Privacy policy

• Your account. Your name and email address, and your password stored only as a one-way hash. If you sign in with Google, we receive your name, email address, profile picture and Google account identifier instead of a password.
• Sign-in activity. When you signed in and were last active, and for each session the IP address and browser it came from.
• Your photographs. The originals exactly as you upload them, including the metadata inside the file — camera settings and, if your camera recorded it, the GPS location where the photograph was taken. We also keep a smaller preview of each one, which carries no metadata.
• What you add. Ratings, picks and rejects, tags, captions and collections.
• What Peak works out. For each photograph, its dominant colours, a short fingerprint used to spot duplicates, and a numerical description of what it shows, used to find similar pictures. These are computed in your browser or on our own server; no photograph is sent to an AI provider, and none is used to train a model.
• Messages you send us through the feedback button: the text, its category, the page you wrote it from, and your name and email so we can reply.
• How the site is used. Pages visited, clicks, errors, and recordings of sessions in the app — see Analytics below.

If you choose to sign in with Google, Peak asks Google only for your basic profile: name, email address and profile picture. We use them to create your account and sign you in, and for nothing else. We do not read your Gmail, Drive, Photos or any other Google data, we do not use Google data for advertising, and we do not sell it or pass it on beyond the providers listed below that run Peak.

Peak’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Peak from your Google account at any time from your Google account’s security settings. To delete the Peak account itself, write to us (see Deleting your data).

• To run Peak: store your photographs, show them back to you, search them and keep your edits.
• To send you email about your account — confirming your address, resetting your password when you ask, and telling you if somebody tries to register it again. No newsletters, no marketing.
• To keep Peak working and secure, and to answer you when you write in. When you report a problem, Peak’s administrator can look at your account as you see it — signed in as you, for at most an hour — to find what is wrong.
• To understand how Peak is used, so we know what to fix and build next.

Under the GDPR, we rely on the contract between us (running the service you signed up for), and on our legitimate interest in keeping Peak secure and improving it.

We use PostHog, hosted in the EU, to measure how Peak is used and to catch errors. It records pages visited and clicks, and can record sessions in the app — a replay of what the interface showed, which may include your captions, tags and file names on screen. The events we send ourselves carry counts and durations only, never anything taken from a photograph: no file names, captions, tags, colours or location.

These providers run parts of Peak for us and process data only on our instructions:

• Cloudflare R2 (EU jurisdiction) — stores your originals and previews.
• Convex — the database: your account, photo details and everything Peak works out.
• Vercel — serves the website.
• Fly.io (Paris) — runs our own visual indexing, which reads each photograph through a short-lived link and keeps no copy.
• PostHog (EU) — analytics, session recordings and error reports.
• Resend — sends our email.
• Google — only if you sign in with it.
• Hugging Face — if you index your library from your browser, it downloads the model from Hugging Face, which sees your IP address. No photograph goes to it.

Some of these companies are based in the United States. Where data leaves the EU, the transfer is covered by the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

We do not sell your data, show you ads, or share your photographs with anyone. We would disclose data only if the law required it.

When you download an original, you get the file exactly as you uploaded it — GPS location included. That is deliberate: it is your file. Bear it in mind before you pass one on.

Peak sets cookies that keep you signed in; without them the app cannot work. PostHog stores an identifier in a cookie and in your browser’s storage to recognise return visits.

Your account and photographs are kept for as long as you have an account. Deleting a photograph removes the original and its preview from storage straight away. Messages you send us are kept while they are useful for answering you and improving Peak.

Write to contact@sorbey.co from your account’s address to have your account, photographs and everything derived from them deleted; we will do it within 30 days. You can also ask for a copy of your data, have it corrected, object to how we use it, or ask us to restrict it.

If you are unhappy with our answer, you can complain to your data protection authority — in France, the CNIL.

Peak is not meant for anyone under 16, and we do not knowingly hold their data.

When this policy changes, the date at the top changes with it. If a change matters to how your data is used, we will tell you by email before it applies. See also the terms of service.