Privacy Policy — Ursine Optics

01WHAT WE COLLECT

OAuth profile data: name, email address, and profile picture (from Google or Facebook) when you sign in as a photographer
Photos you upload: thumbnail and display-size JPEG images
Athlete names (roster): for events where it is offered, an athlete's name (and optionally a jersey number) may be recorded by the site administrator — only with the parent's or guardian's prior consent — and linked to the photos that athlete appears in, so families can find and keep their athlete's season photos
Session data: a session cookie (uo_session) for authentication
Event page views: when you open an event gallery we record that a view happened, along with a one-way token worked out from your IP address and browser type. Your IP address itself is not stored. The token is scrambled together with a secret value, the current date, and the specific gallery — so it changes every day, is different for every gallery, and cannot be turned back into your address or used to follow you from one gallery to another. It exists only so a photographer can tell whether ten people opened a gallery or one person opened it ten times
Photo interactions: anonymous counts of how often a photo is downloaded or shared. No viewer identity is attached to these counts

OAuth sessions are stored in Cloudflare KV with a 7-day TTL
Photographer records (name, email, approval status) are stored in Cloudflare KV
Athlete roster names are stored in Cloudflare R2 (access-controlled; never made public, never indexed by search engines, and never shown to anonymous visitors)
Photos and profile avatars are stored in Cloudflare R2 object storage
View and interaction counts are stored in Cloudflare Analytics Engine. No names, emails, addresses or raw IP addresses are written to it — only counts and the daily one-way token described in section 01
All data is hosted on Cloudflare's global network; no third-party databases are used

Site administrators can view photographer records and manage photos
Athlete names are visible only to the site administrator and to approved photographers (to label photos correctly); they are never shown to anonymous visitors and there is no public list of athletes
Private keepsake links: a family given a private link can view and download only their own athlete's photos for the season. The link is long and unguessable, is not indexed by search engines, contains no athlete name, and can be revoked by the administrator at any time
Gallery viewers can see uploaded photos (each sport gallery is password-protected)
Cloudflare, as our hosting provider, handles visitors' IP addresses in the course of delivering the site and protecting it from abuse — as every web host does. That is separate from the view counting described in section 01, which never stores an address
No data is sold or shared with third parties

Sessions expire after 7 days of inactivity
Photographer records persist until account deletion is requested
Photos persist until archived or deleted by an administrator
Athlete roster names persist for the season and are removed on request, or when the administrator removes the athlete (which also removes that athlete's photo labels)
Private keepsake links persist until the administrator revokes them or removes the athlete; there is no automatic expiry
View and interaction counts are kept for roughly 90 days by Cloudflare Analytics Engine and then expire automatically. The daily token expires with them, and is in any case meaningless after the day it was created
Profile avatars persist until account deletion

Request a copy of your data by contacting the administrator
Request deletion of your account and all associated data
Facebook users can request automatic data deletion through their Facebook settings

Facebook users: Meta can trigger automatic deletion of your data via our callback endpoint
All users: contact christopher.bibbs@gmail.com to request manual deletion
Deletion removes: your photographer record, profile avatar, and session data
Parents/guardians: contact us to remove a child's name from the athlete roster — this deletes the name, unlinks it from all photos, and revokes any private keepsake links for that athlete
Uploaded photos may be retained in the gallery unless separately requested for removal

uo_session — HttpOnly session cookie for authenticated areas (7-day expiry)
Sport password cookies — SHA-256 hash, 30-day expiry, per-sport gallery access
No analytics cookies, no tracking pixels, no third-party cookies. Nothing is stored on your device for analytics — the view counting described in section 01 is worked out on our server and never written to your browser

Data controller: Christopher Bibbs
Email: christopher.bibbs@gmail.com