Your memories.
Your privacy.

Information used for your album

Anyone can start a private album through the public Albums page without an invitation. Signup stores the supplied name, album title and event details, a hash of the browser’s private start key, and a hashed network identifier used to limit new signups. The $500 listed album price and payment-pending status are recorded separately from editable design settings. Starting a design does not collect payment or place a print order. Signup access records are eligible for removal after 30 days.

The service stores project and client names; album photographs and separate browser previews; cover and spread designs; saved versions; feedback, replies and submission notes; and project status, revision history, deadlines and printing status.

For projects that invite clients to upload their own collection, the upload step accepts 20 JPEG photographs. It keeps the original files for printing and creates smaller previews for the designer. When browser storage is available, upload copies are temporarily saved on that device to help resume an interrupted transfer; those recovery copies are cleared when the upload is completed.

It also keeps managed photo file identifiers and checksums, private invitation and session hashes, and temporary hashed identifiers used to limit sign-in attempts. Hosting services process technical request information needed to operate the service.

When ordering, we also store your contact name, email, phone number, delivery choice, and any shipping recipient and address. Shipping addresses are shared with PayPal to complete shipping orders and are available in your private order record and to the studio for fulfillment. Payment amounts and provider order and capture identifiers are recorded; this service does not store your PayPal password or full payment card details. This information supports album editing, private access, collaboration, photographer review, order fulfillment, full-resolution printing and cleanup of managed photo copies.

Save the Date and Thank You Card drafts and private proofs

Save the Date and Thank You Card drafts keep a device backup in your browser. If you choose “Save & continue anywhere,” both editable sides, fonts, colors, positions and original photograph are saved privately online. Cloudflare stores the design, revision, photograph metadata and a hash of the private resume key; the photograph is kept in managed Google Drive storage. The browser retains the resume link and uses a secure HTTP-only cookie for online access. Anyone with the complete private resume link can open and edit that draft. Share it only with people you trust. Clients do not need a Google account. Online drafts have a 14-day window from the first online save; editing does not restart this window. Drafts linked to paid card orders are kept until printing finishes. Expired online designs become inaccessible, their design settings are cleared, and their managed photograph copies move to Drive Trash during scheduled cleanup. Replaced, unused online photograph copies are also eligible for cleanup after a day. Device backups remain separate. Creating a private approval link uploads a frozen reduced-resolution preview of each side, card settings, photo dimensions and checksum, and review status to Cloudflare; that proof feature does not upload the original photograph.

Anyone with the complete private proof invitation can view that version and respond with their name, approval or requested changes. Approval applies to the frozen version shown. Editing the device draft does not change an existing proof.

Unapproved proof previews become inaccessible after 14 days and are removed by scheduled cleanup. Approved previews are held until the studio marks printing finished. The design, review response and status metadata may remain after the previews are removed. Browser drafts are separate and remain until replaced or browser data is cleared.

Private invitations and browser sessions

Clients enter through a private project invitation. Anyone with a valid invitation can use it, so share its access key only with people you want to have access to that album. The photographer can replace or revoke an invitation.

After an invitation is accepted, the browser uses a secure, HTTP-only session cookie to access that project. The studio owner uses a separate sign-in session. These cookies support access to the album service; they are not advertising cookies. Browser storage also keeps interface preferences such as music volume, saved looks and help settings. Clients do not need a Google account connection to design an invited album.

The studio's Google Drive connection

The studio owner authorizes Google Drive through the private setup. Album Studio requests the drive.file permission: access is limited to files created by the app or specifically made available to it. This is not permission to read the owner's entire Google Drive.

The album workflow creates and manages its own photo originals and previews. The Drive connection is used to upload, retrieve and delete those managed copies for album design and printing. OAuth credentials remain in private setup or service configuration and are not included in client invitations or public pages.

The owner can revoke the app's access through the Google account's connected-app controls. Revoking authorization stops further Drive access and can interrupt album loading, transfers, printing and scheduled photo cleanup.

Where project information is handled

Google Drive stores managed album photograph copies. Cloudflare hosts Album Studio and its project database, including album designs, feedback, access records and photo catalog metadata. Resend processes the recipient email and transactional order message to send confirmations and delivery updates. Messages contain the minimum order and delivery information needed by the client, plus a private tracking link. The studio's private Mac workflow can retain local transfer and print copies.

After verified payment, the service records an order receipt, delivery progress, call confirmation, and any shipping tracking number. An estimated ready date may appear on the private client tracking page. Production checklist entries and private studio notes are visible only to the owner. The studio receives new paid-order alerts with a studio sign-in link; these alerts do not include the client’s private tracking access key. Transactional emails include an itemized receipt, delivery details, and a private order-tracking link. Tracking links expire after 180 days; forwarding the complete link gives its recipient access to that order and its available previews, but not studio print downloads.

These services receive the information needed to provide storage, hosting and the album workflow. Google and Cloudflare also handle information under their own privacy notices: Google Privacy Policy and Cloudflare Privacy Policy.

The design window and photo cleanup

Incomplete albums close at their deadline. Scheduled cleanup permanently deletes only that project's individually cataloged portal photo originals and previews from Drive. Removal happens in batches and may take more than one scheduled run; a storage interruption can delay it.

Albums submitted before the deadline are held for the photographer until printing is complete. The owner explicitly marks an album printed to initiate cleanup of its managed portal photo copies.

Photo cleanup does not mean all project information disappears. Designs, submissions, feedback, saved versions, status and photo catalog metadata do not have an automatic 14-day deletion rule. Recoverable project trash, cleanup reconciliation records, provider backups and private local print or transfer copies may remain. Permanently deleted portal photo copies cannot be restored by restoring project metadata.

Moving a project into recoverable studio trash revokes client access but does not permanently erase its photos. A trashed project that was never opened by a client has no started design deadline. Contact the photographer if you need its retained information or photo copies reviewed.

Portal cleanup does not delete original photographs on a client's phone or computer, the photographer's Mac or SmugMug, unrelated Drive files or whole Drive folders.

Questions or project requests

For questions about your album, an invitation, retained project information or a cleanup request, contact Roberts Production through the existing photography website. Include your project name so the photographer can identify the album; do not send passwords or invitation access keys in a public message.