Tribalbum Privacy Policy

Last updated: October 21, 2026

This policy describes how data is handled in the “Tribalbum” mobile app for iOS and Android (identifier com.opharana.tribalbum) and on the pages of this website, including the one that opens an album in the browser (tribalbum.com/i/) (together, “Tribalbum”). The data controller is OPHARANA LLC, located at 99 Wall Street, Suite 1432, 10005, New York (United States), with contact email hello@opharana.com.

1. Summary

• No sign-up. When you open the app, an anonymous account (a random identifier) is created. Saving your albums with Apple, Google or your email is optional.
• Every album is private: its photos, videos, stamps and comments are seen only by the people who have joined with a link to that album. Nothing is public or indexed.
• Photos of children are added by their parents or guardians, or by someone with their permission. We use them for nothing other than showing them to their family: no facial recognition, no artificial intelligence, no advertising with them and no selling them.
• The app shows ads from Google AdMob (never on top of a photo) with your consent where the law requires it.
• Payments for Tribalbum Family and for “no ads” are processed by Apple or Google; we never see your payment details.
• What’s deleted is truly deleted, from storage too. You can delete your data from the app (section 8).

2. Data we process

2.1. Your account

When you open the app for the first time, an anonymous account is created with our database provider, Supabase: a random identifier and the session data that lets us recognize you. It contains no name, email or phone number. To protect the service, Supabase records the IP address and technical data of connections.

Optional account (“Save your album”). If you decide to save your albums so you don’t lose them when you change phones, we also process the data you sign in with: with Apple, your Apple ID identifier and the email Apple gives us (it may be a forwarding address if you choose “Hide My Email”); with Google, your account identifier, your email and, because Google sends it, your name and the address of your profile picture (we neither use them nor show them); with email and password, your email and your encrypted password. If you sign in to an account that already existed, the app brings over to it whatever was in your anonymous account.

2.2. Albums

For each album we store its name (for example, the child’s or “The Garcia Family”) and, if whoever creates it enters it, the child’s date of birth, which is used only to calculate the age shown on each photo. For each person in the album we store the name the family sees them by (“Mom”, “Grandma Linda”), their permission (add photos or just look), whether they want notifications and when they last saw the album (to notify them of what’s new).

2.3. Photos and videos

Before a photo is uploaded, the app creates a lighter copy on your phone (2048 pixels on the long side) and a thumbnail. That new copy doesn’t carry the camera’s hidden data, such as the GPS location. From the original photo we read only, on your phone, the date it was taken, to sort it in the archive. Videos are uploaded just as your phone’s system hands them over and may keep some data from the original file; the app uses only their duration and dimensions.

We also store who uploaded each photo and when, the headline of each batch if one is written, the stamps (reactions) and the comments, with the name of whoever adds them. Photos and videos are kept in a private Supabase storage in the European Union (Ireland) and can only be viewed through signed links that expire after 24 hours and are sent only to the album’s members.

2.4. Notifications

If you accept notifications, we store your device’s notification token (from Expo, which in turn uses Apple’s or Google’s service), the platform and your language, to send you a notification when someone posts photos in your albums. The notification states the album’s name, who added photos and how many. You can turn them off per album in the app or in your phone’s settings.

2.5. Reward for inviting

To apply the promotion of one free month for every 3 new family members who join with your links (details in the Terms), we store which link each person joined with, who created that link, how many new people you have brought, how many months you have earned and until when your free month lasts.

2.6. Advertising (Google AdMob)

The app shows ads through Google AdMob: an ad slot between the stories on the front page and, at most, one full-screen ad when you close the viewer of a new batch. Never on top of a photo. Google may process, among other things, the device’s advertising identifier (IDFA on iOS, AAID on Android), device data, approximate location derived from the IP address and interactions with ads, according to the Google Privacy Policy and its information on how Google uses data when you use partner sites or apps. No photo, video, name, comment or other data from your albums is sent to advertising.

With the app in Spanish, ads from TuIAgencia, the owner’s agency, are also shown; they use no personal data.

2.7. In-app purchases (Tribalbum Family and “no ads”)

All purchases are processed by Apple (App Store) or Google (Google Play). We don’t receive or store your card or billing details. To validate a purchase, restore it and apply its benefits on the server we use RevenueCat, which receives your Tribalbum account identifier and the store’s receipt, and tells us what you have bought and until when it lasts. We store only that: the plan (how many people), until when, which album it applies to and which people in that album get a spot from whoever pays. The people in the album can see who has a plan spot.

2.8. The album in the browser

When you open an album with its link in the browser (tribalbum.com/i/), an anonymous account is created as in the app and its session is kept in your browser’s local storage, so that next time you go straight in. We also keep there whether you want large print. That storage is necessary for the service you ask for and is not used for anything else. The other pages of the site store nothing.

2.9. Reports and messages

If you report a photo or a comment, we store what you reported, in which album and when, so we can review it. If you write to us at hello@opharana.com, we process your email and whatever you tell us to help you.

3. Purposes and legal bases (GDPR)

4. Advertising and your consent

• EEA, United Kingdom and Switzerland: before any Google ad is loaded, the app shows Google’s consent form (UMP). If you decline personalized advertising, the ads are not personalized.
• iOS: in addition, Apple’s tracking prompt (ATT). If you don’t allow it, the IDFA is not used.
• Changing your mind: in the app, You → “Ad privacy” or “Permission for personalized ads”; or in the system settings.
• With “no ads”, with a Tribalbum Family spot or with the free month for inviting, the app loads no advertising.

5. Recipients of the data

In addition, what you upload to an album is seen by its members. We don’t sell your data or share it with any third parties other than those listed.

6. International transfers

The database and the photos are on Supabase servers in the European Union (Ireland). The controller is in the United States, and some providers (Apple, Google, RevenueCat, Expo and Vercel) may process data outside the European Economic Area. These transfers rely on the European Commission’s Standard Contractual Clauses and/or adequacy decisions (such as the EU-U.S. Data Privacy Framework).

7. Retention

Your data is kept for as long as you use Tribalbum. Each photo and each video is kept until it is deleted by whoever uploaded it or by the album owner, or until the album is deleted. When something is deleted, the file is removed from storage immediately or, at the latest, in the next daily sweep. Uploads that are left half-finished are deleted the next day. Notifications already sent are deleted after 30 days. Data processed by Google, RevenueCat and Expo is kept according to their own retention periods.

8. How to delete your data

From the app: You → “Delete my data”, with confirmation. Once you confirm, the following are deleted immediately and forever:

• the albums you created, with all their photos, videos, stamps and comments, including the family’s (if you want your family to keep an album, hand it over to someone else in Family first);
• your photos and videos in other people’s albums, your stamps and your comments;
• your presence in all albums, your phones registered for notifications and the promotion data;
• your account (anonymous, Apple, Google or email), unless you also use it in another OPHARANA LLC app, in which case only the Tribalbum data is deleted.

Files are removed from storage at the same time or, at the latest, in the next daily sweep. What you bought in the store is not lost: you get it back with “Restore purchases”. Deleting your data does not cancel the subscription, which is managed through Apple or Google.

If you can’t use the app, write to us at hello@opharana.com from your account’s email, or with the album’s name and the name you appear under, and we will delete it ourselves.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent by writing to hello@opharana.com. We will reply within one month. You can also lodge a complaint with the supervisory authority; in Spain, the Spanish Data Protection Agency (aepd.es).

10. Minors

Tribalbum is for adults and for people over 14; it is not directed at children and we do not knowingly collect data from people under that age as users. Children appear in photos because their parents or guardians upload them, or family members with their permission, who are responsible for having that permission.

That is why we treat those images with the utmost care: albums are private, are not indexed or published, we apply no facial recognition or artificial intelligence, we do not use them for advertising and they are truly deleted. If you are the parent or guardian of a child who appears in an album and you want a photo removed, ask whoever uploaded it or the album owner, or write to us at hello@opharana.com and we will do it ourselves.

We have zero tolerance for any content that sexualizes or endangers a minor: we delete it, close the account and report it to the competent authorities.

11. Security

Communications are encrypted (TLS). The database cannot be read directly: the app only uses functions that check your session and your permission on every call. The photo storage is private: it only accepts uploads to the path the server has reserved for you and only gives 24-hour links to the members of each album.

12. Changes to this policy

If we change it, we will publish the new version at this same address (https://tribalbum.com/en/privacidad) with its date. Substantial changes will be announced in the app.

13. Language

This policy is published in several languages. In case of discrepancy, the Spanish version prevails.

14. Contact

OPHARANA LLC
99 Wall Street, Suite 1432, 10005, New York, United States
hello@opharana.com