Privacy Policy

Last updated: July 25, 2025

1. Overview

CasePhotons ("we," "us," or "our") operates the website at casephotons.com (the "Site"), a personal astrophotography gallery. This Privacy Policy explains what information we collect, how we use it, and your rights with respect to that information.

We do not sell, rent, or share your personal information with third parties for advertising or marketing purposes.

2. Information We Collect

We collect the following information when you interact with the Site:

• Account registration (email/password): your email address, display name, and a securely hashed (bcrypt) version of your password. Your plaintext password is never stored.
• Google Sign-In: if you authenticate via Google OAuth, we receive your Google account ID, email address, display name, and profile picture URL as provided by Google. We do not receive or store your Google password.
• Contact form: your name, email address, and message content when you use the "Get in Touch" form.
• Session data: a browser cookie is used to maintain your login session. Session data is stored server-side in our PostgreSQL database.

3. How We Use Your Information

• To create and manage your account and authenticate you on the Site.
• To grant approved users access to downloadable gallery images.
• To respond to messages submitted through the contact form.
• To maintain the security and integrity of the Site.

We do not use your information for automated decision-making or profiling.

4. Cookies & Session Storage

We use a single session cookie (connect.sid) to keep you logged in. This cookie is HTTP-only and secure (over HTTPS in production). It expires after 7 days of inactivity. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

5. Data Retention

• Account data is retained for as long as your account exists. You may request deletion at any time by contacting us.
• Contact form messages are retained until reviewed and manually deleted by the site administrator.
• Session records are automatically purged when sessions expire.

6. Third-Party Services

• Google OAuth: if you choose to sign in with Google, your authentication is handled by Google. See Google's Privacy Policy for details on how Google processes your data.
• Hosting: the Site is hosted on Railway. Infrastructure-level data (logs, IP addresses) may be retained by Railway per their own privacy policy.

7. Data Security

We use HTTPS, secure HTTP headers (via Helmet), bcrypt password hashing, rate-limited login endpoints, and HTTP-only session cookies to protect your data. No system is perfectly secure, and we cannot guarantee absolute security.

8. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.

To exercise any of these rights, please contact us using the form on the home page or email us directly.

9. Children's Privacy

This Site is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us for immediate removal.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Site after changes constitutes your acceptance of the updated policy.

11. Contact

Questions about this Privacy Policy? Use the contact form on the home page.