Selu
Privacy policy
Selu keeps your photographs on your phone and a copy in your account, so you get them back on a new one. That is the whole of what it is for, and this page says exactly what that means for your data.
Who is responsible
The controller of your personal data, in the sense of the GDPR, is Raul Julian de Paula, Troyerstraße 90, Stiege 3, Tür 30, 9020 Klagenfurt am Wörthersee, Austria. Selu is run by one person as a sole trader registered in the Austrian trade register (GISA number 40122809). The full imprint has the details.
You can reach a person about anything on this page at admin@selu.world.
What Selu collects
Only what the app needs to work, and one mark a day that you used it (described below). There is no advertising, no tracking, no analytics service, and no third-party software in the app that reports anything about you to anybody. The app talks to one service and no other.
To have an account
- Your email address, and a password, which is stored only as a cryptographic hash and cannot be read back.
- A username you choose. This is how other people find you, so it is visible to anyone who searches for it exactly.
- Optionally a display name and a short description of yourself, and a profile picture chosen from a photo already in the app.
What you make in the app
- The photographs and videos you take in Selu, along with the time they were taken, their size and dimensions, and how long a video runs. There is no way to import a picture from your phone's gallery, so nothing arrives that was not made here.
- The albums you make: their names, when they started and finished, and how they are arranged.
- Who you are connected to, and which albums you share with whom.
- The messages you send, and anything you send with them.
- Feedback you send from the account sheet: the text, when you sent it, and which account it came from. Only the operator of Selu reads it, and it is deleted with your account.
That you used it
- For each day you open Selu, the date — one mark per day, nothing else: not what you did, not how often, not when in the day. It is only used to count how many people use Selu, and it is deleted with your account.
Selu does not collect your location, your contacts, your phone's identifiers, or anything from other apps. Photographs are not scanned, analysed, or used to train anything.
Why, and on what legal basis
- To provide the app you asked for — your account, your albums, backing them up, sharing them with people you choose. This is performance of a contract with you, Art. 6(1)(b) GDPR.
- To keep shared albums intact for the people in them when somebody leaves or deletes their account. This is a legitimate interest of the other members, Art. 6(1)(f) GDPR — see below.
- To keep the service working and secure, which is a legitimate interest of ours, Art. 6(1)(f) GDPR.
- To know how many people use Selu — the day marks above — which is a legitimate interest of ours, Art. 6(1)(f) GDPR.
Where it is kept
Your account, your albums and the files behind them are stored with Supabase, which hosts the database and the file storage this app uses. The project is in the eu-central-1 region — Frankfurt, Germany — so the data stays in the EU.
Supabase acts as a processor on our behalf under Art. 28 GDPR. Their own privacy terms are at supabase.com/privacy.
The app itself — the page and the code — is a set of static files served by Vercel. Serving a web page means that provider sees the ordinary things any web server sees, including your IP address, in its request logs. Vercel is based in the United States, so those logs may be processed there. It receives none of your account contents: your photographs and albums travel directly between your phone and Supabase in Frankfurt, and never pass through it.
And on your phone. Selu is local-first: everything you make is written to your own device first and stays there. The copy in your account is a backup, not the original.
Who can see what
- Your private albums are yours. Nobody else can read them, including us — the database refuses the request rather than trusting the app to hide them.
- A shared album is visible to the people in it, and to nobody else, until somebody in it invites another person.
- An album you put on your profile is visible to the people you are connected to.
- Your username, display name and profile picture can be seen by anyone signed in to Selu who searches for your username. Nothing else about you can.
- Your email address is never shown to another user.
We do not sell your data, share it for advertising, or give it to anyone except as described here. It would be handed over if the law compelled it, and not otherwise.
Reports and blocks
- When you report something, we keep the report: that it came from you, what it is about, the reason and anything you wrote, and a copy of the reported content as it was, so it can still be looked at after it has been deleted. The person reported is never told who reported them. A report sent from the web form keeps the name and email you give.
- When somebody reports you, the same is kept about that report, including a copy of what was reported. If we act on it, we tell you by email, with our reasons.
- Reports are read only by the operator of Selu. They are kept while they are being handled and for one year after the decision, then deleted — also if either account is deleted in the meantime. Where a report concerns a crime, it may be passed to the authorities if the law requires it.
- Who you have blocked is kept in your account, visible only to you, until you unblock them or delete your account.
- The legal basis is the legitimate interest of the people using Selu, and ours, in keeping it safe and lawful, Art. 6(1)(f) GDPR, and our obligations under the Digital Services Act, Art. 6(1)(c) GDPR.
How long it is kept
- Photographs, videos and albums stay until you delete them or delete your account.
- Text messages disappear after 24 hours, on both sides, unless somebody taps one to keep it. Photos, videos and albums sent in a chat do not expire — they belong to an album.
- A file is deleted once nothing points at it any more. While a photo is in an album someone still has, the file behind it stays.
Deleting your account
You can delete your account from inside the app, at any time, without asking anyone: the gear on the Albums or Chat tab, then Delete my account. It cannot be undone. If you no longer have the app or cannot log in, you can ask by email — see selu.world/delete-account.
Deleting takes everything only you could see: your albums, your photographs and videos, your messages, your profile, the files behind all of it, and the account itself. The copies on your phone go too.
One thing does not go, and it is worth reading twice. Photographs you put into albums other people are still in stay in those albums. Everyone in a shared album already holds a copy on their own phone — Selu works offline and cannot reach into anybody's device — so removing the copy in your account would not remove theirs. It would only rewrite an album that belongs to them as much as to you. Your name comes off what you left: with no profile, those items show as taken by "Someone".
If you want a particular photograph out of a shared album, delete that item first, and then delete your account. Deleting an item does reach the other members.
Messages work the other way round: what you said is yours to withdraw, so deleting your account removes your messages from every conversation, and one-to-one threads go entirely.
Your rights
Under the GDPR you have the right to ask for a copy of your data, to have it corrected, to have it erased, to have its use restricted, to object to it being used, and to receive it in a portable form. Deleting your account in the app is erasure, done immediately and without having to ask.
For anything else, write to admin@selu.world and you will have an answer within one month.
If you think your data has been handled wrongly you can complain to the Austrian data protection authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
Children
Selu is for people aged 16 and over, everywhere. Accounts are not knowingly created for anyone younger.
Sixteen is the age the GDPR sets by default. Some countries allow a lower one — Austria sets it at 14 — but using the highest figure everywhere means Selu never has to handle parental consent, and never has to ask where you are in order to work out which rule applies to you.
Security
Everything travels over an encrypted connection and is stored encrypted at rest by the hosting provider. Which rows any account may read is decided by the database itself rather than by the app, so a bug in the app cannot hand somebody your albums. No system is perfect, and this one is small and new.
Changes to this policy
If this policy changes in a way that matters, the date at the top changes and you will be told in the app before it takes effect.
Contact
Raul Julian de Paula, Troyerstraße 90, Stiege 3, Tür 30, 9020 Klagenfurt am Wörthersee, Austria
admin@selu.world