Privacy Policy

• Required at sign-up: email address, encrypted password, and name or photographer name
• Optional at sign-up / required for photographer registration: phone number
• Optional for photographer registration: business information (business name and registration number)
• Generated while using the service: album and photo data (originals, thumbnails, previews and retouches), selection records, album event history, and access logs
• When you use social sign-in (Google, Kakao, or Naver): the provider member identifier, plus the email address and nickname the provider supplies for the consent items you granted. Provider access and refresh tokens are discarded immediately after we confirm your identity and are never stored. Linked provider records are deleted when you withdraw.

• Account identification, sign-up verification, and account management, including email verification
• Providing photo delivery and selection services, including sending, claiming, selecting, and delivering retouches
• Sending necessary service emails, including album delivery, claim, selection completion, and selection cancellation
• Sending marketing information only with optional consent
• Maintaining service security and preventing misuse

We destroy personal information without delay when an account is withdrawn, except as described below.

• A photographer's de-identified display name may remain with an album already claimed by a client to protect the client's legitimate use.
• Information required by law is retained for the statutory period, such as access logs for three months under the Protection of Communications Secrets Act.

When a client withdraws, owned albums and photos are deleted. When a photographer withdraws, unsent albums and photos are deleted.

We use the following processors to provide the service; some operate cloud infrastructure outside your country.

• Amazon Web Services (database and server hosting; Seoul, Korea region): account, album, and selection data
• Cloudflare, Inc. (R2 object storage): original, thumbnail, preview, and retouched photo files
• Email processors (Google Gmail SMTP or Resend, Inc.): verification codes, service notices, and marketing emails

Our processor agreements require compliance with applicable privacy laws. We will disclose processor changes through this policy.

You may view and correct your personal information at any time in My Page, and withdraw your account to revoke consent.

Marketing consent is optional and refusing it does not restrict service use. You may request withdrawal of marketing consent using the contact details below.

We use session cookies (access and refresh tokens) to maintain sign-in. We do not use cookies for advertising or tracking.

We also use a first-party locale cookie named locale to remember your Korean or English preference. It expires after one year and contains only the locale value. The account-level language preference and email-language preference are optional and may be null; when absent, we use the request locale or Korean default.

When you use airplane mode, photos and selection data are stored in IndexedDB on your device only and can be deleted by disabling airplane mode.

• One-way bcrypt password hashing
• Signed, time-limited URLs for photo access
• Role-based access control and album-level authorization
• HTTPS encryption in transit

For questions, complaints, or remedy regarding personal information, contact us below.

• Privacy officer: SnapDrive Operations Team
• Email: privacy@snapdrive.app

For privacy incident reports and advice in Korea, contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118).

We will announce additions, deletions, or changes through the service at least seven days before they take effect.