Privacy policy

Information Petalumi handles

Google account information

When you choose Google sign-in, Google provides a stable account identifier, your email address, whether that address is verified, and your display name.

Account and security information

Petalumi creates an internal user ID and stores your name, email address, roles, account status, account timestamps, and Google account identifier. If you set a Petalumi password, Petalumi stores a salted password hash and never stores the password itself.

Content and support information

Authorized administrators may submit files, asset names, descriptions, Board membership, and Canvas text or layout. If you contact support, Petalumi processes your email address and the information in your message.

Technical request information

The service receives data needed to deliver and protect web requests. This may include your IP address, browser or device details, requested URL, request time, and error data.

How Petalumi uses information

• Provide the public gallery and load its collections.
• Create, find, authenticate, secure, and support Petalumi accounts and authorized administration features.
• Remember the interface language you select.
• Prevent identity conflicts, fraud, abuse, and unauthorized access, and investigate service errors.
• Respond to support requests, comply with legal obligations, and enforce the service terms.

Google user data

Petalumi requests only the openid, email, and profile scopes. These scopes provide the Google account identifier, verified email information, and display name described above. Petalumi does not request access to Gmail, Google Drive, Google Contacts, or other Google product content.

Petalumi uses Google user data only to create or find your account, confirm that Google verified the email address, prevent conflicting identity links, display your account name and email, and sign you in.

For an account created through Google, Petalumi stores the Google account identifier, normalized email address, and display name. When Google is linked to an existing account with the same verified email, Petalumi stores the Google identifier and keeps the existing profile fields. Petalumi does not persist Google OAuth access tokens or refresh tokens.

Petalumi's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Cookies

The language of each page is determined by its URL. Petalumi does not set a language preference cookie.

The HttpOnly petalumi_api_session cookie keeps you signed in until it expires or you log out. A separate short-lived OAuth state cookie protects the Google callback and is cleared when the callback is processed.

Petalumi application code does not set advertising cookies or third-party analytics cookies.

When information is shared

Petalumi limits disclosure to the purposes described in this policy:

• Service providers may process information on Petalumi's instructions when they supply hosting, storage, database, security, or support infrastructure.
• Information may be disclosed when required by law or when reasonably necessary to protect users, the service, or the rights and safety of others.
• Information may be transferred as part of a merger, acquisition, financing, reorganization, or sale of assets only with the notice or consent required by applicable law and Google's rules.

Petalumi does not sell Google user data or other personal information, and does not share it with advertising platforms or data brokers.

Retention and deletion

Petalumi retains account information and administrator-provided content while the account or service needs it. You may request deletion by contacting support. Some information may be retained when needed for legal obligations, security, dispute resolution, fraud prevention, or backup cleanup.

Session and OAuth security cookies expire according to their configured lifetime or are cleared through logout and callback processing.

Your choices and requests

• You can browse the public gallery and read these policies without signing in. Account-only features remain unavailable until you authenticate.
• You can remove Petalumi's Google access from your Google Account permissions. Revoking access prevents future authorization but does not by itself delete information already stored in your Petalumi account.
• To request access, correction, or deletion of your Petalumi information, or to ask a privacy question, email [email protected]. Petalumi may need to verify your identity before completing a request.

Security

Petalumi protects authentication traffic with HTTPS and uses HttpOnly session cookies, short-lived OAuth state validation, salted password hashes, and role-based access controls. No internet service can guarantee absolute security.

Policy changes

Petalumi will revise this page and its effective date when its information practices change. Petalumi will provide additional notice when applicable law requires it.

Contact

Questions or requests about privacy and Google user data can be sent to [email protected].