Privacy

Effective October 1, 2026.

This policy describes what Legasee stores and who receives it. Legasee is operated from the United States. Write to us at support@legasee.online. The rules for using the service are in the Terms.

What we keep

Your account holds your name, username, email address, a hashed password, an optional profile photo, your plan, and how much storage you have used.

Albums hold the photos you add, the words you attach to them, the time each photo was taken, and the coordinates that place it on the map. We also keep comments, your friends and friend requests, the people you block, and reports (the reason, and any details you add).

Signup and password reset keep a little extra so the account is yours and so automated signups stay limited. We store the IP address of a signup attempt for about two days. Google reCAPTCHA checks signup, email changes, and password reset. Email verification links last 24 hours, and password-reset links last one hour. We store a hash of those links, not the link itself. We also store the time you sign in.

If you subscribe, we store a Stripe customer id and a subscription id. Your card number stays with Stripe. We do not keep it.

How we use it

We use this information to run the service: to show your albums to you and to the people you shared them with, to place photos on the map, to verify your email, to reset a password, to take a subscription payment, and to review a report. We use the signup IP address and reCAPTCHA to limit bots and abuse. We do not sell personal information, and we do not use it to advertise to you.

Who else receives it

People you share an album with can see that album, its photos, places, times, and comments. Friends can see the profile the product shows them: your name, username, and profile photo.

Amazon stores the photos, delivers them to the browser, and sends account email from noreply@legasee.online. Google receives the reCAPTCHA check. Google’s privacy policy describes that check. Mapbox receives the map requests for the area on your screen. Stripe receives the subscription, including the email on the account. Railway hosts the API and the database. Vercel hosts the website.

We also share information when the law requires it. The person who operates Legasee reviews reports, including an urgent report of the sexual exploitation of a minor.

Cookies and the browser

A cookie named token keeps you signed in. It is httpOnly and lasts about seven days. A cookie named emailVerified tells the site to send an unverified signup to the check-email page. CloudFront cookies, also about seven days, let the browser load your photos from the image address. The browser’s local storage keeps a copy of your profile so the interface can show your name and photo. These are part of running Legasee. We do not set advertising cookies.

How long

Account information stays until you delete the account in Settings. Deleting the account removes the account, the albums, and the photos from the service, and it cancels a subscription immediately. Signup IP addresses last about two days. Verification and reset links last until they are used or they expire.

Your choices

You can change your email and password in Settings. You can cancel Premium from Manage subscription and keep it until the end of the period you have already paid. You can delete the account in Settings. Deletion is permanent, and it does not refund the current Premium period.

There is no button that downloads every photo. To ask for a copy of the account information we can reasonably send, email support@legasee.online.

Age

Legasee is for people 18 and older. We do not knowingly keep an account for someone younger. If you believe a child has an account, email us and we will delete it.

Other countries

The service is operated from the United States. If you use it from another country, your information is processed in the United States and by the companies named above.

Changes

When this policy changes, the date at the top changes. A material change can ask you to agree again.