Photographer Data Protection & Rights · v2026-10-15

Privacy Policy

Effective Date: October 15, 2026 · Compliant with EU GDPR, CCPA & Apple App Store / Google Play Policies

The ShutterQuest Privacy Pledge

ShutterQuest is built by photographers, for photographers. We treat your creative work with absolute respect: you retain 100% copyright over your photographs, we do not access your device camera, microphone, or GPS location hardware, we strip embedded GPS coordinates from public files, we do not sell your data to brokers, and we will never use your photographs to train generative artificial intelligence models.

1. Data Controller & Information We Collect

ShutterQuest (operating shutter.quest and app.shutter.quest from Paris, France) acts as the Data Controller under EU Regulation 2016/679 (GDPR). We collect only the information necessary to run monthly photography quests and the 7-day Anonymous Jury:

Account & Profile Data: Your email address, display name, unique handle (@username), optional biography, optional city/region text, optional gear list, and legal consent timestamps (legalConsentVersion, termsAcceptedAt) managed via Firebase Authentication.
Photographic Submissions: Photographs that you deliberately select from your device’s Photo Library or filesystem for monthly quests or portfolio display.
EXIF Optical Metadata & GPS Sanitization: We extract optical metadata (camera make/model, lens, focal length, aperture, shutter speed, ISO, or analog film stock) to verify authentic optical capture. Our server-side image pipeline strips embedded GPS coordinates and private camera serial numbers when generating public display derivatives.
Anonymous Jury & Critique Records: Numerical aperture ratings (1–5) and constructive written critiques across four craft rubrics (Composition, Lighting, Storytelling, Technical Execution), plus immutable sq reputation ledger entries.
First-Party Product Telemetry: Pseudonymous interaction events (screen views, quest filters, submission lifecycle steps) stored in Cloud Firestore (analytics_events) and mirrored to our Apache Iceberg lakehouse in Google Cloud Storage and Snowflake for platform reliability and aggregate community insights. You may opt out at any time via Settings → Privacy & Data → Analytics & Telemetry Opt-Out.

2. Device Permissions & Zero-Intrusion Guarantee

Photo Library Only — No Camera, Microphone, or Background GPS Access

Because serious photographers shoot on dedicated cameras and import edited frames, ShutterQuest is engineered as a Photo-Library-first platform:

Photo Library Selection Only: Used strictly when you explicitly choose a photograph from your library to upload for a quest or avatar (NSPhotoLibraryUsageDescription).
No Camera or Microphone Permissions: Our native apps do not request NSCameraUsageDescription or NSMicrophoneUsageDescription.
No Device GPS Tracking: We do not request device location permissions. City or region tags on profiles and photowalks are entered manually by you as plain text.

3. Copyright Ownership & Generative AI Shield

You own 100% of your work. You retain full copyright, moral rights, and intellectual property in every photograph you upload. By submitting to ShutterQuest, you grant us only a limited, non-exclusive, revocable, royalty-free license to display your image within the platform, during the 7-day Anonymous Jury, and in the Hall of Fame.

🛡️ Zero Generative AI Training Guarantee: ShutterQuest never sells, licenses, or sub-licenses member photographs to third parties or AI dataset brokers, and never trains generative AI models on your photographs. If you explicitly invoke our optional AI Critique Assistant on your own work, your frame is processed transiently via Google Cloud Vertex AI / Gemini under enterprise zero-data-retention configurations.

4. Storage, Sub-Processors & Retention

All user data and photographs are encrypted in transit (TLS 1.3) and at rest (AES-256). Our infrastructure relies on vetted sub-processors bound by GDPR Standard Contractual Clauses (SCCs):

Google Cloud Platform & Firebase: Authentication, Cloud Firestore database, Cloud Storage media hosting, Cloud Functions image sanitization, and Apache Iceberg analytics storage.
Snowflake Inc.: First-party analytics data warehouse powering aggregate community health metrics.
Google Cloud Vertex AI (Gemini API): Optional on-demand critique assistance (zero training retention).
MailerLite: Optional newsletter (The Monthly Dispatch) for double opt-in subscribers only.

5. Your Rights (GDPR Articles 15–22 & CCPA)

Regardless of your geographic location, we extend full European Union GDPR and California CCPA rights to every photographer:

Self-Serve JSON Data Portability (Art. 15 & 20): Generate and copy a complete machine-readable JSON archive of your profile, signed legal consent receipts, submissions, critiques, and sq ledger at any time via Settings → Privacy & Data → Export My Data.
Immediate Account & Portfolio Erasure (Art. 17): Permanently delete your account directly inside the app via Settings → Account → Delete Account. This immediately purges your profile, submissions, votes, critiques, notifications, and stored image files.
Supervisory Authority: EU residents have the right to lodge a complaint with the French Data Protection Authority (CNIL — www.cnil.fr) or their local supervisory authority.

6. Contact & Related Policies

For privacy inquiries, GDPR/CCPA requests, or DPO correspondence, contact us at privacy@shutter.quest (Paris, France).