Privacy Policy

Who We Are

Media Moana stores, searches and shares photos for photographers, at mediamoana.com. It is operated by Jun Zhang, a sole proprietor trading as Media Moana, based in California, United States — the data controller: we decide how the personal data this policy describes is used, and questions or requests about it go to privacy@mediamoana.com.

This policy covers the website, your account and library, and the albums and photos you share with people who have no account.

What We Keep

Your account: your name and email address; your profile picture if you sign in with Google or GitHub; which sign-in methods are linked to the account (the provider and its account id — never a password or the provider's access tokens); the display name you set; and when the account was opened.

Your photos: the files you upload, kept byte for byte; the previews and web-size copies we make of them; the details inside each file — camera, lens, exposure, the date it was taken and, if it has one, its location (GPS); and the place name we look up from that location.

What the analysis found in each photo, unless you turn analysis off: the scene, the objects in it, any text in the frame, landmarks and events, how many people there are, and a 1–5 star rating with what works and what doesn't — and, made from that text, a list of numbers that lets search find the photo by meaning (see Photo Analysis and AI Actions).

A small visual fingerprint and a sharpness score for each photo, worked out on our own servers so bursts and near-duplicates can be grouped. They are stored with the photo and deleted with it.

How your library is organized: folders, favorites, your albums and which photos are in each, what you write for them (a description, captions, chapter titles) and the drafts of those you ask for until you accept or discard them, the links you share them by and their settings (an album password is kept only as a salted hash).

If you set them, the name and the logo shown on the albums you share. We keep the logo as we re-encode it — at most 512 pixels, with no metadata in it — not the file you uploaded.

If you let only the people you add open an album, their email addresses: other people's addresses, which you give us so we can let those people in. We keep them with the album's link, with when each of them first and last opened the album, and write to them only when you ask us to — an invitation to the album — or when they ask for a code. Of each invitation we keep who it went to, when and how often, whether it was delivered and whether its button was used; never the note you write in it.

If you email an album from Media Moana (Email this album), the addresses you type: other people's addresses, which you give us only so that we send each of them that one invitation, and again when you ask. We use them for nothing else — they join no list, and we write to them about nothing else. Of each we keep what we keep of a list's invitation, for as long (below).

Albums others share with you. When you open an album shared only with the people on a list while signed in, we compare your account's email address with that list and, if it is on it, let you in without a code; your library's Shared with me then lists the albums whose list holds that address. On an album anyone with the link can open, Keep in Media Moana adds it to Shared with me too: we keep which album you kept and when, until you remove it, its link is turned off, the album is deleted, or your account or the photographer's is deleted — and list it only while the link would still let you in. The photographer is not told who kept their album, and keeping an album with a password does not keep the password.

The presets and AI actions you run — which photos, which one, when — and the new photos they make.

Your plan: its history, how much of it you have used (storage, AI actions, preset runs) and your Stripe customer id. Card details and invoices are held by Stripe; we never see your card number.

Where you came from when you signed up: the campaign tags in the link that brought you (utm_source, utm_medium, utm_campaign), the domain of the site that sent you, and the first page you opened here. It is kept with your account to count sign-ups by source and, when the link came from a file converter, to show you how to convert your files here; it is part of your data export.

Your email settings — the newsletter and product updates you chose, and which getting-started emails and weekly share summaries we have sent you, with the photos each summary showed.

Messages you send us through the support form or by email.

Feedback you send from inside Media Moana — the Feedback button, or the error page — is only what the form shows you before you press Send: what you write and what it is about (something broke, an idea, other); the page you were on, as its kind of page and never a shared album's link (a shared album is reported as /s/[token]); which button you used; your browser and system, by name and major version; and, from an error page, its error reference — never the error's text. Sent along lists these, and Review shows the exact values, each with a box to untick. Signed in, it carries your account's email address so we can reply; signed out, an address only if you type one, used only to reply. It reaches us as an email in our support inbox, through our servers and our own mail service (Hetzner, Cloudflare, Amazon SES and Google, below), and is kept as long as we need it to deal with it — email support@mediamoana.com to have it deleted sooner.

When someone reports a shared album: the reason, the details they write and — only if they choose to give it — their email address, so we can follow up.

An audit record of account actions — uploads, shares, deletions, the jobs you run, billing changes and refused attempts on your account — each with the IP address and browser it came from. Opening and viewing your own photos is not recorded.

Server logs: what our servers did for each request, tagged with your account id and, on some lines, your email address or IP address.

Visits to our pages, counted without cookies (Website Analytics and Cookies, below).

When someone opens an album you shared, their browser sends us what any website receives — an IP address and browser details — which we use to serve the page, to stop abuse, and to count each visitor once a day in how many people opened the album, without a cookie and without keeping either (Sharing Your Photos, below). They need no account and give us nothing else, unless they report the album or the album is shared only with people you add: then they give us their email address to be sent a code, and we note when they first and last open the album. Someone you invite to an album gets an email from us on your behalf for each invitation you send, ending with a link that stops every such email to them, from anyone — after which we keep only a one-way hash of their address, so that it stays stopped. We keep the code and the address it was sent to only as one-way hashes, and the code works for 10 minutes. A visitor who marks a photo with ♥ gets a cookie holding a random code, so the album knows their hearts again; we keep a scrambled form of that code with each heart, and when it was given — never a name (Sharing Your Photos, below).

How We Use It

To give you the service you signed up for, under our contract with you: your account; storing and showing your photos; reading their details and place names; analyzing them for search; running the presets and AI actions you choose; sharing what you share; your plan and its payments; and the emails the service has to send, such as sign-in links, an export being ready or a payment that failed.

For our legitimate interest in keeping a small service secure, working and affordable: logs and the audit record, the limits that stop abuse, reviewing reports about shared albums, counting visits — to our pages, and to the albums you share, for you — and where sign-ups come from, a few getting-started emails in your first two weeks, and a weekly summary of the views and hearts on the albums you share, in the weeks they had any — each sent only while it still applies to you, and each with a link that turns the rest of them off without touching any other email. You can object to any of these (Your Rights).

On your instructions, for your legitimate interest and ours in delivering what you share to the people you chose: the invitations you ask us to email to the people you let into an album, or to the addresses you type to email one, each with a link that stops every such email to them, from anyone.

With your consent: the newsletter and product updates, which you choose in Account → General → Email Preferences and can leave from the link in any of them.

To meet legal obligations: keeping payment records, answering lawful requests, and reporting child sexual abuse material to the authorities.

To resolve a support request or look into abuse, an authorized Media Moana operator may view your account and library through a read-only administrative mode, whose use is logged — each photo opened this way is recorded against the operator who opened it, not against you; operators never change or delete your content this way.

We do not sell your data, we show no ads, and your photos are used for nothing but the service you asked for.

Photo Analysis and AI Actions

Every photo you upload is analyzed once, on every plan, so you can search for it by what it shows. Analysis is on unless you turn it off in Account → Privacy & GDPR → Photo analysis. From the moment you turn it off, no photo is sent to be analyzed: photos still waiting for their analysis are cancelled, and only a photo already with the model when you turned it off is finished. Photos uploaded before automatic analysis began, while it was off, or still waiting when you turned it off, are analyzed only if you choose Analyze all photos there.

For analysis we send a web-size copy of the photo, 1024 pixels on its longer side, with no location or other details in it. It goes to OpenRouter, which passes it to Google's Gemini model, and we tell OpenRouter to use only providers that neither store nor train on what they are sent. The answer is stored with your photo.

To find photos by what they mean as well as by the words in them, search compares lists of numbers (embeddings): one made from the text of each photo's analysis — never from the photo — and one from what you type in the library's search box. Both are made by Cloudflare's Workers AI, which we call directly; Cloudflare does not store them or use them to train AI models. A photo's embedding is stored with its analysis and deleted with it, and is not made for an account whose photo analysis is off. What you search for is not stored or logged: our server keeps its embedding in memory for at most 10 minutes, so the next page of results does not ask again.

An AI action — restore faces, colorize, upscale, reduce noise, remove dust and scratches or remove background — runs only when you choose it, on the photos you pick. Each photo is sent as a copy made for the purpose: turned upright, scaled down to what the model accepts, and with no metadata, location included. Restoring faces and colorizing run on Replicate; upscaling, reducing noise and removing backgrounds run on fal.ai. Removing dust and scratches uses Topaz Labs' model, which we reach through Replicate, so its copy may also run on Topaz Labs. Each fetches its copy from a temporary link, and we delete the copy an hour later. What Replicate, fal.ai or Topaz Labs keep after answering is governed by their own terms. The result is a new photo; your original is not changed.

Draft captions, when you choose it for an album, sends no photo. It sends text: what the analysis found in each photo to be captioned, the place names and dates of those photos, and the album's title and description — to Anthropic's Claude model, which we call directly and which runs in the United States. Anthropic does not use what we send to train its models, and deletes it within 30 days — unless its automated safety systems flag it as breaking its usage policy, in which case it may keep it for up to 2 years, or the law requires it to keep it. If Anthropic is unavailable or does not answer in time, the same text goes to OpenRouter and on to Google's Gemini model instead, on the same terms as the analysis; a request that timed out may have reached both. The drafts come back as text, kept with the album where only you see them until you accept or discard them; an accepted one is a caption or a chapter title like one you wrote. It needs photo analysis on.

Those are the only model providers your photos are sent to. If an AI action moves to another provider, this page changes first.

We never use your photos, or anything made from them, to train AI models.

There is no face recognition. The analysis can count the people in a photo, but it never identifies them, and we make no face templates of anyone.

Our team also has AI tools of its own for trying out models — chat and image generation, which can reach other model providers, OpenAI among them. They cannot be reached from your account, and they are not run on your photos.

Sharing Your Photos

Your library is private. Nothing in it can be seen by anyone else until you put it in an album and share the album's link.

Anyone with an album's link can view its photos without an account, as the album is at the time they look. An album shows the photos you put in it — chosen one by one, or a folder's and those of the folders inside it when you make it from that folder — and photos you add to it later can be seen through its link too; photos added to that folder afterwards are not. A photo that is in several albums can be seen through the link of each one you share.

Someone who opens an album again sees which photos you added since their last visit, marked as new. Their browser remembers that visit in a cookie for that one album (our Cookie Policy); we keep nothing of it.

Album photos are shown at web size, without their location (GPS) data. If you let visitors download originals, the originals have their GPS data removed as well, unless you also choose to keep it; other details in the file, such as the camera and the date taken, stay in it.

With each photo, an album shows the day it was taken unless you turn that off, and — only if you choose — the camera and its settings, and the country or the city it was taken in: a city's name at most, never its position. Unless you turn them off, an album also shows its highlights first: photos you rated 4 or 5 stars in your own editing software, or — while photo analysis is on — that the analysis did, and the best frame of each burst. An album you share as a Story is divided into chapters — by day, and by long pauses between photos, only while it shows the day; by place only at the level you chose — and where one day has several chapters, each says the part of the day it starts in (morning, afternoon, evening or night), never the time.

If you set a name or a logo, every album you share shows them at the top. If you turn on the watermark for an album, the photos it shows carry your logo: we make a watermarked copy of each one's web-size version, made without any metadata, and never watermark the originals.

For each album you share we also make a larger viewing copy of its photos, up to 2048 pixels on the longer side, for large and high-resolution screens: made without any metadata, location included, and with your logo on it when the album's watermark is on.

When a link is pasted into a messaging app or an email, that app fetches a preview card of the album to show with it: its cover, its title, how many photos it holds and the month they were taken in — each only while the album shows it — with your name and logo if you set them — the watermarked cover if the album is watermarked. A link with a password or a list of people, or whose preview you switch off, gets a card with no photo and no title. The app keeps the card it fetched under its own policy; turning the link off cannot take back a preview already shown.

You can give an album a password and an expiry date; after that date the link no longer opens. Entering the password sets a cookie that lets that browser into that one album for 12 hours; changing or removing the password signs everyone out of it.

Instead of a password, you can let only the people you add open an album, by their email addresses. When you publish the album, or publish it again after adding people, we can email them an invitation on your behalf: from Media Moana, under your name, with the album's cover and a few of its photos — none if you turned its link preview off — and your note if you write one; replies go to your address. You can send one person an invitation to an album again up to 2 times, a day apart, however you send it — taking them off the list and adding them back doesn't start the count over — and one account's invitations reach at most 100 people a day (20 on the Free plan). The invitation's button opens the album without a code for 30 days after it was sent, and its pictures load for 60 days; both stop once you take the person off the list or turn the link off. You can also send the link yourself: whoever opens it enters their address and we email them a 6-digit code; whether an address is on your list is never shown to whoever types it. The code, or the invitation's button, sets a cookie that lets that browser into that one album for 30 days, or until the link expires. Taking someone off the list stops their access on their next visit.

An album anyone with its link can open, with or without a password, can be emailed too (Email this album): you type up to 20 addresses at a time, 100 different addresses in all for one link, and we send each the same invitation — counted in the same 100 people a day, sent again on the same terms. The password is never in it: the email says they need the one you gave them, and its button opens the album as the link does, password and all; it only tells you when it was used. The account's own address is not emailed. Taking an address off the album's Emailed list stops that.

For the people on a list, we keep when each of them first opened the album and when they last did — updated at most once an hour — and nothing else about their visits: you see beside each address whether they have opened it, and on which day. Nobody else on the list sees it. The times are kept with the address, are part of your data export, and are deleted with it. On an album anyone with the link can open, we keep nothing of the kind about anyone — only the count below.

Turning a link off stops the album opening at once, and a photo someone already has open stops loading within about four minutes. Deleting the album or your account turns its link off too; deleting an album never deletes its photos.

Album pages tell search engines not to index them, send no referrer to the sites they link to, and are counted by our page-view counter without the link itself.

You see how many people opened each album you share, and when the last one did. A visitor is counted once a day, without a cookie: we scramble their IP address and browser details together with the album and a random value we make each day, and keep only the scrambled result, until the end of the next day — never the address or the browser details. The day's random value is deleted when the day ends, after which nobody, us included, can tell whose visit a scrambled result was. The same person on another device or network may be counted again. You opening your own album while signed in, and the previews messaging apps make of a link, are not counted. The counts are kept while the link is on, and deleted when you turn it off, delete the album or delete your account.

Visitors can mark the photos they like with ♥, no account needed — an echo of what they liked, not a selection: you see how many hearts each photo has, never who gave them. A heart is remembered by the shared album visitor cookie (our Cookie Policy), set only when a visitor uses it; we keep a scrambled form of its random code, different for each album, with each heart and when it was given, and never a visitor's name, IP address or browser details. A photo's hearts are deleted when it leaves the album, and all of an album's when you turn its link off, delete the album or delete your account.

In weeks people open or love the albums you share, we email you a summary: each album's views and hearts that week, and its most-loved photos as small pictures. Those pictures load from our servers through a link only that email carries, and only for 60 days after it was sent. Turn the summary off in Account → General → Email Preferences, or from the link in any of them; it stops the summary and no other email.

Anyone who views an album can report it to us. A report holds the reason, any details the reporter writes and — only if they choose to give it — their email address. Reports about your albums are deleted when your account is.

Who Else Handles It

Hetzner, in Falkenstein, Germany: the servers that run Media Moana — its databases, the processing of your photos, the place-name lookup and our logs.

Cloudflare: every request to Media Moana passes through its network, which also delivers the mail sent to our addresses. Its Workers AI makes the embeddings search compares, from the text of each photo's analysis and from what you search for (Photo Analysis and AI Actions, above). Your photos are stored in Cloudflare R2, in North America, which encrypts everything it stores; an upload is first written to Cloudflare storage near the person uploading it, wherever they are, and copied from there to North America. It also stores the encrypted backups of our database, in Europe (its Western Europe location), each for at most 56 days.

Anthropic, for Draft captions; OpenRouter and Google, for photo analysis, and for Draft captions when Anthropic is unavailable; Replicate and fal.ai, for the AI actions you run, and Topaz Labs, whose model removes dust and scratches (Photo Analysis and AI Actions, above).

Amazon SES, in the United States (us-east-1), delivers our emails, so it processes your address and the message — and the address of someone you shared an album with, when we send them an invitation you asked us to send, or the code they asked for.

Stripe handles payments; we never see your card number.

Google hosts our support inbox (Gmail), where the messages you send us arrive.

Google or GitHub, if you sign in with them: they tell us your name, email address and profile picture, and learn that you signed in here. Signing in with an email link involves neither.

OpenFreeMap, when you open the map of your library: your browser loads the map images straight from it, so it receives your IP address and the part of the map you look at — never your photos or their coordinates. It sets no cookies.

Nobody else takes part in finding place names: they are looked up from your photos' GPS coordinates on our own servers, in an offline copy of the GeoNames place database, and the coordinates are not sent anywhere for this. Our fonts are served from our own domain too, so no request goes to Google Fonts.

Anyone else only when the law requires it — a court order or another legal process — and we tell you first unless the law forbids it.

International Transfers

The servers that run Media Moana are in Germany. Your photos are stored in North America — an upload first lands in Cloudflare storage near where it is sent from and is copied there — and Cloudflare, OpenRouter, Google, Anthropic, Replicate, fal.ai, Topaz Labs, Amazon, Stripe and GitHub are companies in the United States, so your data is transferred there. Where the law requires a safeguard for such a transfer, we rely on Standard Contractual Clauses and the other safeguards the law approves.

Website Analytics and Cookies

We count visits to this site — the public pages and the app — with Umami, an analytics tool we run on our own servers. Your browser sends its counts to our own domain, so no analytics company receives them. It sets no cookies and stores nothing in your browser, so there is no consent banner and nothing to opt out of.

For each page view it records the page, the site that referred you, roughly where you are (worked out from your IP address, which it does not store), and your browser, operating system, device type and language. Visits are grouped by a hashed identifier that changes every month, so they identify nobody. It also counts a few steps — a sign-up with where it came from, a sign-in, the start and completion of a checkout, a click on the Media Moana link at the foot of a shared album, a ♥ given or taken back on a shared album (never which album or photo), an album suggesting new photos for itself and those photos being added, an upload's size, speed and outcome (never file names) — and how fast pages load for real visitors (Core Web Vitals).

We used Google Analytics until August 2026 and removed it, along with the cookie banner that existed to gate it. The cookies this site sets are all strictly necessary; our Cookie Policy lists each of them, and the other things we keep in your browser.

How Long We Keep It

Your photos, their analysis, your folders and albums: until you delete them or your account.

The trash: a photo you delete waits there for 30 days, during which you can restore it, and is then deleted for good. Emptying the trash, or deleting a photo from it, deletes it at once. A photo deleted for good has its files removed from storage within minutes.

An export: 7 days after it is ready. It can be downloaded only while signed in to your account, and is then deleted from storage.

An album link you turn off is kept as a record, with access to nothing, until your account is deleted. How many people opened it is deleted within the hour of turning it off; the scrambled results behind the count, by the end of the next day. Its visitors' hearts: within the quarter hour of turning it off, and a photo's within the quarter hour of it leaving the album.

The email addresses you let into an album, and when each of them first and last opened it: until you take them off its list — then deleted within the hour — turn its link off, or delete the album or your account. A code sent to one of them: deleted within the hour after its 10 minutes. The record of an invitation you had us send: 90 days after it was sent, or within the hour after you turn the album's link off once a day has passed since it was last sent — the day's limit counts it until then — and with your account. An address that stopped these emails: only as a one-way hash, kept so that it stays stopped. That each of your invitations went — when, with a one-way hash of the address and never the address itself — and that one bounced or was reported as spam: 7 days, counted towards turning your invitations off, even after the invitation's own record is deleted — and, once they were turned off, that record, with your account. So that a run of bounces holds back only your invitations, never anyone else's, our mail service is given a one-way hash of your account with each one — never the account itself — and keeps it with each that bounced or was reported as spam for a day, and the record that it held yours back for 30 days.

The watermarked copies of an album's photos: deleted within the hour once you turn its link or its watermark off or change or remove your logo, and a photo's copy within the hour once you take it off the album or delete it for good (one you move to the trash: when the album is next opened). Your logo: until you replace or remove it, or delete your account.

What a shared album showed each time you published it — its title, description, captions and chapter titles, and which photos — for its last 10 publishes: an older one is deleted when you publish again. Once its link is turned off, all but the last are deleted within the hour, and the last 30 days later — kept that long only for reviewing reports about the album. All of them with your account.

The larger viewing copies of a shared album's photos: deleted within the hour once its link is turned off or expires, its watermark is turned on or off, or your logo changes, and a photo's copy within the hour once you take it off the album or delete it for good (one you move to the trash: when the album is next opened).

The copy of a photo made for an AI action: deleted an hour after it is made.

The audit record of account actions is kept for 3 years; the IP address and browser details in each entry are removed after 90 days. When you delete your account, its entries are anonymized, apart from the record that the deletion took place.

Server logs: 90 days, then deleted automatically.

Database backups: taken every 6 hours, kept encrypted in Cloudflare R2 in Europe, and each expires within 56 days. We never bring a deleted account back from one: if we ever restore a backup, we delete again every account deleted since it was taken.

Addresses mail cannot reach: when email to your address fails for good or is reported as spam, our mail service stops mailing it, and Amazon SES adds it to its own list of addresses not to deliver to, which does not expire. Once your account is deleted our mail service keeps only a one-way hash of the address, so it is still never mailed; its logs keep the address for up to 90 days and its backups for up to 56.

Payment records: Stripe keeps them as long as tax and accounting law requires, which can be longer than your account.

Security

Everything between your browser and Media Moana travels over HTTPS. Your photos are kept in private storage that encrypts what it stores, and they leave it only through links that expire, made for you or for the albums you share.

You sign in with Google, GitHub or a link sent to your email, so we never hold a password of yours. Google and GitHub apply their own protections, including any two-step verification you have turned on.

An operator's view of your account is read-only, and each time one is opened it is logged. If a breach affects your data, we will tell you as the law requires.

Your Rights

Depending on where you live, you may ask to see, correct, delete or take your personal data with you, and to restrict or object to how we use it. Three of these are buttons; the rest reach a person.

To see it and take it with you: Account → Privacy & GDPR → Export your library gives you your originals in their folders, a metadata file for each photo and your account data, at any time and on any plan — over your storage or not.

To delete it: delete your account from the same page. It takes effect at once: any subscription is cancelled first, then everything the account holds — your profile, photos, folders, albums and the reports about them, the addresses you let into your albums or emailed them to and the invitations you had us send, the albums you kept, jobs, email settings and billing records — is erased. Our database keeps a random account identifier and the time of deletion, with no name or email, so that a sign-in session that outlived the account cannot recreate it — and the audit entry recording the deletion. What else outlives the account is listed above: logs, backups, our mail service's hash of an address that could not be reached, Amazon SES's list and Stripe's payment records.

To correct it: change your display name in Account → General. To change the email address on your account, write to us.

To restrict or object: write to privacy@mediamoana.com. You can also turn photo analysis off, and leave the newsletter or product updates at any time.

If someone invited you to an album through Media Moana, the link at the end of the invitation stops every such email to you, from anyone, and the codes you ask for still come. You can also ask privacy@mediamoana.com to delete the record of the invitations sent to your address; if you stopped them, the one-way hash that keeps them stopped stays, and for 7 days after each invitation went, so does the one-way hash that ties it to the account that sent it, in case it bounces or is reported as spam.

You may also complain to the data protection authority where you live, whether or not you have raised it with us first.

Children

Media Moana is not directed to children, and an account requires you to be at least 16. We do not knowingly collect personal information from anyone younger.

If you believe a child has given us personal data, write to privacy@mediamoana.com and we will delete it.

Changes to This Policy

When this policy changes, we post the new version here and change the effective date at the top.

A material change — one that changes what we do with your data — is emailed to the address on your account at least 30 days before it takes effect.

Contact

For privacy questions and requests, write to privacy@mediamoana.com.