Privacy
2026-10-05
1. Privacy at a glance
PicFolio is a free image browsing site. There are no user accounts, no uploads, and no selling or sharing of personal data with anyone.
Because there is no login, we cannot identify you by name. The only data tied to your visit is the ordinary web-server record described in section 5.
2. What we collect
We collect only what the web server needs in order to answer your request:
- Your IP address, for example 203.0.113.7
- The date and time of the request and the exact URL you requested
- Your browser type, version and User-Agent string
- The referring page, if your browser sends it
- Your language preference, stored in a first-party cookie named pic_lang so the site remembers which of the ten languages to show
- For photos: how many times each photo page has been viewed. This is a single incrementing counter, not linked to your IP address or any identifier
3. Images are hot-linked, never uploaded
Every photo on PicFolio is shown by linking directly to the original file on the provider's server. Your browser downloads the image from that provider, not from us. Our database stores text metadata only: title, description, author, license name, license URL, image dimensions and image URL.
Since you never upload anything to us, PicFolio cannot collect your photos, their file names, their EXIF data, or any content of your own.
4. Cookies and advertising
This site does not use advertising cookies at the moment. Advertising is currently switched off.
If advertising is enabled in the future, this section will describe it in full before it is switched on, and the date at the top of this page will be updated. At that point you can expect third-party vendors, including Google, to set cookies in your browser in order to serve ads based on your prior visits to this and other websites.
You can decline advertising cookies in your browser settings, and you can delete cookies already stored at any time. Doing so does not stop you from browsing the photo library.
5. Analytics and server logs
We use the standard access log written by the web server (nginx) and the application log. They contain the items listed in section 2 and serve two purposes only: diagnosing faults and measuring aggregate traffic. They are not joined with any other dataset and are not used to build a profile of you.
Raw log lines are not linked to the view counter in section 2. Retention is short: entries older than 14 days are deleted by a rotation job.
6. Third-party providers
When you open a photo page, your browser sends requests directly to the providers listed below. Because those requests go from your browser to them, the providers see your IP address and User-Agent, and their own privacy policies apply. We do not control how they handle it.
- Openverse (openverse.org), operated by the Word Foundation
- Wikimedia Commons (commons.wikimedia.org), operated by the Wikimedia Foundation
- Lorem Picsum (picsum.photos), which serves placeholder photographs
- Google AdSense, only once advertising is switched on
7. Your rights and choices
Depending on where you live, you may have rights under local law to ask what personal data an organisation holds, to ask for it to be corrected, or to ask for it to be deleted. Because we do not maintain accounts, we hold no name, no email address and no account identifier for you, so in practice we can only respond to data contained in server logs, which are short-lived as described in section 5.
You can always browse this site without accepting advertising cookies, and you can block cookies entirely in your browser. The photo library itself does not require cookies to work.
8. Children's privacy
This site is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.
9. How to contact us
Questions about this policy, or a privacy request, can be sent to the address given below. If a request concerns personal data in server logs, please include the approximate date and the country you were browsing from so we can locate the right records. We aim to reply within 30 days.
10. Changes to this policy
We may update this policy, for example to reflect a change in the providers we use or in the law. The date at the top of this page always shows the version that currently applies.