Kynto Photo — privacy policy
Last updated 2026-08-18
It's a photo library, so nearly everything in it is personal by definition. The questions worth answering are where it's kept, who can get at it, and how thoroughly it disappears when you want it gone.
Who is responsible
Marcel Meijer. Contact: info@kynto.eu.
Your account
- Your email address, used to sign in and to send account email such as a password reset.
- Your password, kept only as a bcrypt hash. It can't be read back out.
- Your language preference.
- If you enable two-factor authentication, the shared secret and your backup codes, so codes can be verified.
- Session tokens, so you stay signed in. Changing your password invalidates all of them.
Your photos
- The files themselves, plus the smaller renditions generated for display.
- The technical data inside them: camera, settings, when the shot was taken, and coordinates if your camera recorded any. That's what makes searching by place and date work, and nobody you haven't shared with ever sees it.
- Albums, favourites and descriptions you add.
Faces
Photos get grouped by who's in them, which means working out a mathematical description of each face. Under the GDPR that counts as biometric data. It's only ever used to group your own library, it's never compared across accounts, and it never puts a name to anyone unless you type one in yourself. Delete a person and the grouping goes; delete your account and all of it goes.
Sharing
A share link is a long random token, and anyone holding it can see whatever it points at. That's what it's for, so treat it like a key. You can give a link an expiry date, and you can withdraw one later, which kills it straight away. Deleting an album or a photo also stops it being served through any link that pointed at it.
Where it's kept
On servers in the EU, with a European provider. Files travel over TLS and sit encrypted on disk. Photos are served through signed links that expire within minutes, so nothing is parked at a guessable public URL.
Who else sees it
Nobody. No advertising in this product, no analytics running over your library, nothing sold or handed to data brokers. The only sub-processors involved are the European hosting and storage provider and whoever delivers the account email.
If you import from Google Photos you're granting access to your Google library for as long as the import takes. The copied files then live here under this policy, and the access token is thrown away as soon as the import finishes.
How long
For as long as you keep the account. Deleted photos go to a bin you can pull them back out of, and they leave storage when you empty it or close the account.
Your rights
You can export your photos from inside the app whenever you want, and delete individual items, albums or the entire account yourself — see deleting your account. If you want a copy of what's held or a correction to it, write to info@kynto.eu. You can also complain to your national data protection authority, which in the Netherlands is the Autoriteit Persoonsgegevens.
Changes
If this policy changes, the date at the top changes with it.