Privacy

Last updated November 3, 2026

This is my photo site: my own photos, and albums I've made for clients on their own web addresses. I run it myself, on my own servers. There are no ads, no analytics and no tracking on it, and I don't sell or share anything about you with anyone.

Jorj Bauer, jorj@jorj.org

If you're only looking at photos

You don't need an account, and the site won't set any cookies while you look around. Like most web servers, it keeps a log of the pages it serves: your IP address, the page, the time, the page that linked you here, and the name your browser gives itself. I use that log to find and fix problems, and for nothing else.

If you sign in with Google

Google will give the site your name, your email address, whether Google has checked that address, and the ID number Google uses for your account. The site stores those so it knows it's you the next time you sign in, and so I can tell who you are and decide which albums you can see.

The site doesn't ask Google for anything else. It can't see your contacts, mail, files or Google Photos, and it doesn't keep the token Google hands back after you sign in.

If you have a username and password

The site stores your username and a bcrypt hash of your password, which is a one-way scramble. I can't read your password from it.

Cookies

Opening the login page sets one cookie. Until you log in, it holds a random token that stops other sites from submitting the login form for you. Once you're logged in, the same cookie also holds your user number and username, signed so it can't be changed. It will expire after 12 hours, or when you log out. Logging out on one device logs you out on all of them.

While you're signing in with Google, a second cookie keeps track of the sign-in. It's deleted when you get back from Google, or after 10 minutes.

What else is stored

When you last logged in, which albums I've given you, and any photos you've starred in a client album (I see those stars; that's what they're for).

Where it's kept

The database is on servers I run. The photos are in Hetzner's object storage in Helsinki, Finland.

Removing your account

Email me at jorj@jorj.org and I'll delete your account and everything stored with it. You can also remove this site from your Google account at myaccount.google.com/connections. That will stop Google signing you in here, but it won't delete what's stored here, so email me as well.

If you're in one of my photos and want it taken down, email the same address.

Changes

If this page changes, the date at the top will change with it.