Privacy Policy

Data controller: Lukáš Rykr, Company ID 02257874, registered at Do Kotle 801, 564 01 Žamberk, Czech Republic

Contact: hello@kalury.com

Effective from: 20 July 2026

1. In short and in plain words

When you create without a saved project, your photos are never sent anywhere. All photo processing (cropping, preview, PDF generation) happens entirely in your browser. Photos never leave your device and we have no access to them.
If you save a project (My projects), the photos are uploaded to secure EU-based storage (Frankfurt). Only you and the people you invite to the project can see them — we never look into your photos and never use them for anything other than running the app.
Without registration you can use the app completely anonymously.
We measure traffic with a tool that uses no cookies and stores no data that could identify a visitor.
If you sign in, we store only what is necessary for your account to work.

2. What data we process and why

2.1 Anonymous use of the editor (without signing in)

We process no personal data. Photos are processed only locally in your browser (device memory, or the browser’s local storage — IndexedDB) and are not transferred to our servers.

2.2 User account (signed in)

Data	Source	Purpose	Legal basis
E-mail address	registration / Google	sign-in, account management	performance of a contract (Art. 6(1)(b) GDPR)
Name and avatar	Google account (if you sign in with Google)	display in the app	performance of a contract
Roles and permissions	assigned by an administrator	access control (administration, translations)	legitimate interest
Technical sign-in records	system	account security	legitimate interest

Signing in works via Google (OAuth) or a one-time link sent by e-mail (magic link). We do not store passwords — we don’t have any.

2.3 Saved projects (My projects)

When you save a project after signing in, we store its name, the uploaded photos (including downscaled previews) and crop settings. Photos are kept in private storage with the provider Supabase in the EU (Frankfurt) — only you and the collaborators you invite to the project can access them, technically enforced by database-level permissions and time-limited signed links. The legal basis is performance of a contract. Deleting a project also deletes all of its photos.

2.4 Traffic measurement

We measure traffic with Umami, which we run ourselves on our own infrastructure (self-hosted) — the data is not shared with any external analytics provider. The tool uses no cookies or other persistent identifiers, the IP address is not stored and is used only briefly to derive an anonymous visit identifier. Only aggregate figures reach us (number of visits, country, device type), from which no one can be identified.

2.5 Newsletter and contact form

If you subscribe to news, we process your e-mail on the basis of consent (confirmed via a link in the first e-mail) — only to send Kalury news and only until you opt out; you can unsubscribe anytime using the link in every e-mail. When you write to us via the contact form, we use your e-mail and the message content solely to handle your enquiry. E-mail delivery is technically provided for us by the service Resend.

3. Where the data is stored

User account data and saved projects (including photos) are stored with the provider Supabase in a data centre in the EU (Frankfurt am Main, Germany). The website runs on Vercel infrastructure with serverless functions in the EU (Frankfurt); static content may be delivered via a CDN also outside the EU, but personal data stays in the EU.

4. Processors

A few trusted services help us run the app. Each one sees only what it strictly needs for its work:

Processor	What it does for us	Data location
Supabase Inc.	accounts and saved projects (database, photo storage, sign-in)	EU (Frankfurt)
Vercel Inc.	running the website	serverless functions EU (Frankfurt), CDN globally
Resend, Inc.	e-mail delivery (sign-in links, confirmations, collaboration invites)	USA — EU Standard Contractual Clauses
Umami (self-hosted)	anonymous traffic measurement (no cookies), run by us	our own infrastructure — aggregate data only, no personal data
Google Ireland Ltd.	sign-in via Google (only if you use it)	per Google's terms

We do not share personal data with any other party, we do not sell it and we do not use it for advertising.

5. Retention period

We keep account data for as long as the account exists.
You can delete your account yourself at any time directly in the app (account menu → Delete account) — together with it, all your projects, photos and account data are deleted without delay and any subscription is ended. The exception is data we are required to keep by law (e.g. accounting documents).
Anonymous traffic statistics contain no personal data and are kept without a time limit.

6. Your rights

Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict processing, to data portability and to object. We will handle your request within 30 days — write to hello@kalury.com. You also have the right to lodge a complaint with the Czech Data Protection Authority (uoou.gov.cz).

7. Children

The app is intended for parents and adults. Photos of children that you process without a saved project stay solely on your device (section 2.1). Photos in saved projects are kept in secure EU storage, where only you and the collaborators you invite can see them (section 2.3) — we do not look into them and never use them for anything other than running the app.

8. Changes to this policy

We will announce material changes on the website. The current version is always available on this page.

Loading…