Where are your photos stored?
Your photos sit on servers inside the European Union, at a Dutch company, and so fall entirely under European law.
Where the disks are is not the whole story. A European data centre owned by an American company also falls under American law (the CLOUD Act), which makes it possible to demand data even when it physically sits in Europe. At Ohhi both the servers and the company sit within the European legal order, so a request for access always passes a European court.
The GDPR protects your data and determines who may access it and under which conditions. Within that, we make our own choices explicit: no ads, no selling of data and no AI training on your photos.
The full explanation, including what this means legally, is in servers in Europe: what it really means. How to strengthen access to your own account is in setting up two-factor authentication.