Privacy

What stays on this device

Imported media, derived previews, filenames, captions, and capture timestamps are stored locally in your browser.

Browser storage is not encrypted by Pictayo, so protect your browser profile and clear imported items on a shared device.

Location services

When a file contains GPS coordinates, Pictayo shares coordinates—but never the photo or video—with:

• BigDataCloud for place names;
• OpenStreetMap Overpass services for nearby landmarks and dining suggestions; and
• Google Maps when a map is displayed or you open a map link.

These providers also receive normal connection information such as your IP address. Their own privacy policies apply.

Feedback

Feedback sends the category, text you enter, current Pictayo page, viewport size, app version, and browser information to a dedicated feedback service. It creates a public issue, so do not include personal information, private photo details, email addresses, passwords, or links. Photos are never attached.

Usage counts

Pictayo adds 1 to a daily total at three moments: when you open the app, when an import finishes, and when you export an album. The site is hosted as static files and keeps no visitor logs, so without this there is no way to tell it is being used at all.

Each request sends one word — open, import, or export — and nothing else. There is no identifier, account, cookie, or device, browser, screen, or location detail.

What is kept is the word, the UTC time it arrived, and the two-letter country Cloudflare resolved the request to, plus a running count per day. The country is derived from your network address and the address is then discarded; it is never stored, and when the country cannot be determined nothing is recorded in its place.

Because the entries are timed, ones close together read as a single visit — the app opening at 09:14 followed by an import at 09:15 is plainly the same session — so the log shows the shape of a visit as well as how many there were.

It still holds nothing that could be traced back to you: no address, cookie, account, browser or device is stored, a country is shared by everyone using the app from it, nothing distinguishes one visitor from another, and nothing connects a visit on one day to a visit on any other. Anything else reported — weekly and monthly figures, how many days had activity, averages per active day — is arithmetic on those entries rather than extra information about you. A tab is counted once per event no matter how many times you repeat it.

Exports and sharing

An exported album is a folder of your own photos. Every page asks search engines not to index it, and the album ships a robots.txt that disallows crawling.

That is a request well-behaved crawlers honour, not a security control — anyone with the link can still open the album, so use your host's access controls if it should be private.

Your controls

Removing one item or clearing Pictayo deletes only the browser-stored copies. Your original files are never changed, moved, or deleted.