01WHAT WE COLLECT
- OAuth profile data: name, email address, and profile picture (from Google or Facebook) when you sign in as a photographer
- Photos you upload: thumbnail and display-size JPEG images
- Athlete names (roster): for events where it is offered, an athlete's name (and optionally a jersey number) may be recorded by the site administrator — only with the parent's or guardian's prior consent — and linked to the photos that athlete appears in, so families can find and keep their athlete's season photos
- Session data: a session cookie (
uo_session) for authentication
02HOW WE STORE IT
- OAuth sessions are stored in Cloudflare KV with a 7-day TTL
- Photographer records (name, email, approval status) are stored in Cloudflare KV
- Athlete roster names are stored in Cloudflare R2 (access-controlled; never made public, never indexed by search engines, and never shown to anonymous visitors)
- Photos and profile avatars are stored in Cloudflare R2 object storage
- All data is hosted on Cloudflare's global network; no third-party databases are used
03WHO HAS ACCESS
- Site administrators can view photographer records and manage photos
- Athlete names are visible only to the site administrator and to approved photographers (to label photos correctly); they are never shown to anonymous visitors and there is no public list of athletes
- Private keepsake links: a family given a private link can view and download only their own athlete's photos for the season. The link is long and unguessable, is not indexed by search engines, contains no athlete name, and can be revoked by the administrator at any time
- Gallery viewers can see uploaded photos (each sport gallery is password-protected)
- No data is sold or shared with third parties
04DATA RETENTION
- Sessions expire after 7 days of inactivity
- Photographer records persist until account deletion is requested
- Photos persist until archived or deleted by an administrator
- Athlete roster names persist for the season and are removed on request, or when the administrator removes the athlete (which also removes that athlete's photo labels)
- Private keepsake links persist until the administrator revokes them or removes the athlete; there is no automatic expiry
- Profile avatars persist until account deletion
05YOUR RIGHTS
- Request a copy of your data by contacting the administrator
- Request deletion of your account and all associated data
- Facebook users can request automatic data deletion through their Facebook settings
06DATA DELETION
- Facebook users: Meta can trigger automatic deletion of your data via our callback endpoint
- All users: contact christopher.bibbs@gmail.com to request manual deletion
- Deletion removes: your photographer record, profile avatar, and session data
- Parents/guardians: contact us to remove a child's name from the athlete roster — this deletes the name, unlinks it from all photos, and revokes any private keepsake links for that athlete
- Uploaded photos may be retained in the gallery unless separately requested for removal
07COOKIES
uo_session— HttpOnly session cookie for authenticated areas (7-day expiry)- Sport password cookies — SHA-256 hash, 30-day expiry, per-sport gallery access
- No analytics cookies, no tracking pixels, no third-party cookies
08CONTACT
Data controller: Christopher Bibbs
Email: christopher.bibbs@gmail.com