1. Introduction
Common Tools Co ("we," "our," or "us") operates Selekt, its website, desktop and mobile applications, and related cloud services. This Privacy Policy explains what information we process, why we process it, when it is shared, and the choices available to you.
2. Information We Process
2.1 Data on Your Device
Selekt is local-first. Its local catalogue can include file names and locations, folder structure, thumbnails and previews, EXIF data such as camera settings, capture dates and GPS coordinates when present, tags, ratings, cull status, workflow progress, and app settings. The catalogue is stored in a SQLite database on your device.
Information may leave your device when you choose a feature that requires network processing, including account services, AI analysis, cloud sync, proofing, or product analytics. The information sent depends on the feature you use.
2.2 Cloud and AI Features
When you choose AI analysis or cloud sync, Selekt sends the information needed to provide that feature. Depending on the feature, this can include developed JPEG versions of images, thumbnails, face crops or exports, file names, image dimensions, capture dates, cull status, tags, AI-generated descriptions, and usage or quota records. For RAW files, the current desktop sync path uploads a developed or embedded JPEG rather than the RAW file. A JPEG source image may itself be used as the synced representation.
Amazon Rekognition receives image bytes for selected AI features. Its non-storage operations return labels or face analysis. If you use face grouping, Rekognition stores mathematical face vectors and related metadata in a collection for your account; it does not store the source image in that collection. OpenAI receives tag names for applicable tag-grouping features. When you use Auto-organize while signed in, Selekt may also send representative photo thumbnails, current scene names, photo counts, and the shoot name or description where provided to OpenAI through Selekt's cloud to suggest scene names. The image-reassignment step may send additional thumbnails with image and scene identifiers and current scene names to suggest which scene a photo belongs in. These paths do not send original full-resolution photo files to OpenAI.
2.3 Account and Billing Data
When you create or use an account, we process your email address, name and profile image when provided, authentication identifiers, session records, plan and subscription status, and related account activity. Clerk provides authentication. Lemon Squeezy provides checkout, subscription, and billing services and processes payment information under its own privacy terms; Selekt stores subscription identifiers and status, not full payment-card details.
2.4 Website and Product Analytics
On the redesigned public website, PostHog analytics remain off until you allow them in that browser and remain off when the browser sends a Do Not Track signal. If allowed, we measure page views and selected actions such as download and call-to-action clicks. We may record the page visited, a referring domain, allowlisted campaign details, and technical browser information. Session recording, automatic element capture, application-error capture, and performance capture are disabled on these pages. You can change your choice through the Analytics preferences control in the footer.
Desktop analytics starts off when no preference has been saved. During setup, the analytics switch is preselected on. Finishing setup with that switch on enables product analytics; skipping setup without changing it leaves analytics off. You can change your choice in Settings at any time. If enabled, PostHog receives selected product-usage and diagnostic events. The app disables session recording and applies filters intended to exclude photo names, file paths, shoot and person identifiers, and precise location links. If you sign out, Selekt resets the PostHog person and device identifiers. Website and desktop choices do not control one another.
During the website transition, older public marketing pages may use Google Ads conversion measurement, Vercel Web Analytics, and Vercel Speed Insights. The account, authentication, and proofing routes retained in that application do not load those optional measurement tools or PostHog. The redesigned public pages do not include the Google Ads or Vercel measurement tags.
2.5 Proofing, Communications, and Support
If you publish a proofing gallery, we process the gallery content and settings needed to share it, including image previews, access controls, expiry information, and client favourites. If you join a mailing list, receive a service message, or contact us, we process your email address, message, and related delivery or support information. Loops is used for applicable newsletter and transactional email delivery.
3. How We Use Information
We use information to:
- provide, secure, troubleshoot, and maintain Selekt;
- run the cloud, sync, AI, proofing, authentication, and billing features you request;
- communicate about your account, service changes, support requests, and opted-in news;
- understand and improve product and website performance when analytics is enabled;
- prevent fraud, abuse, and security incidents; and
- comply with legal obligations and enforce our terms.
4. Service Providers
We disclose information to service providers only for the purposes described in this policy. The services currently used by Selekt include:
- Cloudflare for the redesigned public website and R2 object storage for synced images, thumbnails, and crops;
- Vercel for cloud services and the account, authentication, and proofing web application during the transition;
- Supabase for hosted PostgreSQL records;
- Clerk for authentication and account management;
- Amazon Web Services for Rekognition image analysis and face collections;
- OpenAI for tag-name embeddings and group labels, and image-assisted scene naming and reassignment;
- PostHog for consented website and desktop product analytics;
- Lemon Squeezy for checkout, subscriptions, billing, and tax handling; and
- Loops for applicable newsletter and transactional email delivery.
Older public marketing pages may temporarily use Google Ads conversion measurement and Vercel measurement as described above. We may also disclose information where required by law, to protect rights or safety, or as part of a business transaction subject to appropriate safeguards.
5. Storage and Security
Local data: The local catalogue is stored in a SQLite database on your device. Selekt does not currently add database-level encryption to that file. Device or operating-system encryption and access controls that you configure may provide additional protection. Removing the app may not remove photo libraries, catalogues, backups, preferences, or related files stored elsewhere on your device.
Cloud data: Account and product records are stored in hosted PostgreSQL, while synced image files, thumbnails, and crops are stored in Cloudflare R2. Implemented network paths use HTTPS/TLS. Cloudflare states that R2 objects and their metadata are encrypted at rest. Amazon Rekognition states that its stored face vectors are encrypted at rest. We use reasonable administrative and technical safeguards, but no system can guarantee absolute security.
6. Retention and Deletion
We keep personal information for as long as needed to provide the selected features, maintain security and business records, resolve disputes, and meet legal obligations. Retention depends on the type of information and the feature involved. Expired proofing galleries are inaccessible after expiry and are scheduled for deletion after a 30-day grace period.
When an account-deletion request is completed, Selekt is designed to cancel active billing, revoke app sessions, delete the account's Rekognition face collection, remove objects under the account's R2 storage prefix, and delete the account row and associated product records. A delayed R2 recheck runs after outstanding upload links expire. Deletion from provider backups, security logs, billing records, or legally required records may take longer under the provider's retention practices or applicable law.
OpenAI states that API abuse-monitoring logs may be retained for up to 30 days by default, unless longer retention is legally required, and that API data is not used to train its models unless the customer opts in. Other providers retain information under their own terms and our configuration with them.
7. Your Choices and Rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a portable copy of your personal information, or to object to certain processing. Where processing relies on consent, you may withdraw it without affecting earlier processing. You may also have the right to complain to your local privacy regulator.
You can change website analytics through the footer control and desktop analytics in app settings. To make another privacy request, email hello@selekt.photos. We may need to verify your identity before completing a request.
8. Cookies and Similar Technologies
Our website and applications may use cookies or similar local-storage technologies for authentication, security, preferences, and analytics. On redesigned public pages, PostHog is not loaded until you allow optional analytics and remains off when Do Not Track is enabled. If allowed, PostHog may store a persistent identifier and analytics state in the browser. Authentication routes may use storage required by Clerk. Blocking essential storage may prevent account features from working.
9. Children's Privacy
Selekt is not directed to children under 13, or the higher minimum age required to consent to data processing in their country. We do not knowingly collect personal information from children below that age. Contact us if you believe a child has provided such information.
10. International Data Transfers
Our providers may process information in Australia, the United States, the European Union, and other countries where they or their subprocessors operate. Those countries may have different privacy laws. Where required, we use contractual or other recognised safeguards for international transfers.
11. Changes to This Policy
We may update this policy as Selekt and its data practices change. We will post the updated policy here, revise the date above, and provide additional notice when required.
12. Contact Us
Questions or privacy requests can be sent to hello@selekt.photos. The operator is Common Tools Co, Australia.