shrim.pics

Privacy

Last updated 29 October 2026

shrim.pics is built so that we can't see what you share. This page explains, in plain words, the little we do see, why, how long we keep it, and what you can do about it.

The short version

  • Your photos, videos, album names, captions, dates and places are encrypted. We can't read them.
  • We keep what's needed to run your account: your email, your plan, and a few facts about each link.
  • No ads, no trackers, no analytics, nothing loaded from other companies.
  • One cookie, only to keep you signed in.
  • You can download your data or delete your account from your dashboard at any time.

Who is responsible

Shy Newt Technologies LTD, Efesou 9, Paralimni, 5280, is responsible for your data (the "controller"). For any privacy question or request, write to hello@shrim.pics.

What we can't see

Everything in a shared album is encrypted on your server before it leaves your home, and decrypted in the browser of the person opening the link. The key is the part of the link after the #, and browsers never send that part to any server, including ours. So we can't see:

  • your photos and videos, or anything friends upload;
  • album names, descriptions, file names, dates, camera details and places;
  • the address of your Immich server.

The one exception: if someone sends us the full link, key included, we can open that album like anyone else with the link. That only happens when someone reports a link (see below).

What we keep, and why

Your account

Your email address, your password (stored scrambled with a one-way hash, so even we can't read it), when you signed up, and the state of your plan. We need these to run your account and your plan (the contract between us). Kept until you delete your account.

Your agent

A scrambled copy of your agent's connection token, when it was made, and when your agent was last online. We use this to connect your agent and to show you its status. Kept until you delete your account.

Your links

For each link: a random ID, when it was made, when it expires, whether it allows uploads, whether it was turned off, how often it was opened, and how much data went through it. Not what's inside. We use this to run the links, to show you how they're used, and to keep the service fair. Kept until you delete your account.

Payments

Payments are handled by Stripe. Your card details go straight to Stripe; we never see them. We only keep your Stripe customer number and whether your plan is paid up. Stripe keeps invoices and payment records for as long as tax law requires, and is responsible for that under its own privacy policy.

Reports

When someone reports a link, we keep the full link they sent, the reason, their message and, if they give it, their email address. We need this to handle the report and meet our legal duties. Kept until the report is closed, then for 12 months, then deleted.

Internet addresses

Like every website, our server sees the internet address (IP) of everyone who connects, including people opening links. We use it only to stop abuse, by limiting how many requests come from one address. We hold it in memory for a few minutes and don't write it to logs.

Emails

We only email you about your account: a link when you ask to reset your password, and a short note when your password changes. No newsletters, no marketing, no tracking in the emails. We don't keep copies of them.

Backups

We make a daily copy of our database to protect against accidents. Copies are kept for 14 days, then deleted.

Cookies

We use one cookie, shrim_session, to keep you signed in. It's strictly necessary, so we don't need to ask for consent. No other cookies, and nothing on the album pages.

Who else is involved

  • Hosting: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France. Our servers are in France.
  • Email: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland sends our account emails. It sees your email address and the message, and nothing else.
  • Payments: Stripe Payments Europe, Ltd., Ireland. Stripe may process some data in the United States, protected by the EU–US Data Privacy Framework and the EU's standard contractual clauses.

We don't sell your data and we don't share it with anyone else, unless the law requires us to.

Keeping it safe

Everything you share is encrypted end to end. Connections to shrim.pics use HTTPS. Passwords and tokens are stored as one-way hashes. Only the people who run the service can reach the servers.

One honest limit: the page that decrypts photos is served by shrim.pics. If someone took over this site, they could change that page. That's true of every website that encrypts in the browser. The code is open source, so it can be checked, and you can run your own copy instead.

Your rights

You can, at any time:

  • see and download your data (Download my data on your dashboard);
  • delete your account and everything tied to it (Delete account on your dashboard);
  • ask us to correct something, limit what we do with it, or object to it;
  • ask any question about how we handle your data.

Write to hello@shrim.pics and we'll answer within a month. If you're not happy with our answer, you can complain to a data protection authority, in the country where you live or where we're based.

Children

Accounts are for adults (18 and over). We don't knowingly collect data about children.

Changes

If we change this policy in a way that matters, we'll email account holders before it applies and update the date at the top.