Privacy
Last updated: 4 October 2026
This is a translation of the original Dutch version. In case of any discrepancy, the Dutch text prevails.
What you share stays yours. We don’t sell your data, we show no ads, we don’t use your photos or videos to train AI models, and we don’t pass anything on to third parties for marketing purposes. Below is exactly what we do do.
What we store
- Account: email address, name (optional), date of birth, and a hashed version of your password. If you are 13 to 15, also the email address of your parent or guardian.
- Country: when you create your account we derive which country you are in from your IP address, and store only that country code — so “NL”, not your city, postcode or IP address. If your account already existed before we started doing this, it happens the next time you sign in. We use it to decide which features we can offer in your country (currently only face recognition) and to work out your local time as long as we don’t know your time zone.
- Photos & videos: the files themselves plus the associated EXIF metadata (camera, date, GPS if it was embedded in the file). Plus IP address and user agent for each upload.
- Folder structure and sharing settings: the folders and sharing options you create yourself.
- Comments and likes: what you leave on shared photos and videos, visible to the other members of that circle.
- Derived data: face clusters (only if you’ve enabled face recognition on your profile — off by default), automatic tags, and thumbnails. These are generated locally on our own servers; we never send your photos to external AI APIs.
- Push notification token: if you enable notifications on your phone or in your browser, Apple, Google or your browser gives us a device token. We only use it to send you notifications about your circle, such as new photos shared with you, invitations and reactions to what you share.
- Payment data: if you take a paid subscription on ohhi.nl we use Mollie (NL) to process the payment. We only see whether the payment succeeded, never your IBAN, card number or CVC — those stay with Mollie. If you subscribe in the iOS or Android app, the payment runs through the App Store or Google Play, and we don’t see your payment details there either.
- CV details (cv.ohhi.nl): if you use the CV maker: what you enter there (work experience, education, skills and contact details such as your address, phone number and date of birth) and the CVs you make from it. If you choose a CV photo from your own photos, we keep only the square you cut out, as a separate copy; the rest of the photo never reaches your CV. If you remove the photo, we delete that copy too. For each detail you choose whether it may appear on a CV. Only you can see and edit your CV details. If you switch on a share link for a CV, anyone with that link sees that one CV, with what’s on it; you can switch it off at any time, and then the link stops working. We use your CV details for nothing else.
Retention periods
- Photos, videos and albums: as long as your account is active. If your subscription ends or you switch to a smaller plan and you use more storage than it includes, we freeze what is over the limit and delete it after 30 days, unless you take enough storage again. When you close your account everything is deleted immediately — in practice within minutes from both our database and object storage. There is no recovery window.
- Account: your profile data (email address, name, hashed password, sessions, push tokens) is deleted immediately on cancellation.
- Billing history: invoice records (invoice number, plan, amount, VAT, date and the email address we used as billing address) are kept for at least 7 years to comply with the Dutch fiscal retention obligation (art. 52 AWR). The email address on the invoice is not anonymised — fiscally it belongs to the invoice.
- Security audit logs (IP, user agent): we record login, MFA and account events, and actions such as uploading, deleting and sharing, with IP address and user agent, and for some events your email address too. These records remain after you delete your account and are automatically deleted after 90 days.
- Face embeddings: removed immediately when you disable face recognition, or on account cancellation. If you turn face recognition off, we also remove the small face crops we made from our storage shortly afterwards.
- CV details: for as long as your account is active. Items and CVs you delete are gone straight away; when you close your account we delete everything immediately.
Face recognition & biometrics
Face embeddings fall under special categories of personal data (GDPR art. 9). We only process them after your explicit consent via an opt-in on your profile page. On an account for ages 13 to 15, only a parent or guardian can turn face recognition on. You can withdraw consent at any time; on withdrawal we immediately delete all existing embeddings and clusters.
If you mark which person is you under People (‘This is me’), we use that only to find photos of you, such as when you choose a CV photo in the CV maker (cv.ohhi.nl). It only learns which of your own photos you are in: never other people, names or face data. The mark is deleted with your face data when you turn face recognition off.
Where we store it
All data is held on servers within the European Union. Photos don’t leave our servers for analysis — face detection and tagging also run in our own environment, not via external AI APIs.
Who can access it
Only you and the people you share something with, such as the people you invite to a folder and your travel companions. If you create a share link, anyone with that link can see what you share through it; a share link for a trip shows the photos of all travel companions. We don’t look at your photos; the only exception is an administrator intervening for an acute technical problem, in which case we log what was viewed.
Errors and crash reports
To find and fix bugs quickly we collect technical crash reports from the app and website. A report contains your user ID, the error type, the location in the code and the HTTP route — no email address, no IP address, and no contents of photos, comments or upload requests. The reports run on our own server; no third party receives them. Retention: 90 days.
What we don’t do
- No ads or ad networks
- No tracking cookies or third-party analytics
- No training of AI models on your photos
- No sale or transfer of data to third parties
Cookies
On ohhi.nl we use two strictly necessary cookies: ohhi_token remembers your login session and ohhi_locale your language preference. On cv.ohhi.nl there are also login cookies: cv_at and cv_rt keep you signed in, and cv_oauth is only used while you sign in. No tracking cookies, no third-party analytics, no consent banner needed.
Visitor counts
For our public pages — like this one — we keep track of how often they are viewed. That runs on a simple counter on our own server: per day we add up how often a page was opened, in which language, what kind of source it came from (a search engine, for instance), which campaign tag the link carried, if any, and whether the visit came from a person or a known crawler.
Nothing is stored on your device in the process: no cookie, no local storage, no visitor ID. We keep no IP address, no browser characteristics and no session, so we cannot tell whether you come back and cannot tie a visit to a person. Nothing goes to an outside party either. Inside the logged-in app we count nothing at all.
Sub-processors
We use a limited number of partners to run Ohhi — each under a data processing agreement. The original storage of your photos and videos is with Hetzner in the EU; delivery runs through Bunny CDN, which may briefly cache them at edge locations worldwide. For partners outside the EU/EEA we rely, where required, on the European Commission’s Standard Contractual Clauses (SCCs) or a valid adequacy decision.
Your rights
Under the GDPR you have the right to access, correct, erase, restrict, port and object to the processing of your data. For any of these requests — including a data export — Open een support-ticket from your account. We respond within 30 days. Not happy with our response? You can lodge a complaint with the Dutch Autoriteit Persoonsgegevens or your local data protection authority.