Retention and Recovery Policy

This policy explains what happens to your files over time, and what we can and cannot recover. It forms part of our Terms of Service.

In short

• Hosted files are the files you upload to PhotoPostman or import into it. On paid plans, after they expire they stay in a recovery archive for 90 days, then they are permanently deleted.
• Cloud-connected files stay in your Dropbox, Google Drive or OneDrive. We never have a backup of those originals.
• Trial files are not archived. They are deleted 14 days after the trial ends.
• Permanently delete now really does delete, and a deletion record makes sure deleted files cannot come back from a backup.

1. Expiry

• Each gallery and transfer has an exact expiry date and time, which is shown in the event's time zone. Galleries can expire after 7, 30 or 90 days, on a custom date or, on a paid plan within your allowance, never. Transfers expire after 7 days by default and after at most 30 days.
• Expiry is checked every time someone opens a link. Access stops at the exact expiry time, even if routine clean-up runs late.
• At expiry, guests and recipients lose access immediately. You can still see the event in your dashboard and export or restore its files as described below.
• A printed QR code keeps working after expiry, but it shows a neutral "this event has ended" page.

2. The 90-day recovery archive (paid plans)

What goes in. When a gallery or transfer expires or you close it, each hosted original it used goes to the recovery archive, but only if no other active gallery or transfer still uses it. Shared files stay active until their last use ends.

How it is copied. We copy the original and a small restoration record into private archive storage at a separate provider, then check the number of files, their sizes and their checksums. Only after this check succeeds do we remove the active copy. Until then, the dashboard shows Archive pending or, if a copy failed, Archive failed, never "Backed up". If copying fails, we keep the last verified copy privately and keep trying. Public access stays closed throughout.

How long. Files stay in the archive until exactly 90 days after the expiry or closing date. A delay in copying does not extend the date. The dashboard shows Restore until [date].

It does not use your allowance. Archived files do not count against your stored-files allowance.

Restoring. You can restore archived files while you have an eligible paid plan and enough free storage. Restored files count against your stored-files allowance again, but not against your new-uploads allowance, because they are not new uploads. If there is not enough space, we ask you to free space or upgrade. We never upgrade you or charge you automatically.

Repeated restores. To stop files staying in the archive indefinitely through repeated restore and re-expire cycles:

• a restored file must stay active for 90 days in a row before a later expiry starts a new 90-day recovery window;
• if it expires again within those 90 days, the original recovery deadline still applies; and
• we show you the applicable deadline before you close or re-expire a gallery. We do not create duplicate archive copies of the same file after each restore.

Deadline. At the deadline, we permanently delete the archived original, its restoration record, previews and any temporary ZIP files.

3. What is never recoverable

• Cloud-connected originals. If a gallery shows files from your Dropbox, Google Drive or OneDrive, the originals live there. The small previews we keep are not a backup. If a file is deleted or access is lost at the source, we cannot bring it back. To protect such files with our recovery archive, import them into PhotoPostman, which uses your hosted allowance.
• Trial files (see section 4).
• Uploads that did not finish, or files we never fully received and verified.
• Previews and temporary ZIP files. We recreate these from originals when needed.
• Files already permanently deleted.
• Copies other people have downloaded. We cannot recall those.

4. Trials

When a 30-day trial ends, galleries and transfers close and new uploads, syncing and processing stop. You have 14 days of read-only access to export your files and to choose a paid plan. We email you the exact deletion date. If you do not move to a paid plan within those 14 days, all trial media is permanently deleted. Trial files never enter the 90-day recovery archive.

5. When a paid service ends

When a paid service ends (at the end of a cancelled term, after the 7-day overdue-payment grace period, or when a complimentary plan ends):

1. galleries and transfers close to guests and recipients;
2. you have 14 days of read-only export access; and
3. your hosted files are in the recovery archive for 90 days counted from the day the service ended. The export window is part of that period, not added to it.

To restore after that, you need to reactivate a paid plan with enough space before the deadline.

6. Deleting

In the dashboard you can choose between:

• Remove from gallery: the file is hidden from that gallery but stays in your account.
• Close and keep recovery: the gallery or transfer closes, and its files follow the recovery rules above.
• Permanently delete now: we delete the files without waiting for the recovery period. This cannot be undone.

A valid request to erase personal data under data protection law follows the permanent-deletion route where required, even if the normal recovery period has not ended.

What "permanently deleted" means. We delete every copy we control: originals, our operational copies, recovery archive copies, previews, temporary ZIP files and related records. We also remove cached copies from our network. Each deletion is a tracked job that is retried if a provider is temporarily unavailable, and we do not report deletion as complete until it has succeeded. Deletion in PhotoPostman never deletes originals in your own cloud accounts.

7. Backups and the deletion record

• Media files are stored so that each one can be deleted individually, including our own operational copies.
• Our database provider keeps point-in-time recovery data for up to 30 days, for disaster recovery only. During that time a deleted record may still exist in that recovery data. We do not use it for anything else, and it expires automatically.
• We keep a minimal deletion record: identifiers and dates, with no media, file names or file contents. Before any restored data is used to serve the service, we re-apply every deletion in the record, so deleted files and data cannot reappear. We keep deletion records for as long as a backup made before the deletion could still be restored.

8. Why there is a rolling 30-day upload allowance

Each plan has two storage limits:

• Stored original files: what you have active right now.
• New uploads per rolling 30 days: how much new data you have added in the last 30 days.

Because every expired or deleted hosted file goes into the 90-day recovery archive at our cost, a storage limit alone would allow someone to upload, delete and re-upload without limit, building an ever-larger archive. The rolling 30-day limit keeps the archive bounded, so we can offer the recovery archive to every paid customer without charging it against your visible storage.

What this means in practice:

• deleting files frees stored-file space straight away, but not new-upload allowance;
• new-upload allowance returns gradually, as each upload passes 30 days. The dashboard shows when;
• it does not reset on your billing date, including on annual plans;
• a verified retry of the same file counts only once; and
• restoring from the archive does not count.

9. Other data we keep

Questions: privacy@photopostman.com.