Privacy Policy

This policy covers anyone who signs in to or uploads files through Total Vault. If you’re a guest using a scoped upload link — a second shooter, a client, a family member — the customer who invited you is the controller of the resulting data; we process it on their behalf under the same protections described here.

We collect three categories of information:

Account information. Your email address (used as your identifier), an optional display name and avatar image, your role within an organization, the date you joined, and timestamps recording when you last signed in. Depending on how you sign in, we also store a password hash (if you set a password), the identity details returned by Google or Apple single sign-on (your subject identifier, email, and name), short-lived two-factor codes, and a hashed token for any device you ask us to remember. When you make an account we also note the country (and, for sign-in alerts, the city) your connection came from, your time zone, the kind of device you used, and how you arrived (for example, to view a studio’s gallery), so our emails arrive at a sensible hour and fit how you use Total Vault.

Content you upload. The files you put in Total Vault — photos, videos, RAWs, and anything else you choose to store — along with their filenames, sizes, MIME types, and any embedded metadata (EXIF, capture time, camera, lens, ISO, and GPS location when your camera recorded it, which is personal information about where you were; it powers the Places map and location search, and anyone you share a file with can see it unless you remove it). We also keep a cryptographic checksum, computed in your browser at upload, which we use to confirm the file arrived intact and to keep double-checking it over time. To power browsing and search, we store data we derive from your visual files — thumbnails, auto-generated tags, a short caption, any text we can read in the image, and a numeric “embedding” used for similarity search. Documents (PDF, Word and the like) are read on our own servers so search can match what they say.

Activity data. A record of actions you take in the Service: uploads completed, files moved or renamed, folders created or trashed, files double-checked, shares created, and the natural-language search queries you type. We retain a per-org audit log so administrators can answer “who did what when.”

Technical data. When you use the site or app, our host and error tools receive your IP address, browser and device type, and the pages and requests involved. We use it to serve the Service, limit abuse (rate limits use your IP address), and fix errors. Our hosting provider also derives your approximate country and city from your IP address; we use that for sign-in alerts and to pick when to send emails. If you turn on push notifications in our iPhone app, we store the device token Apple gives us to deliver them. If you use the Places map, the location of a photo is sent to Apple’s maps service from your browser or phone to draw the map and name the place.

• Browser-fingerprinting data or advertising identifiers. We don’t run ads, don’t track you across other sites, and don’t build an ad profile. Our analytics are set up with advertising features off.
• Plaintext passwords. If you set a password, we store only a salted, hashed form of it — never the password itself.
• File contents for AI training. We don’t train models on your files, and we don’t opt in to any provider program that would. The AI providers we use receive previews only as described in “How we use it” and on the subprocessors page.
• Anything from children. The Service is for people 18 and older, and we don’t knowingly collect personal information from anyone under 13. See “Children” below.

• To operate the Service — store, retrieve, verify, search, and present your files.
• To send you transactional emails: sign-in verification codes and password-reset links, receipts and notifications when a project finishes processing, share invites you send, and security alerts about your account.
• To send occasional tips for using Total Vault, chosen from what you’ve done in your account (for example, how to keep copies of photos you hearted in a gallery). There are only a few, each has an unsubscribe link, and you can turn them off in Settings, Notifications. We don’t send them to clients of studios that use their own branding, or, for now, to people in the European Economic Area, the United Kingdom, Switzerland or Canada. We note which tips you got and whether you clicked them; we don’t track opens.
• To keep double-checking your files. When a file lands we confirm it arrived intact, then continuously monitor its storage-level integrity, and on a rolling schedule (and on demand) we re-read the file in full and re-compare its checksum to detect silent corruption or bitrot. Results are recorded on the file’s row.
• To generate derived assets — thumbnails and EXIF extracts — to power browsing and search. With Smart search on, we also send small previews of your photos to Anthropic (descriptions, reading scanned pages) and Cohere (matching photos by meaning), and the words you type in Search, or a photo you search by, to Anthropic and Cohere. Along with a preview we may send its filename and camera details. We ask before any of it is sent: a workspace’s owner decides for its files, and each person decides for their own searches. Full-resolution originals never leave our storage.
• To diagnose problems, prevent abuse, and improve the Service in aggregate. That includes error reports to Sentry and, on our website, visit counts from Google Analytics (see Cookies).
• To take payments. Stripe handles your card; we keep the plan, status and billing contact, never the card number.
• To comply with legal obligations (subpoena, audit, tax records).

We do not use your data for advertising, profile-based marketing, or any purpose beyond providing the Service.

File contents are stored in Backblaze B2 (US data centers), with derived video assets on Cloudflare R2 and, for video formats browsers can’t play, a temporary playback copy on Cloudflare Stream. The database that tracks file metadata, checksums, folders, and activity runs on Neon Postgres (US-East). The web application is hosted on Vercel (US edge with US-East origin). Background jobs run on Inngest, imports and live updates run on Cloudflare, video conversion runs on Fly.io (and on RunPod GPUs for some large videos), error reports go to Sentry, payments go through Stripe, and email is sent via Resend. Sign-in with Google or Apple, and Apple Maps and push notifications, involve those companies too.

A complete list of third parties we share data with, what they receive, and where they operate is on our subprocessors page. We update it whenever we add or remove a vendor.

Total Vault uses the cookies it needs to sign you in and keep you signed in. The main one is __Host-tv_session, which holds your signed session token; it’s HTTP-only, Secure, SameSite=Lax, sent only to app.totalvault.ai, and expires 30 days after sign-in. It replaces older tv_session and vault_session cookies, which we remove the next time you open the app. If you ask us to remember a device, we set a long-lived vault_device cookie (also 30 days). During a Google or Apple sign-in or a cloud-import connection we set a few short-lived cookies (about 10 minutes) to keep the round-trip secure, then clear them. We set a one-day tv_age_ok cookie when you confirm you’re 18 or older at sign-up, a tv_tz cookie with your time zone, and we use your browser’s local storage to let an interrupted upload resume and to remember your cookie choice.

We also use Google Analytics (Google LLC) on our website to see how the site is used (which pages are visited and how people found us). We use them only for analytics: we don’t sell this data, use it for advertising, or share it for cross-site tracking; Google Signals and ad personalization are switched off. If you’re in the EU, EEA, UK or Switzerland, we ask first, and no analytics cookies are set until you accept. Elsewhere, analytics are on by default and you can turn them off at any time with Cookie choices at the bottom of every page. We also honor your browser’s Global Privacy Control signal as an opt-out: if it’s on, analytics stay off.

Our error monitor (Sentry) records errors and slow requests, with the page, browser and IP address involved. It can also record sessions for debugging, but that is off, and if it is ever turned on it masks all text and blocks all media.

• Active files stay in Total Vault as long as the owning organization’s account is open.
• Soft-deleted files (Trash) stay recoverable for 30 days before permanent deletion from both the database and Backblaze.
• Playback copies on Cloudflare Stream are deleted automatically about 31 days after they’re made.
• Copies a provider handles for a moment (an AI preview, an email, a job) are kept by that provider only as its own terms say; see the subprocessors page. Error reports and website analytics are kept for the periods set in Sentry and Google Analytics, which we keep as short as is useful.
• Account and activity records are retained for the lifetime of the account and for up to 12 months after closure, then purged.
• Password-reset links expire 15 minutes after issue, and sign-in verification codes expire after 10 minutes; both are destroyed once used.
• Residual copies in our database provider’s point-in-time backup window expire automatically within that recovery window.

• Every file gets a cryptographic checksum in your browser before upload, and our storage provider confirms the bytes it received match it — so a file is double-checked the moment it lands. We also re-read files in full and re-compare the checksum on a rolling schedule to catch any later drift.
• Files are stored encrypted at rest in Backblaze B2, and all in-transit traffic uses TLS.
• Database access is over TLS to a per-environment Neon endpoint; credentials live in encrypted secrets and never in code.
• You sign in with your email and password plus a single-use code we email you, or with Google or Apple single sign-on. You can trust a device for 30 days to skip the emailed code on that browser. Any password is stored only in salted, hashed form.
• Access to your data inside our team is limited to staff who need it and is logged.
• If we ever detect that a file’s checksum no longer matches the one recorded at upload, we flag it, surface it prominently in your dashboard, and notify the account owner by email.

Wherever you live, you can do the following. If you’re in the EEA, the UK or Switzerland, these are your rights under the GDPR and UK GDPR; if you’re in California, see the next section.

• Access. Download a copy of your personal information in a machine-readable file (JSON) from Settings, Profile, Your data. It has your account, your workspaces, a record of every file in the workspaces you own, and the comments you wrote. Your files themselves download from the app. For anything else we hold, email us.
• Correct. Fix your name, avatar and email in Settings, or email us for anything else that’s wrong.
• Delete. Delete your account yourself in Settings (Account), or email us. Workspaces you own alone are deleted with it; for a shared workspace you choose a new owner or delete it for everyone. We remove the database rows and purge the file bytes from object storage in a background job; any residual copies in our backup window expire on their own shortly after.
• Export. Download your original files any time, one at a time or in bulk where the app offers it. For a full copy of your account data, email us.
• Object or restrict. Ask us to stop or limit a use of your information, for example one that relies on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.
• Switch off Smart search. For a workspace’s files in Settings → General (its owner), or for your own searches in Settings → Profile. Nothing new is sent after that; descriptions already made stay so search keeps working, and go when you delete the files.
• Opt out of analytics. Use Cookie choices at the bottom of any page, or turn on Global Privacy Control in your browser. We treat it as an opt-out of analytics.
• Opt out of tips. Settings → Notifications, or the unsubscribe link in any tip email.
• Complain. You can complain to your data protection authority (in the UK, the ICO) if you think we got something wrong. We’d like the chance to fix it first.

How to ask. Email support@totalvault.ai from the address on your account, so we know it’s you. We may ask one extra question to confirm. We respond within 30 days (45 for California requests, with notice if we need longer); usually faster. It’s free. If a request is from a guest, we may send it to the customer who invited them, who controls that data (see Who this applies to).

Our legal bases (EEA/UK): we process your information to provide the Service you asked for (contract), to keep it secure and working and to understand how our website is used (legitimate interests), to follow the law (legal obligation), and for analytics cookies in Europe and Smart search where you said yes (consent).

If you live in California (or another state with a privacy law like Colorado, Virginia, Connecticut or Texas), you can know what we collect, get a copy, correct it, delete it, and opt out of sale, sharing and targeted advertising. The categories we collect are in “What we collect”: identifiers (email, IP address), account and billing details, files and their metadata (including precise location if your camera saved it), activity and search history, device and usage data, and approximate location from your IP address. We use them for the purposes in “How we use it” and share them with the service providers on the subprocessors page.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. We don’t use or disclose sensitive personal information to infer characteristics about you; account sign-in details and precise location in your own photos are used only to run the Service. We honor Global Privacy Control as an opt-out of analytics, and we won’t treat you differently for using any of these rights. You can use an authorized agent; we may ask for proof they act for you. To appeal a decision, reply to our answer.

We share your data only as needed to provide the Service: with the subprocessors listed on the subprocessors page, with people you explicitly invite (guests, members of your organization, share-link recipients), and where compelled by law. We will challenge any government request that appears overbroad. We will not sell, rent, or trade your data, ever. If we are ever part of a merger or sale, your information goes with the Service under this same policy.

Total Vault is for people 18 and older. Sign-up asks you to confirm it, and nothing works until you do. We don’t knowingly collect personal information from anyone under 13 (or under 16 in the EEA and UK). If you think a child has an account or that we hold a child’s information, email support@totalvault.ai and we’ll delete it. Photos of children that adults upload are that customer’s files, treated like any other file.

The Service operates from the United States. If you upload from outside the US, your data will be transferred to and stored in the US, where privacy laws may differ from yours. Where our vendors process EU/UK personal data, we rely on the EU–US Data Privacy Framework (where the vendor is certified) or standard contractual clauses.

When this policy changes, we’ll update the “Effective” date at the top and email account owners if the changes are material. Older versions stay available on request. Continuing to use the Service after a change means you accept the new policy.

When you connect a Google account to import files, you grant Total Vault read-only access to your Google Drive (the drive.readonly scope). We use that access solely to let you browse the folders and files in your Drive and to copy the items you choose into your vault. We never create, modify, or delete anything in your Google Drive, and we request read-only access for exactly this reason.

Total Vault’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, that means:

• We do not use Google user data for advertising.
• We do not sell, rent, or trade Google user data.
• We do not use Google user data to train generalized or non-personalized AI or machine-learning models.
• We transfer Google user data only as necessary to provide or improve the import feature you requested, to comply with applicable law, or as part of a merger or acquisition.
• No human reads your Google user data except where you give explicit consent, where it is necessary for security or to comply with applicable law, or in aggregated, anonymized form for internal operations.

Your OAuth refresh token is encrypted at rest. You can disconnect a connected Google account at any time, which revokes our access, and you can revoke it directly from your Google Account permissions page.

Questions about this policy, requests under it, or anything else: support@totalvault.ai. Total Weddings LLC is the controller of account data. Copyright notices go to the address on our DMCA page.