1. Introduction
Common Tools Co ("we," "our," or "us") operates Selekt, its website, desktop and mobile applications, and related cloud services. This Privacy Policy explains what information we process, why we process it, when it is shared, and the choices available to you.
2. Information We Process
2.1 Data on Your Device
Selekt is local-first. Its local catalogue can include file names and locations, folder structure, thumbnails and previews, EXIF data such as camera settings, capture dates and GPS coordinates when present, tags, ratings, cull status, workflow progress, and app settings. The catalogue is stored in a SQLite database on your device.
Information may leave your device when you choose a feature that requires network processing, including account services, AI analysis, cloud sync, proofing, or product analytics. The information sent depends on the feature you use.
2.2 Cloud and AI Features
When you choose AI analysis or cloud sync, Selekt sends the information needed to provide that feature. Depending on the feature, this can include developed JPEG versions of images, thumbnails, face crops or exports, file names, image dimensions, capture dates, cull status, tags, AI-generated descriptions, and usage or quota records. For RAW files, the current desktop sync path uploads a developed or embedded JPEG rather than the RAW file. A JPEG source image may itself be used as the synced representation.
Amazon Rekognition receives image bytes for selected AI features. Its non-storage operations return labels or face analysis. If you use face grouping, Rekognition stores mathematical face vectors and related metadata in a collection for your account; it does not store the source image in that collection. OpenAI receives text such as tags, scene information, or requested descriptions for applicable AI features. We do not send images to OpenAI in the current implementation.
2.3 Account and Billing Data
When you create or use an account, we process your email address, name and profile image when provided, authentication identifiers, session records, plan and subscription status, and related account activity. Clerk provides authentication. Lemon Squeezy provides checkout, subscription, and billing services and processes payment information under its own privacy terms; Selekt stores subscription identifiers and status, not full payment-card details.
2.4 Website and Product Analytics
The public marketing website uses Cloudflare Web Analytics to measure page views and website performance. It is cookieless and does not use persistent browser identifiers to track visitors across visits. Account, authentication, and proofing routes do not load this beacon.
Release builds of the desktop app have a separate analytics choice that is off unless you consent. If enabled, PostHog receives selected product-usage and diagnostic events. The app disables session recording and applies filters intended to exclude photo names, file paths, shoot and person identifiers, and precise location links. If you sign out, Selekt resets the PostHog person and device identifiers. Website measurement does not change your desktop analytics setting.
During the website transition, older public marketing pages may use Google Ads conversion measurement, Vercel Web Analytics, and Vercel Speed Insights. The account, authentication, and proofing routes retained in that application do not load those optional measurement tools or Cloudflare Web Analytics. The redesigned public pages do not include the Google Ads or Vercel measurement tags.
2.5 Proofing, Communications, and Support
If you publish a proofing gallery, we process the gallery content and settings needed to share it, including image previews, access controls, expiry information, and client favourites. If you join a mailing list, receive a service message, or contact us, we process your email address, message, and related delivery or support information. Loops is used for applicable newsletter and transactional email delivery.
2.6 Selekt beta builds
Beta builds send crash reports, usage and performance data linked to your account with a private code, never your email or name. You can turn each of these off at any time in Settings, Privacy. Release builds ask first.
When account linking is off, telemetry uses a random anonymous code. Account linking has its own switch in Settings, Privacy.
Beta telemetry never sends photos, file names, folder paths, face data or AI prompts. PostHog processes usage and performance data in its US region. Sentry processes crash reports in its US region. PostHog retains data according to the project settings. Sentry retains crash reports for 90 days.
To request deletion of telemetry linked to your account, email hello@selekt.photos. We may need to verify your identity before completing your request.
3. How We Use Information
We use information to:
- provide, secure, troubleshoot, and maintain Selekt;
- run the cloud, sync, AI, proofing, authentication, and billing features you request;
- communicate about your account, service changes, support requests, and opted-in news;
- understand and improve product and website performance when analytics is enabled;
- prevent fraud, abuse, and security incidents; and
- comply with legal obligations and enforce our terms.
4. Service Providers
We disclose information to service providers only for the purposes described in this policy. The services currently used by Selekt include:
- Cloudflare for the redesigned public website and R2 object storage for synced images, thumbnails, and crops;
- Vercel for cloud services and the account, authentication, and proofing web application during the transition;
- Supabase for hosted PostgreSQL records;
- Clerk for authentication and account management;
- Amazon Web Services for Rekognition image analysis and face collections;
- OpenAI for applicable text embeddings, grouping, naming, and descriptions;
- Cloudflare Web Analytics for cookieless website analytics;
- PostHog for consented release desktop analytics, and beta usage and performance data, as described above;
- Sentry for beta crash reports, as described above;
- Lemon Squeezy for checkout, subscriptions, billing, and tax handling; and
- Loops for applicable newsletter and transactional email delivery.
Older public marketing pages may temporarily use Google Ads conversion measurement and Vercel measurement as described above. We may also disclose information where required by law, to protect rights or safety, or as part of a business transaction subject to appropriate safeguards.
5. Storage and Security
Local data: The local catalogue is stored in a SQLite database on your device. Selekt does not currently add database-level encryption to that file. Device or operating-system encryption and access controls that you configure may provide additional protection. Removing the app may not remove photo libraries, catalogues, backups, preferences, or related files stored elsewhere on your device.
Cloud data: Account and product records are stored in hosted PostgreSQL, while synced image files, thumbnails, and crops are stored in Cloudflare R2. Implemented network paths use HTTPS/TLS. Cloudflare states that R2 objects and their metadata are encrypted at rest. Amazon Rekognition states that its stored face vectors are encrypted at rest. We use reasonable administrative and technical safeguards, but no system can guarantee absolute security.
6. Retention and Deletion
We keep personal information for as long as needed to provide the selected features, maintain security and business records, resolve disputes, and meet legal obligations. Retention depends on the type of information and the feature involved. Expired proofing galleries are inaccessible after expiry and are scheduled for deletion after a 30-day grace period.
When an account-deletion request is completed, Selekt is designed to cancel active billing, revoke app sessions, delete the account's Rekognition face collection, remove objects under the account's R2 storage prefix, and delete the account row and associated product records. A delayed R2 recheck runs after outstanding upload links expire. Deletion from provider backups, security logs, billing records, or legally required records may take longer under the provider's retention practices or applicable law.
OpenAI states that API abuse-monitoring logs may be retained for up to 30 days by default, unless longer retention is legally required, and that API data is not used to train its models unless the customer opts in. Other providers retain information under their own terms and our configuration with them.
7. Your Choices and Rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a portable copy of your personal information, or to object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier processing. You may also have the right to complain to your local privacy regulator.
You can change desktop analytics in app settings. To make another privacy request, email hello@selekt.photos. We may need to verify your identity before completing a request.
8. Cookies and Similar Technologies
Our website and applications may use cookies or similar local-storage technologies for authentication, security, preferences, and desktop analytics. Cloudflare Web Analytics on the public marketing website does not use cookies or local storage to identify visitors. Authentication routes may use storage required by Clerk. Blocking essential storage may prevent account features from working.
9. Children's Privacy
Selekt is not directed to children under 13, or the higher minimum age required to consent to data processing in their country. We do not knowingly collect personal information from children below that age. Contact us if you believe a child has provided such information.
10. International Data Transfers
Our providers may process information in Australia, the United States, the European Union, and other countries where they or their subprocessors operate. Those countries may have different privacy laws. Where required, we use contractual or other recognised safeguards for international transfers.
11. Changes to This Policy
We may update this policy as Selekt and its data practices change. We will post the updated policy here, revise the date above, and provide additional notice when required.
12. Contact Us
Questions or privacy requests can be sent to hello@selekt.photos. The operator is Common Tools Co, Australia.