---
title: Privacy at Those Times
url: https://thosetimes.app/privacy
language: en
---

# Privacy at Those Times

How Those Times protects your family photos: private EU storage, no AI training on your data, GDPR rights. Summary of our privacy policy.

This page summarises how Those Times handles your data. The complete, binding [privacy policy](https://studio.thosetimes.app/privacy) is available in the studio. The data controller is ThoseTimes (Paris, France), reachable at [contact@thosetimes.app](mailto:contact@thosetimes.app).

## Your photos stay yours

- Photos you upload and the films we make are stored **privately on Cloudflare R2 in the European Union**. Only you can access them from your account.
- Photos and descriptions are sent to our AI providers (OpenAI, Replicate) **only to produce the film you asked for**. We do not allow their reuse for model training, and **we never train models on your data**.
- You remain the sole owner of your content.

## What we collect

- **Account data:** email address, hashed password, language and theme preference.
- **Content you entrust to us:** photos, descriptions and dates, projects, generated videos.
- **Payment data:** handled by Stripe. Card numbers never reach our servers.
- **Technical data:** IP address, device and browser type, error logs and product usage events (PostHog, EU), used to keep the service working and improve it.

## How long we keep it

Account data, photos, videos and projects are kept while your account is active and deleted at the latest 30 days after you delete your account. Invoices are kept for 10 years (legal obligation). Technical logs are kept up to 13 months.

## Your rights

Under the GDPR you can access, correct, delete, restrict or export your data, object to its processing, and give instructions about it after your death. Write to [contact@thosetimes.app](mailto:contact@thosetimes.app). You can also complain to the CNIL ([cnil.fr](https://www.cnil.fr)) or your local authority.

## Cookies

Only cookies needed to run the service (sign-in, language, theme). No advertising cookies.

## Sub-processors

Supabase (Germany) for accounts, Cloudflare R2 (EU) for files, Stripe (Ireland/US) for payments, OpenAI and Replicate (US) for AI processing, PostHog (EU) for analytics, Contabo (Germany) for hosting. Transfers outside the EU rely on the European Commission's standard contractual clauses.