, and watch what is actually sent. The other half of the agreement is next door.
Read the terms of service