Policies

Privacy

There is very little to declare here, and that is the point.

October 2026

1Who is responsible

The controller for the data described here is the provider named in the legal notice, reachable at hello@shepherd.photo.

There is no data protection officer: shepherd is too small to be required to appoint one. Write to the address above and you reach the person who decides.

2Your photographs: shepherd is not a recipient

shepherd is a desktop application. It reads your photographs from your own disk, analyses them on your own processor, and writes your ratings back to your own files. All of that stays on your computer:

• the photographs themselves, and their filenames and folder structure;
• the EXIF metadata shepherd reads out of them (camera, lens, exposure, time);
• the session database, the thumbnails and the analysis results shepherd caches so a second look at a shoot is quick;
• the XMP sidecar files and the ratings written into image files, which shepherd writes only after you have confirmed them;
• on the package Range, the local learning that adapts to your corrections. The training runs on your machine and is never uploaded.

None of this is transmitted to shepherd, and none of it is data I hold. If your shoot contains personal data (and a wedding shoot certainly does), you remain the controller for it, exactly as you were before shepherd was installed. Weddings, boudoir, babies and children, hospital work, anything under an NDA: the files stay where you put them.

Deleting it is a matter of deleting the folder and the app's own data directory. No request to me is needed, because there is nothing at my end to delete.

3The licence check

Activating a key, and re-confirming it about once a day while you are online, is the one thing in the app that contacts a server. That request carries:

• your licence key. When you enter a new key on a computer that already holds one, the request also carries the previous key and its device fingerprint, so that the previous licence's place on that computer is released;
• a device fingerprint: a keyed hash of your computer's machine id, so a two-computer licence can tell two computers apart. The machine id itself never leaves your computer, and because the hash is keyed with your licence key, the same computer looks different under any other licence. It is pseudonymous, not anonymous: next to your licence, it means "one of your computers";
• a device label: the computer's operating system and its version, such as "Darwin 24.3.0", stored with the activation. The name of your computer is not sent;
• the app version, its build date and the platform, which decide whether your licence covers this build;
• your IP address and the time, because that is what making an HTTPS request involves.

Purpose: issuing and checking your licence, keeping to the number of computers your package covers, and spotting a key that has been published or shared. Legal basis: performance of the contract, Art. 6(1)(b) GDPR, and my legitimate interest in enforcing the licence, Art. 6(1)(f) GDPR. Kept: the licence and its activated computers for as long as the licence exists, including a released computer's entry, so that coming back reclaims its own slot instead of using up a second one. Your IP address is not stored with the licence; it appears only in the server's request logs, which are kept for up to 365 days.

The licence service runs on servers rented from Hetzner in Germany. Nothing about your photographs reaches it, and there is nothing in it that could reconstruct a shoot.

4Buying: payment and the key email

Checkout is handled by Creem, which sells the licence as reseller and merchant of record. You give Creem your email address, billing details and payment data; Creem is responsible for that data and for the invoice, under its own privacy policy. I never see your card details.

When a purchase completes, Creem notifies the licence service, and that notification is stored as received: the order reference, your email address, the product, the language you were reading the site in, and whatever else Creem includes about the order (e.g. invoice address, name, VAT ID for businesses). From it, your licence keeps the order reference, your email address, the package and the language to write to you in.

Purpose: issuing and delivering your key, matching a refund or a chargeback to the right order, and answering you if you write. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) for keeping the record afterwards. Kept: the licence is never deleted outright, because it is the proof that a key was issued against a payment. This is what a chargeback or a tax question needs years later; see section 10. Stored notifications are kept for up to 10 years to be compliant with local laws.

The key email goes out through Brevo, an email service in France. Brevo sees your address and the message, including your key and your download link.

Brevo also records whether the email was opened and which of its links were clicked, by way of a small tracking image and links that pass through Brevo first. That is there to tell whether your key actually arrived. Legal basis: Art. 6(1)(f) GDPR. Your address is not added to any mailing list. There is no newsletter to add it to. I reserve the right to contact you about your licence, but not to send you marketing.

5Downloading shepherd

There is no public download. Your personal link leads to a page on the same Hetzner server as the licence service, and each download is recorded with the licence it belongs to, the file, the time, your IP address and your browser's user agent.

That record exists for one reason: a link that has leaked shows up as one licence fetching the same file from many addresses. Legal basis: my legitimate interest in protecting the licence, Art. 6(1)(f) GDPR. Kept: for up to 12 months.

6This website

shepherd.photo is a static site hosted by Netlify. Netlify's servers log the usual technical data of any web request (IP address, time, the page asked for, referrer and browser string), which is what keeps the site available and lets an attack be spotted. Legal basis: Art. 6(1)(f) GDPR.

There is no analytics. No page-view counter, no heatmap, no advertising or social-network pixel, and no cookie banner, because there are no cookies to consent to. The page loads no third-party resources at all: the fonts are served from this domain, which is the whole reason they are vendored.

Two small values are stored in your browser's local storage, both technically necessary for something you asked for and neither of them personal data: the light or dark theme you picked, and, after a click on a buy button, a note of which language you were reading, so the page you land on after payment is in that language.

The Status link in the footer leads to status.shepherd.photo, a status page hosted by Phare (phare.io, run by Lightkeeper OÜ in Estonia), which keeps its data in the EU. It is a separate site: opening it sends your request to Phare rather than to this one.

7Writing to me

The contact form is Netlify Forms. What you type in it (name, email address, your message, the subject you picked) is stored in the site's Netlify dashboard and forwarded to me by email.

I use your address to answer you. Not to put you on a list. Legal basis: Art. 6(1)(b) GDPR where your message is about a purchase, otherwise Art. 6(1)(f): my legitimate interest in answering somebody who wrote to me. Correspondence is kept as long as the matter is open, and afterwards for as long as I might need it to handle a follow-up question, for up to 10 years.

8Who else processes the data, and where

9What shepherd deliberately does not collect

• No user accounts, and no registration to install or try shepherd.
• No telemetry, no usage statistics and no crash reporting. If diagnostics are ever added, they will be opt-in and off until you switch them on.
• No profiling and no automated decision-making within the meaning of Art. 22 GDPR. shepherd scores photographs, not people, and the scoring happens on your machine.
• No special-category data. shepherd does not identify who is in your pictures; it looks for open eyes and sharp focus, and forms no opinion about the person.

10Your rights

You can ask me for access to your data (Art. 15 GDPR), for it to be corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), for a copy in a portable form (Art. 20). You can object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you can withdraw it at any time.

One email to hello@shepherd.photo is enough, and there is no form to fill in. Bear in mind what section 2 says: for the photographs themselves there is nothing for me to hand over or erase.

Erasing your data also stops your key working. What stays is the bare record that a key was issued against a payment (the key, the dates, the package and the order reference) for as long as a chargeback or a tax question can still need it, for up to 10 years.

You can also complain to a supervisory authority. For shepherd that is the Landesbeauftragte für Datenschutz und Informationsfreiheit (LfDI) Baden-Württemberg (data protection commissioner), and you may equally go to the authority where you live.

11Children

shepherd is a professional tool sold to adults, and is not directed at children. Photographs of children on your own disk are your material, and section 2 applies to them like everything else: they stay there.

12Changes to this policy

If what shepherd does with data changes, this page changes with it, and the version line at the top says when. Anything that would newly send something off your machine gets said plainly here before it ships, not quietly added to a list.

If a sentence here is vaguer than you need it to be, write to hello@shepherd.photo and I will help you out.