Privacy policy

Who is responsible for your data

Darkbroom is operated by ZeelotWeb, based in Columbus, Ohio, USA. ZeelotWeb decides how your personal data is used on darkbroomphotography.com and is responsible for it. This policy explains what we collect, why, who sees it, how long we keep it and the choices you have.

What we collect

• Account details: your name, handle, email address, date of birth, password (stored only as a secure hash), language, and your Google account ID if you sign in with Google.
• Family: who is in your family, your children’s profiles (see below) and your parent PIN, stored only as a secure hash.
• Profile: your bio, profile photo and cover.
• What you post: photos, captions and anything else you share.
• Safety records: reports you make or that are made about you, and moderation decisions.
• Technical data: IP address, browser and device type, and logs of requests to our servers, which we use to keep the service working and secure.

Children’s data

Darkbroom is used by families, including children. We ask for a date of birth when you join so we can apply the right protections. If a child under 13 tries to sign up, we turn them away and don’t keep the date of birth or anything else they entered.

Children under 13 don’t have accounts. A parent adds them as a profile inside the parent’s own account, and for each child we keep only a nickname, a picture chosen from our set, a birth year and the settings the parent picks. No email, full name or photo of the child. The parent can change or delete the profile at any time, and it is deleted with the family when the last parent’s account goes.

Teens can link their own account to a parent’s family with a code from that parent, and either side can undo the link.

We never sell children’s data, never use it for advertising, and collect only what their account needs to work.

How we use your data

• To run your account and show your content to the audiences you choose.
• To keep Darkbroom safe: preventing fraud and abuse, reviewing reports, and enforcing our Terms.
• To send you service emails, such as sign-in and verification emails and notices about your account. We don’t send marketing emails without your permission.
• To meet our legal obligations, including responding to lawful requests from authorities.

Where privacy law requires a legal basis (for example in the EU and UK), we rely on: performing our contract with you; our legitimate interest in running a safe service; the consent of a parent or guardian for children’s accounts where the law requires it; and legal obligation where the law requires us to keep or share something.

What other members can see

• Signed-in members can see your name, handle, bio and profile photos.
• Your email and date of birth are never shown to other members.

Photos, videos and files

All photos and videos are stored privately and are only ever sent to members who are allowed to see them. We remove location and device information (such as GPS coordinates and camera details) from uploads.

Who we share it with

We don’t sell your personal data, and we don’t share it for advertising. We share it only with:

• Resend, to send our emails.
• Google, if you choose to sign in with Google.
• Our hosting and infrastructure providers, which store and run Darkbroom for us.
• The National Center for Missing & Exploited Children (NCMEC), law enforcement, courts or regulators when the law requires it, or to protect someone from serious harm.
• A buyer or successor if ZeelotWeb’s business is sold or merged, under the same protections described here.

These providers may process data in the United States and other countries. Where required, we use appropriate safeguards for international transfers.

Cookies

We only use cookies that Darkbroom needs to work: to keep you signed in (including “remember me” if you choose it), to protect forms against forgery, and to remember your language. We don’t use advertising or cross-site tracking cookies.

How long we keep it

• Your account and content: while your account is open. If you delete it, it is removed 30 days later, together with your files, unless you sign back in first.
• Server logs and uploads you never finished: kept only briefly, then deleted automatically.

Your choices and rights

• See and correct your details: in Settings at any time.
• Delete your account: in Settings. It is deactivated at once and removed after 30 days.
• Get a copy of your data, or ask us to correct, delete or restrict it: contact us through the link at the bottom of this page.

Depending on where you live (for example the EU, UK or California), you may have further rights, such as to object to how we use your data or to complain to your data protection authority. We will respond to requests within the time the law requires and won’t treat you differently for using your rights. We may need to confirm your identity first.

Security

We protect your data with encryption in transit, private file storage, access limited to staff who need it, and optional two-factor sign-in and passkeys. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.

Changes to this policy

We’ll update this policy when our practices or the law change, and change the date at the top. For significant changes we’ll tell you by email or in the app before they take effect.