Privacy Policy

This Privacy Policy explains how PhotoJam (https://photojam.co) handles personal data, cookies and local storage of visitors, in line with Brazil's General Data Protection Law (Lei nº 13.709/2018, LGPD) — the applicable law given that PhotoJam operates from Brazil. By using PhotoJam, you agree to the practices described here.

1. Who is the data controller

PhotoJam is the controller of the personal data processed through this site, for the purposes described in this policy. Questions, requests or the exercise of rights can be sent to hello@photojam.co.

2. The core principle: your photos never leave your browser

The PhotoJam editor runs entirely in your browser (client-side). When you open an image to edit, it is processed locally by your computer: the file, the edited result and the undo/redo history are never sent to our servers. The only storage that exists is the autosave in IndexedDB, a local database of your own browser, so your project stays available if you close the tab. This means that, for the content of your edits, PhotoJam collects, transmits or stores no data remotely at all.

3. What data we process

Since the editor requires no sign-up or login, the data we process is limited to:

• Access and infrastructure data: IP address, browser type, pages accessed and access times, collected automatically by our hosting provider (Vercel) for operation, security and diagnostics of the service.
• Necessary local storage: the project saved in IndexedDB and preferences such as theme (light/dark) and selected tool, stored only in your browser; they never reach us.
• Optional cookies/storage: only if you consent in the cookie banner. Used today to remember your consent preference; analytics and advertising categories are set up for when those services are activated (see section 6).

4. Legal basis for processing

• Service performance / legitimate interest: access and infrastructure data, necessary to operate and protect the site (LGPD art. 7, IX).
• Consent: non-essential cookies and storage (analytics, advertising), collected only after your explicit authorization in the cookie banner (LGPD art. 7, I), which can be revoked at any time.

5. Who we share data with

We do not sell personal data. We share data only with:

• Vercel (hosting and infrastructure), which processes access data to serve the site and may be located outside Brazil.
• Google AdSense (advertising network): shows ads on the site, and only receives your data (such as advertising identifiers) if you consent to advertising cookies in the banner. Learn more at how Google uses data from partner sites.
• Analytics tool (when activated): only if you consent to analytics cookies. None is active today.

When a new advertising or analytics service is activated, this policy will be updated with the provider's name before activation.

6. Cookies and local storage

We use the categories below. You decide which optional categories to accept through the banner shown on your first visit, and can review your choice at any time using the button below.

• Necessary (always on): local storage for the editor to work (project autosave, theme) and to remember your cookie choice. Do not require consent, as they are strictly necessary for the service you requested by opening the site.
• Analytics (optional): would help us understand aggregate site usage. Not active today.
• Advertising (optional): used by Google AdSense to show ads. Only loaded after you accept this category.

7. International transfer

Our hosting infrastructure (Vercel) operates in global data centers, which may involve international transfer of access data. These transfers follow the provider's contractual and technical safeguards, in line with LGPD art. 33.

8. How long we keep data

Access and infrastructure data is retained for the hosting provider's standard log period, typically a few weeks, and then discarded. Local storage (autosave, preferences) stays in your browser until you clear the site's data or delete it manually. We have no access to it and no retention period to define, since it never reaches our servers.

9. Information security

We adopt reasonable technical measures to protect the data we process, including encrypted connections (HTTPS) across the whole site and hosting infrastructure with its own security practices. Since the content of your edits never leaves your browser, the main exposure risk for that data is under your own control (for example, the browser or device you use).

10. Your rights as a data subject

Under LGPD art. 18, you have the right to:

• Confirmation that processing exists;
• Access to the data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary data or data processed non-compliantly;
• Portability to another service provider;
• Deletion of data processed with consent;
• Information about entities we share data with;
• Withdrawal of consent, at any time;
• Objection to processing based on other legal grounds, in case of non-compliance.

To exercise any of these rights, write to hello@photojam.co. We will respond within a reasonable time.

11. Children and teenagers

PhotoJam is not directed at people under 18 and we do not intentionally collect data from children or teenagers. Since the service requires no sign-up, we do not collect identifying data from any user, regardless of age.

12. Changes to this policy

We may update this policy to reflect changes to the service (for example, when activating an advertising network or analytics tool). The “last updated” date at the top of this page always reflects the version in effect. Relevant changes will be communicated visibly on the site.

13. Contact

Questions about this Privacy Policy or how we handle personal data can be sent to hello@photojam.co.