Privacy Policy

This policy explains what data Gumnut collects, why we collect it, who we share it with, and what you can do to control it. If anything here is unclear, reach out and we'll answer.

Who we are

Gumnut is operated by Gumnut Labs LLC ("Gumnut", "we", "us"). This policy covers:

• Our marketing site at www.gumnut.ai
• The Photos web app at app.gumnut.ai
• The Gumnut Photos mobile app
• The Photos API at api.gumnut.ai, including the MCP server used by AI assistants
• The Immich-compatible service at immich.gumnut.ai

What we collect

Account information

When you sign up, our authentication partner Clerk collects your name, email address, and (if you sign in with Google, Apple, or another identity provider) the OAuth profile information those providers share with us. Clerk also manages your password if you set one.

We store the home region you give us (your country and, in the United States, your state), and whether you have turned automatic face detection on, turned it off, or have not chosen yet.

The sign-up form also lets you choose whether to receive occasional Gumnut product updates and product-related marketing. If you leave that option selected, we share your email address with Beehiiv, which manages the mailing list. You can unsubscribe at any time.

Photos and videos you upload

When you upload a photo or video, we store:

• The original file
• Metadata embedded in the file (EXIF, including the time the photo was taken, camera model, and — if your device wrote it — the GPS location)
• Any metadata you add yourself, such as album names, captions, face labels, or album descriptions

Data we derive from your photos

To make your library searchable and organized, our servers generate additional data from the files you upload:

• Thumbnails and resized variants for faster display
• Text descriptions of each image or video, written by a vision-language model
• Search embeddings (numeric vectors that let us match your text queries to images)
• Detected faces and face templates so we can group photos of the same person (see Face templates)
• Quality scores for each image, rated by a vision-language model on photographic quality (such as focus, exposure, and composition), which AI assistants and apps you connect can use to choose among your photos
• Reverse-geocoded place names (neighborhood, city, country) derived from GPS coordinates in your photos

Face templates

Automatic face processing detects the faces in your photos and creates a numerical template of each face: a set of numbers that describes the face, together with the positions of features such as the eyes and nose. For each person in your library, we also keep an average of that person's templates. Together, we call these face templates. Face templates are biometric data.

We use face templates only to group photos of the same person and to suggest who is in a photo. They are created and stored on our servers, not by an outside AI model provider. We also keep the box that marks each detected face and the person it is assigned to.

Your home region determines whether automatic face detection is available for your account. Automatic face processing does not run:

• While it is turned off for your account.
• Until the account owner chooses to turn it on.
• If your home region is Illinois or Texas. It cannot be turned on while that is your home region.
• On photos whose location data places them in Illinois or Texas, in any account.
• On videos.

You can still mark faces by hand and assign them to people. In a shared library, the library owner's setting and home region apply to every photo in it.

We do not sell, lease, or trade face templates, or otherwise profit from them. We do not disclose them to anyone outside Gumnut, other than the providers that host our servers and database on our behalf, unless the law requires it (see Government and third-party requests). Face templates are never included in responses from the Photos API or the MCP server, so the apps and AI assistants you connect do not receive them.

Model evaluation uses only photos whose owners agreed to that use.

How long we keep face templates is set out in Face template retention.

Activity and technical data

• API and app usage logs. Standard request logs including IP address, User-Agent, timestamps, and which endpoints you called. These are used for debugging, abuse prevention, and capacity planning.
• Search text. When you search your library, we use the text you enter to find and rank results, including sending it to our search ranking provider (see Who we share your data with).
• Error and performance telemetry. When the app encounters an error or a slow request, we record a diagnostic event. These may include your user ID, the URL being accessed, and a stack trace. We do not intentionally include photo contents in these events. When mobile diagnostic collection is configured, sampled session replays may record screen interactions; text and images are masked in these replays. Search diagnostics are designed to retain technical context such as search mode, filter counts, timings, result counts, and failure reasons while filtering literal search text, private filter values, filenames, and result contents from routine telemetry. These controls reduce collection but are not a guarantee that every sensitive value can be detected. For a specific investigation, authorized engineers may use a reproduction you share or access the minimum necessary content through restricted administrative interfaces, keeping it only as long as needed for that investigation.
• OAuth clients you authorize. When you connect an AI assistant (e.g., ChatGPT, Claude) to your Gumnut library, we record which client you authorized and what permissions it has.
• API keys you create. We store a one-way hash so we can verify the key on future requests. We do not store the key itself in a recoverable form.

Feedback

Feedback goes to the Gumnut team through Basin for human review. When you send feedback from the web app, the report includes your message, your user ID and email when available, the page URL, browser and app environment. Sending web feedback also attempts to upload a masked replay of buffered activity or an ongoing error session to Sentry; the Basin report includes a reference when available. You can choose to attach a screenshot; screenshots are not masked.

We are preparing feedback submission through the API and connected AI assistants; this intake is not yet enabled. When enabled, reports will contain a feedback category and technical message, optionally whether the original task completed and relevant tool names. Our server will add your authenticated Gumnut user ID, environment, submission time in UTC, an attempt identifier, and whether the report came through the API or an AI assistant. It will not automatically add your account email or library content, and this report format will not accept attachments, screenshots, or replays.

An assistant may submit its own sanitized observations of technical problems without asking you each time, subject to its host's permissions, or send feedback at your request. Reports must exclude credentials, photos, signed URLs, conversations, private tool results, personal or library names, precise locations, and literal search text. This is reporting guidance, not a guarantee that every sensitive value can be detected. Feedback is optional; acceptance for intake does not guarantee that a person reads it, responds, or makes a fix.

Marketing-site information

If you send a message via the contact form, we receive your name, email, and whatever you write.

How we use your data

• To operate the service. Storing and serving your photos, generating thumbnails and search results, clustering faces, running AI-assistant integrations.
• To keep the service reliable and secure. Detecting errors, investigating abuse, rate-limiting, and maintaining backups.
• To communicate with you. Responding to support requests, confirming account actions, and—when you leave the sign-up option selected—sending occasional product updates and product-related marketing communications. We do not use this list for unrelated third-party promotions.
• To improve the service. Aggregate usage information helps us understand what's working and what isn't. We don't train our own models on your photos. The third-party AI providers we use operate under zero-data-retention terms and don't use the data we send them to train or improve their own models. TypeSafe's Jev does not retain your search text or photo metadata after returning its output, as described below.

We do not sell your personal data, and we do not share it with advertisers.

Who we share your data with

We share your data with the service providers below to operate Gumnut, with apps and integrations you authorize, and in response to requests as described below. Each service provider is bound by its own terms and privacy practices.

We may add or change service providers as the product evolves. We'll update the list above when that happens.

Government and third-party requests

Gumnut reviews government and third-party requests individually, verifying the requester’s identity, authority, legal basis, jurisdiction, and scope. We disclose personal data only with appropriate user authorization or where disclosure is legally required.

Where appropriate, we seek legal advice and challenge or seek to narrow requests that are invalid, overbroad, or inconsistent with applicable law. Any disclosure is limited to the data necessary to satisfy the authorized or legally required request.

We notify affected users before disclosure where legally permitted and practicable, unless notification would create a security risk. Access is restricted to authorized personnel, and we document the request, assessment, and response.

When you connect AI assistants

Gumnut supports connecting AI assistants (like ChatGPT and Claude) to your library through an MCP integration. When you connect one and ask it something about your photos — for example, "show me my dog photos last summer" — the assistant's host receives:

• The specific photos, thumbnails, and metadata returned by the tool calls the assistant makes on your behalf
• The prompts and context you send to the assistant

Once that data reaches the assistant's host (OpenAI for ChatGPT, Anthropic for Claude, etc.), that host's privacy policy applies to how they handle it, not ours. You can disconnect an AI assistant at any time from its own integrations settings, which revokes its access to your library.

Your controls

You can:

• Delete individual photos or videos through the Gumnut web app, an Immich client, or the API. Deleted items go to a 90-day trash from which they can be restored, and are then purged from our servers and our object storage.
• Delete a library. First move it to trash through the API or SDK. Gumnut requires at least one active library, so create another before trashing your last one, or contact us if you want all library data removed. A trashed library can be restored during its 90-day retention period, then its contents are purged in the background. To waive that wait, call DELETE /api/libraries/{id}on the trashed library. This schedules an expedited background purge; deletion is not immediate.
• Export your data. The Gumnut API and the TypeScript and Python SDKs let you list and download all your assets, metadata, and derived data other than face templates. If you'd prefer a one-time archive compiled by us, request one.
• Close your account. When you close your account, we retire it as we do an inactive account, and we also delete the rest of your personal data, except what we must keep for legal reasons. Photos you added to someone else's library stay with that library.
• Turn automatic face processing on or off in Settings > Faces, and set your home region in Settings > Account. A change applies to photos processed afterwards; face templates you already have are kept until an event in the face template retention schedule applies to them.
• Revoke AI-assistant access. If you've connected ChatGPT, Claude, or another AI assistant to Gumnut, you can disconnect it at any time from the assistant's integrations settings.

How long we keep your data

• Active data stays on our servers for as long as your account and library exist.
• Deleted photos and videos spend up to 90 days in the trash, after which they're permanently removed from our database and object storage.
• Database and storage backups are kept for up to 30 days. Data you've deleted may persist in backups until those backups cycle out, but is not restored into the active system.
• Logs and telemetry are retained for up to 90 days for operational purposes.
• Error events in Sentry are retained per Sentry's default retention (typically 90 days).

Face template retention

We keep face templates until one of the events below applies to them. Deleting a face also deletes its template. Deleting a person deletes that person's average template; the person's faces keep their templates and become unassigned.

Using your account means signing in or making any request with it, including through an API key or a connected app. When we delete templates because of a location edit, at your request, or because an unused account is retired, we keep the box that marks each face and the person it is assigned to, so your people look the same. A photo moved to another library keeps its face boxes, but its faces arrive unassigned, because people stay in the library they belong to. Nothing is matched against a face while it has no template. Deleted templates may remain in backups for up to 30 days, as described above, but are not restored into the active system.

Cookies

We use a minimal set of cookies:

• Essential cookies set by Clerk to keep you signed in.

Our marketing-site analytics (Cloudflare Web Analytics) is cookieless — it sets no cookies and builds no cross-site profile, which is why the marketing site shows no cookie banner. We don't use advertising or cross-site tracking cookies.

Children

Gumnut is not directed to children under 13. We don't knowingly collect information from children under 13. If you believe a child has created an account, contact us and we'll remove it.

Where your data is stored

Gumnut's servers and database are hosted in the United States. Our object storage (Cloudflare R2) and CDN are US-primary but may replicate data to other regions for performance and reliability. By using Gumnut, you understand that your data will be processed in the United States and other countries where our service providers operate.

Changes to this policy

We may update this policy from time to time. The Last updated date at the top reflects the most recent change. For material changes, we'll make reasonable efforts to let you know, but we encourage you to review this page periodically.

Contact us

Questions, requests, or concerns? Get in touch.