Privacy Policy
Obscura Studio is operated by Steve Harris, Livingston, Tennessee. This page says what Obscura collects from photographers and from the visitors to their galleries, why, how long it is kept, and how to have it corrected or removed. Nothing is sold and nothing is used for advertising. Last updated September 6, 2026.
What Obscura collects from photographers
Your email address and a bcrypt hash of your password (never the password itself); your studio name, branding and appearance choices; the photos you upload and the edits, presets and galleries you make with them; your plan, and the Square customer and subscription identifiers that connect your account to your billing. Card numbers are entered on Square and never stored by Obscura.
Optionally, a public Community handle, bio and the posts, comments and threads you publish there.
What Obscura collects from gallery visitors
When a photographer turns on the email gate, a visitor enters a name and email to open that gallery. Obscura also records favorites and downloads inside the gallery. All of it is shown only to the photographer who owns the gallery, as their client list; Obscura does not contact gallery visitors.
Site measurements
Obscura counts page views per day, per path and per referring site (only the origin, never the full address), plus a day-scoped visitor hash that cannot be linked across days. No IP address, browser fingerprint, cookie or per-visit record is kept. Cloudflare Web Analytics runs at the network edge on the same cookieless basis.
Where data lives
On server hardware the operator owns, in the United States, behind Cloudflare for TLS and DDoS protection. Photos are stored in MinIO object storage and records in Postgres. The database is backed up nightly and the photo store weekly; backups stay on the same site.
Third parties that process data
Square processes payments and holds card details. Resend delivers transactional email (welcome, password reset, gallery and Community notices) and sees the address and message it sends. Cloudflare terminates TLS and carries the traffic. No data is sold or shared for advertising, and none of these providers may use it for their own purposes.
Email is transactional: account, billing, password reset, gallery activity and Community notifications. Community notification email can be turned off on the Account page. Reply to any message to stop all non-essential email.
Community content is public
Posts, comments, threads, handles and profiles in the Community are visible to anyone on the internet and may be indexed by search engines. Do not post what you would not publish.
Retention
Account data is kept while the account exists. Trashed photos are removed 30 days after deletion. Account deletion is by request to [email protected] and completes within 30 days; the deleted data leaves the backups over the following 30 days.
Security
Passwords are hashed with bcrypt. Traffic is TLS end to end. Login, signup and password-reset requests are rate limited. Photos are served through signed, tenant-checked routes, never from a public bucket. No card data touches the service.
Children
Obscura Studio is for adults. Nobody under 18 may hold an account, and Obscura does not knowingly collect data from children.
Your rights
Email [email protected] from the address on your account to see, correct, export or delete your data. Data stays in the United States apart from what Cloudflare caches at its edge to serve your visitors.
Changes to this policy
Changes appear on this page with a new date.
Contact
Privacy questions: [email protected].