Your data
Every studio has its own encrypted vault, opened by its members’ passwords or the studio’s own recovery key.
The studio’s vault
The vault’s keys live only on members’ devices, locked with each member’s password and with the recovery key. Your password never leaves your device: it becomes a sign-in key there, and the server keeps only a check value of that key.
The data is encrypted end to end. The server stores sealed data and encrypted files and never opens them, so Pictures Up cannot read a studio’s data. It knows who belongs to which studio and their role, email addresses as keyed hashes, members’ public keys, when they sign in, the sizes and counts of encrypted files and messages, and the settings of the links it checks. Changes made on set in Shoot day, signatures included, are kept encrypted on the phone until they sync. A studio set up before November 12, 2026 moves to this at its first sign-in after that date.
The recovery key is the way back in if every admin forgets their password. Pictures Up cannot reset it for you. Keep the file offline, and make a new one in Studio settings if it goes missing while an admin can still sign in.
Media
Every file is encrypted before it is stored, and so are its previews.
Every link a studio sends, from share links to signing links and holds, carries its key after the #, which stays in the browser and never reaches our server. Emails carry the link only. Share links and the client portal are checked on every visit, so switching a link off, shortening its expiry or adding a password applies to the next visit. See Sharing links.
Profiles
A profile is encrypted with a key only its owner’s password opens. A studio sees it only when its owner shares it there. See People and profiles.
Where it lives
The servers are in Canada, and traffic reaches them through Cloudflare.
Everything in Pictures Up comes from inside our system, except the map and the weather, which come from open-source data.
- Addresses are looked up on OpenStreetMap when you save a location. It gets the address you typed.
- Forecasts come from Open-Meteo. It gets the location’s coordinates and the date.
- Sunrise and sunset are worked out by Pictures Up itself.
Limits today
- Watermarks show on screen. Downloads are not marked.
- Turning profile sharing off stops updates. What a studio already has stays.
The Build tracker lists everything still to come. The privacy policy covers what we keep and for how long.