Your photos are yours. Here is exactly what we do with them.

Last updated 2 October 2026

Who we are

Infloo is run by Tavo, a technology studio in Rijeka, Croatia. Contact: hello@tavo.company. Tavo is the data controller for the information described here.

What we store

Account: your name and email address, and either a password (stored only as a salted hash, never readable by us) or, if you use Google, the profile picture Google provides. Plus a session cookie so you stay signed in. If you ask for a password reset, the email with the link is sent through Resend.
Events: the title, place, dates and notes you enter.
Photos: the originals you upload and smaller copies we generate for the board. Your browser removes camera metadata, including GPS location, before upload. Photos are stored on servers we operate in Germany.
Approximate location (optional):only if you tick “Keep an approximate location” when uploading. Your browser reads the GPS position from the photo, rounds it to about 1 km (two decimal places), and sends only that rounded value; the exact position never leaves your device. We use it to suggest place names and captions for that photo. It is never shown on share links, and you can remove it from any photo in the editor (“forget”). The box is off unless you turn it on, and turning it off stops it for future uploads.
Curation: the groups, reasons, filter suggestions, songs, captions and warnings generated for each photo, and your edits to them.
Usage:a monthly count of uploads, so we can apply your plan's allowance, and standard server logs (IP address, browser, time) kept for 30 days for security.

How photos are processed

To sort your photos and write the notes, we send a reduced copy of each photo (about 1000 pixels on the long side) together with your event details, and the approximate location if you chose to keep one, to Anthropic's Claude API. Anthropic processes it to return the result and, under its API terms, does not use it to train models. No other third party receives your photos.

Other people in your photos

You are responsible for the photos you upload, including anyone who appears in them. The app flags photos where another person is the subject so you can ask them before posting. Nothing you upload is published by us; sharing happens only when you turn on a share link or download a photo and post it yourself.

Cookies

We use a session cookie for sign-in and a small set of preferences stored in your browser (for example which photos you marked as posted, and whether you keep an approximate location). No advertising or tracking cookies.

Legal basis

We process your account, events and photos to provide the service you signed up for (contract). Approximate location is processed only with your consent, which you give with the checkbox and can withdraw at any time by unticking it or removing the location from a photo.

Retention and deletion

Photos and events, with any approximate location, stay until you delete them. Deleting a photo or an event removes the files from storage immediately. Deleting your account, from Settings, removes your account, events, photos and usage records. Backups are overwritten within 30 days.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, delete it, or object to processing. Most of this you can do in the app; for anything else email hello@tavo.company. You can also complain to the Croatian Personal Data Protection Agency (AZOP).

Changes

If this policy changes in a way that matters, we will say so on the sign-in page before it takes effect.