Privacy Policy

This Privacy Policy explains how Modest Foundry (“Dlickr”, “we”, “us”) collects, uses, and protects your information when you use the Dlickr desktop application and website at dlickr.modestfoundry.com (the “Service”).

We are the data controller for the purposes of the EU General Data Protection Regulation (GDPR) and equivalent laws.

Contact: [email protected]

1. The short version

• We never store your photos. Dlickr backs up your Flickr photos by downloading them directly from Flickr to your own computer. The image files do not pass through, and are never stored on, our servers.
• Your Flickr token stays on your device. The authorization that lets Dlickr read your photos is kept in your computer’s operating-system keychain — not on our servers.
• We store only the minimum needed to run accounts, credits, and backup jobs.
• We connect to Flickr on your behalf using read-only access that you authorize, and that you can revoke at any time.
• You can delete all of your associated data from within the app at any time.

2. Information we collect

2.1 Account & authentication data

• Your Flickr user ID, username, and display name (provided by Flickr when you sign in).
• A Flickr OAuth access token (read-only) authorizing Dlickr to list and read your photos on your behalf. This token is stored only in your device’s operating-system keychain (e.g. macOS Keychain, Windows Credential Manager). It is not uploaded to, or stored on, our servers (see §6).

2.2 Service data

• Backup jobs: metadata such as job type, scope (e.g. a search query or target account), status, totals, and timestamps.
• Completed-photo records: the Flickr photo IDs you have successfully backed up (used for resume, progress, and de-duplication). We do not store the photos themselves.
• Credit & transaction records: your credit balance and an append-only ledger of credit grants, purchases, and usage (required for billing accuracy and accounting).

2.3 Payment data

• Purchases are processed by Paddle, which acts as the merchant of record. Dlickr does not receive or store your full payment-card details. We store only a reference to the transaction and the credits granted. See Paddle’s privacy policy.

2.4 Technical data

• Standard request logs (e.g. IP address, timestamps, user-agent, error diagnostics) generated by our infrastructure provider for security, abuse prevention, and reliability.

We do not knowingly collect sensitive categories of data, and the Service is not directed at children under 16.

3. How we use your information (and legal bases)

We do not sell your personal data. We do not use your data for advertising or profiling.

4. Who we share data with (sub-processors)

We rely on the following service providers and third-party content to run Dlickr:

• Flickr / SmugMug — to authenticate and read your photos on your behalf. Flickr privacy policy
• Cloudflare — hosting of our website and backend services, and privacy-first website analytics. Cloudflare privacy policy
• Paddle — payment processing as merchant of record. Paddle privacy policy
• Lorem Picsum (picsum.photos, delivered via Fastly) — serves decorative placeholder images shown on our website and in the Dlickr desktop app. When your browser or the app loads these images, it contacts this service directly, which receives your IP address and standard request data. These images are placeholders and contain none of your photos or personal data. Lorem Picsum

We may disclose information if required by law, to protect our rights, or in connection with a merger or acquisition (with notice where required).

5. International transfers

Your information may be processed in countries outside your own, including the European Union and the United States. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and our providers’ equivalent transfer mechanisms.

6. Data retention

We keep data only as long as needed:

• Flickr access token — kept in your device’s OS keychain while your account is active; removed from your device and revoked at Flickr when you delete your account or disconnect. It is never stored on our servers.
• Credit usage window records — automatically pruned after 7 days (used only for the recent-backup pricing window).
• Completed-photo records — pruned approximately 30 days after a backup job ends.
• Credit/transaction ledger — retained for as long as required for accounting, tax, and dispute resolution (e.g. up to 7 years per local law), then deleted.
• Account & profile data — deleted when you delete your account, except records we must keep by law.

7. Security

• Your Flickr access token is stored only in your device’s operating-system keychain, protected by your OS. It is never uploaded to or stored on our servers.
• The Flickr authorization we request is read-only — Dlickr cannot modify or delete anything in your Flickr account.
• Photos are transferred directly between Flickr and your device and are never stored on our servers.
• Traffic between the app, our backend, and Flickr is encrypted in transit (TLS).
• We apply access controls so that you can only access your own jobs and data.

No system is perfectly secure, but we take reasonable measures to protect your information and will notify you and regulators of a personal-data breach where required by law.

8. Your rights

Subject to applicable law (including GDPR), you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data (“right to be forgotten”);
• Restrict or object to certain processing;
• Port your data to another service;
• Withdraw consent at any time (e.g. by disconnecting Flickr);
• Lodge a complaint with your local data-protection authority.

How to exercise them:

• Delete your account directly in the app (Settings → Delete Account). This permanently removes your Dlickr account, credits, jobs, and backup records, and revokes our access to your Flickr account. (Note: deleting and re-creating an account with the same Flickr identity does not re-grant the free trial credits.)
• For any other request, contact us at [email protected]. We respond within 30 days.

9. Cookies, the website & analytics

• The Dlickr website uses Cloudflare Web Analytics, which is privacy-first: it does not use cookies, does not fingerprint visitors, and collects only aggregate page metrics. Because no personal data is used for tracking, we do not show a cookie-consent banner.
• The website also loads decorative sample images from a third-party service (Lorem Picsum — see §4). As with any externally hosted image, your browser contacts that service directly, so it receives your IP address. These images are placeholders only and carry none of your data. We otherwise do not embed third-party advertising, social, or tracking content on the website.
• The Dlickr desktop app uses no cookies, no advertising, and no third-party trackers. Like the website, it loads decorative placeholder images from Lorem Picsum (see §4), which receives your IP address when those images load; apart from that and the connections to Flickr and our own backend needed to run the app, it loads no third-party content.

10. Changes to this policy

We may update this policy from time to time. We will post the new version here with an updated “Last updated” date and, for material changes, notify you in-app or by email.

11. Contact

Modest Foundry Email: [email protected]

Dlickr is not affiliated with, or endorsed by, Flickr or SmugMug, Inc.