Pictures Up is made in Victoria, British Columbia. This policy covers this website, the docs at docs.picturesup.io, and the Pictures Up app on the web at app.picturesup.io and on iPhone. Last updated November 12, 2026.
This website and the docs
There are no accounts, ads or cookies here. The docs remember whether you picked light or dark, in your own browser. Cloudflare counts visits to the website, the docs and the app without cookies.
The contact form
The form asks for your name, your email, your studio or company if you want to add it, and what you are working on. We use it to reply to you. We don’t share it or add it to a mailing list.
Your message is kept on our own server in Canada and sent to us through Proton Mail, with a copy to you.
To stop floods of messages, the form keeps a scrambled form of your connection’s address for up to a day. It can’t be turned back into the address.
Your account
An account needs your name, your email and a password. Your password never reaches our server: your device turns it into a sign-in key, and we keep only a check value of that key. We keep your email as a keyed hash. Sign-in codes come to your email, and we record when you last signed in.
The app’s cookies keep you signed in for 7 days, remember a browser you chose to trust for 30 days, and keep your appearance and accent. Share links use cookies to count visits by a random id (a year), to remember that you gave a link’s password (7 days), and to remember the name and email you gave (180 days). None is used for advertising or to follow you to other sites.
The iPhone app
The iPhone app talks to our server and nothing else. To sign in, it sends your email and a key worked out on the phone; your password stays on the phone. We record the phone’s model and iOS version with each phone sign-in, which ends after 30 days unused.
The keys sit in the phone’s Keychain behind Face ID, for that phone only. The phone keeps its own copy of what your role allows, under iOS file protection and out of iCloud and computer backups, with media still encrypted. Crew phones get only their own productions, and no production documents or release forms, answers, signatures or signing records. Signing out deletes the keys, the copy and the cache. Removing someone from a studio deletes that studio from their phone at its next check with our server.
Photos and videos you upload are picked without access to the rest of your library, encrypted on the phone and sent to our server, which makes their previews.
A studio’s data
A studio’s productions, people, paperwork and media belong to the studio. They are encrypted end to end: the keys live only on its members’ devices, and our server stores sealed data and encrypted files it never opens. Pictures Up cannot read a studio’s data.
What our server does know: who belongs to which studio and their role, members’ email addresses as keyed hashes, their public keys, when they sign in, the sizes and counts of encrypted files and messages, and the settings of the links it checks (whether a link is on, its expiry, its password check, its view limit and visit counts). Sign-in codes, invites and link emails pass through it on their way out. The studio’s name is sealed for its members; the licence record from an activation code keeps the customer name it was issued to.
Links a studio sends carry their key after the #, which browsers never send to our server. Integrations such as Notion, Slack and Google Calendar aren’t live: connecting one records the choice, and nothing is sent to it.
A studio that used Pictures Up before November 12, 2026 moves to this at its first sign-in after that date. Until then its data stays encrypted at rest, and our server opens it only while it is in use. The copy our server could open is deleted 30 days after that sign-in.
If a studio has added you as crew, talent or a client, it decides what it keeps about you. Ask the studio to change or remove it. If you can’t reach them, write to us.
What a studio’s data holds about people it works with, sealed like the rest:
- Release signers: the signature, the form’s answers, and the IP address and device used to sign, kept with the release.
- Guests on share links: the name and email given to comment, upload or watch a watermarked link, kept with their comments and uploads.
- Clients in the portal: name, email and company, when they last visited, and their notes and approvals.
- Calendar holds: each reply, with the name and email it came from.
Shoot day keeps changes made on set, signatures included, encrypted in the browser until they reach the server.
The app sends sign-in codes, invites, call sheets, calendar holds, signing links and client portal notices through Proton Mail. Every studio email has an unsubscribe link; sign-in codes still arrive. Our server logs each email with a shortened address, the first two characters and the domain, and not its subject. An email that fails to send isn’t kept.
Maps and weather
Everything in Pictures Up comes from inside our system, except the map and the weather, which come from open-source data.
- Addresses are looked up on OpenStreetMap when a location is saved. It gets the address as typed.
- Forecasts come from Open-Meteo. It gets the location’s coordinates and the date.
- Apple Maps links open only when you tap them.
Where it lives
Our servers are in Canada. All traffic passes through Cloudflare (United States), whose network decrypts it on the way to our servers. Proton (Switzerland) sends our email. OpenStreetMap and Open-Meteo run outside Canada.
We don’t sell personal information or use it for advertising.
How long we keep it
- A studio’s data stays until the studio removes it. Files in the Trash stay until an admin deletes them for good. Closing a whole studio is not in the app yet; write to us.
- A studio’s earlier copy that our server could open is deleted 30 days after its first sign-in after November 12, 2026.
- Backups of our servers are kept for 30 days, then removed, including after a studio deletes its data, so a mistake can be undone. A studio’s backups made after it moves hold only sealed data that our server’s keys can’t open.
- One copy of the server’s data, made just before the change on November 12, 2026, is kept until the change is confirmed working, then deleted. Earlier copies are already deleted.
- Enquiries from the contact form stay until we delete them. Ask and we delete yours.
Your rights
You can ask what we hold about you, and have it corrected. If our answer doesn’t settle it, you can take it to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.
Questions
Write to us with the contact form at picturesup.io. When this policy changes, the date at the top changes with it.