Privacy Policy

P3 is operated by the team behind P3, based in India. We are the controller of the personal data described in this policy.

You can reach us about anything in this document at hello@pickpluspost.com. Under India’s Digital Personal Data Protection Act and the IT Rules, that address also serves as our grievance contact.

This policy covers the P3 marketing website at pickpluspost.com, and the P3 photo-sharing service once it is available. P3 is currently pre-launch: no accounts, galleries or photographs exist yet, and the only personal data we handle through the site is described in clause 3.

On this website

• Your cookie choice. Stored in your browser so we do not ask again. This never leaves your device.
• Analytics, only if you accept. Pages viewed, approximate location derived from IP, device and browser type, and how you moved through the site. See clause 6.
• Anything you email us, including a waitlist request — your email address and whatever you write.
• Server logs kept by our hosting provider for security and reliability, which include IP addresses. These are retained only as long as needed for that purpose.

In the P3 service, once it opens

• Account information — the email address, username and password you provide, and the public key your device publishes so others can share galleries with you.
• Gallery information — gallery names and descriptions, event dates, permissions, invitations, sharing settings and photo counts.
• Encrypted photo data — the encrypted files themselves and the encrypted keys that go with them, plus file size, dimensions and format.
• Technical and security data — authentication events, abuse-prevention signals and diagnostic logs.

We aim to collect what operating P3 requires, not everything we could.

Photographs are encrypted on your device before they are uploaded. What reaches our servers is encrypted data and encrypted keys — we do not hold a readable copy of your photographs, and we cannot produce one on request, including in response to a legal demand.

Reactions and comments are encrypted the same way your photographs are — only people with access to a gallery can read them.

Information about a gallery — its name, who was invited, when things happened — is not encrypted in this way and is visible to us in the course of running the service. Privacy is not the same as anonymity, and we would rather say so plainly.

Where the UK or EU GDPR applies, our lawful bases are: consent for analytics, which you may withdraw at any time; performance of a contract to provide the service you have signed up for; legitimate interests in keeping P3 secure, preventing abuse and fixing faults; and legal obligation where the law requires us to retain or disclose something. Where India’s DPDP Act applies, we rely on your consent and on legitimate uses permitted by that Act.

We do not sell personal data. We do not use your photographs, or the contents of your galleries, to train artificial intelligence models, and we do not make them available to anyone else for that purpose.

This site uses PostHog for product analytics, and only after you accept it. Nothing is loaded and no identifier is set until you do. If you decline, or simply never answer, no analytics script runs at all.

PostHog is provided by PostHog, Inc. and processes the data on our behalf. Our instance is hosted on PostHog’s EU cloud (eu.i.posthog.com), so analytics data stays within the EEA. It is retained for the period set on our PostHog plan. Session recording is disabled.

You can change your mind whenever you like — see the Cookie Policy for what is stored and how to withdraw.

We share personal data only with providers who process it on our instructions:

• PostHog, Inc. — product analytics, processed on EU infrastructure and only with your consent.
• Backblaze, Inc. — storage of encrypted photo data in Backblaze B2. Backblaze holds ciphertext only.
• Hosting and database — infrastructure providers chosen for their security and reliability.
• Email delivery — a transactional email provider, for invitations and notices.

We may also disclose information where the law requires it. Because of how P3 is built, such a disclosure cannot include readable copies of your photographs.

We are based in India, and some providers listed above are outside India, the UK and the EEA. Analytics is an exception: it is processed on PostHog’s EU cloud and does not leave the EEA. For every other international transfer we rely on standard contractual clauses or another lawful transfer mechanism.

Account and gallery data is kept while your account is open and for a limited period afterwards, to allow you to reverse a closure. Encrypted photo data is deleted when you delete it or close your account, subject to our standard backup deletion window. Analytics data follows PostHog’s retention setting in clause 6. Emails you send us are kept for as long as reasonably necessary to handle your enquiry.

Depending on where you live you may have the right to access a copy of your personal data, correct it, delete it, object to or restrict how we use it, withdraw consent, and receive it in a portable form. Under the DPDP Act you may also nominate someone to exercise these rights on your behalf.

Write to hello@pickpluspost.com and we will respond within a reasonable time, and in any case within the period the law requires. One limit is worth stating honestly: we cannot give you a readable copy of an encrypted photograph, because we do not have one. You can export your own photographs from within P3, where they are decrypted on your device.

P3 is not intended for children. You must be at least 18, or 16 with the consent of a parent or guardian where your local law permits it, to create an account. If you believe a child has given us personal data, contact us and we will delete it.

Photographs are encrypted on your device before upload. Beyond that we work on authentication, access controls within our own systems, infrastructure security and monitoring. No service can promise that risk will never materialise; we treat protecting your information as engineering work rather than as a statement in a policy.

If a breach occurs that is likely to affect your rights, we will notify you and the relevant regulator as the law requires.

If we change this policy materially we will update the date above and, where the change affects you meaningfully, tell you directly. Continuing to use P3 after a change means the updated policy applies.

Email hello@pickpluspost.com. We do not currently list a postal address; ask there and we will provide one if you need it for a formal notice.

If you are in the UK you may complain to the Information Commissioner’s Office; in the EEA, to your local supervisory authority; in India, to the Data Protection Board once it is operational. We would rather you came to us first.