Privacy

This notice covers 35mm.org and the NegaKit app’s connection to it. It says what we keep about you, why, for how long, who else sees it, and what you can ask us to do about it. We have tried to keep it short and to keep as little as we can.

Who we are

This notice is from the people who run 35mm.org. We decide what is kept and why, which makes us the “controller” of your data in the words of the EU General Data Protection Regulation (GDPR).

A contact address for questions about your data will be published here.

The short version

You can read the film reference, the news and the NegaKit pages without an account, and we keep nothing that identifies you when you do.
We never store your IP address. Our visit counts use a code that changes every day and cannot be traced back to you.
There are no adverts, no tracking pixels and no third-party scripts for visitors.
If you make an account, we keep what you give us and what you post, until you delete it — which you can do yourself at any time.

What we keep

Your account

Your name, email address and a scrambled (hashed) form of your password — never the password itself — plus when you joined, whether you have confirmed your email, when you agreed to the terms, and whether you joined on the website or in NegaKit. When you choose a password, we check it is not one already published in a known data breach: only the first five characters of a scrambled form of it are sent to the Have I Been Pwned service, which cannot work out the password from them.

If you sign in from NegaKit, we keep a sign-in for each Mac with the name you gave it, when it signed in and when it was last used, so you can see and sign out your Macs. The settings NegaKit syncs, looks you share and the shooting log you keep are stored with your account.

Your profile and what you post

Your profile is your public page: the name you show, your headline, bio, picture, city, the links and contact details you choose to add, your gear and your favourite films (the notes you keep on a film stay private). What you post — feed posts with their photographs and what they were shot on, reposts, likes, comments, reviews, stars and roll galleries — is kept with your profile so that it can be shown.

Who can see it: other members can see a profile once a moderator has listed it. People who are not signed in, and search engines, can see it only if you also leave “Show this profile to everyone” on in your profile settings. A roll gallery shared by link can be seen by anyone with the link, but is never listed or indexed.

If you report a post, we keep the report, its reason and your note so a moderator can act on it; the person you reported is not told who you are.

Comments without an account

On film, camera and lens pages you can leave a comment without an account. We keep the name you give and, if you add it, your email address (never shown), and a moderator reads the comment before it appears.

Asking to test NegaKit

If you ask to become a tester, we keep your name and email, what you told us about your Mac, how you scan and what you shoot, your message, the language your browser prefers, and the country and city your connection came from (worked out when you send the form, without keeping your IP address). We use it to choose testers and to write to you about testing.

If you ask to test the iPhone app, we keep your name and the email of your Apple ID, the devices and iOS version you gave us, your message, the language your browser prefers, and the country and city your connection came from (without keeping your IP address). We use it to choose testers, to send TestFlight invitations and to write to you about testing.

If you subscribe to news by email, we keep your email address and when you subscribed, and use it only to send the newsletter. You can unsubscribe whenever you like, and we then stop using the address.

Visits and downloads

To know which pages are read, we count visits ourselves. Each visit records the page (and, from whatever follows the “?” in its address, only campaign labels such as utm_source, ref, from and q — never anything that looks like an email address or a code), the site you came from, the kind of device, browser and system with their versions, the make and model of a phone where your browser says so, whether it looked like a bot and which one, the languages your browser lists first, the language the page was shown in, and the country, region and city the connection came from together with the name of its network provider. The visitor is a code made from your session and that day’s date, which changes every day and cannot be traced back to you. No IP address, no account and no full browser description is stored. Staff browsing is not counted.

As you leave a page, a small script on it tells us how long the page was on screen, how far you scrolled, your screen size and which links you clicked (only the site a link goes to). It sets no cookie of its own, and it sends nothing when your browser sends Do Not Track or Global Privacy Control; such a browser is still counted as a visit, but only with its country, device type, browser and the site it came from.

When NegaKit is downloaded or updated, we record the same kind of information plus the version, the kind of Mac and macOS version (from the app or your browser), and any campaign labels in the link you followed. If you were signed in, the record is linked to your account. No IP address is stored.

Where a place or a network provider is worked out, it comes from information our network provider adds to each request, or from location databases kept on our own server (DB-IP Lite or MaxMind GeoLite2). Your address is used to answer that question and then dropped; it is never sent to another company to look up.

Cookies and similar

We use only the cookies the site needs to work: a session cookie that keeps you signed in and remembers a form you were filling in, a security cookie that protects forms from forgery, and — if you tick “Keep me signed in” — a cookie that signs you in again later. Your choice of light or dark appearance, and a dismissed language notice, are kept in your browser and never sent to us. None of these is used to follow you elsewhere, so they do not need your consent.

Why we keep it

To give you the service you asked for — your account, your profile, posting, NegaKit sync and galleries (the GDPR calls this performing a contract).
To keep the site safe and fair — moderation, reports, limits on how often things can be done, and stopping spam (our legitimate interest in running a community people can trust).
To understand which pages are useful — the anonymous visit and download counts (our legitimate interest in improving the site, with nothing kept that identifies you).
Because you agreed — tester requests and the newsletter. You can withdraw that agreement at any time.
Because the law requires it — when we must keep or hand over something by law.

We do not sell your data, use it for advertising, or make decisions about you by automated means alone.

How long we keep it

Your account, profile and posts — until you delete them or the account. Deleting the account removes your profiles, posts and their photographs, reviews, comments, likes, stars, galleries, synced settings and Mac sign-ins straight away.
Sign-in sessions — until you sign out, or two hours after you were last active; “Keep me signed in” lasts up to about 400 days. A Mac’s sign-in lasts a year.
Email codes — 30 minutes, and only a scrambled form of the code is kept.
Visit records — 400 days, then deleted automatically. Only daily totals (by page, country, device and the like, never about one person) are kept after that.
Download records — for as long as they are useful for counting downloads; they hold no IP address, and the link to your account is removed when you delete the account.
Tester requests — until testing ends or you ask us to delete yours.
Comments left without an account — until they are removed by a moderator or at your request.
Newsletter — until you unsubscribe.

Who else sees it

What you make public is public. Beyond that, we use a small number of providers who handle data on our behalf and only on our instructions: the company that hosts the site, the network provider in front of it, and the service that delivers our emails. Some of them may handle data outside the European Economic Area; where they do, we rely on the safeguards the GDPR requires, such as the European Commission’s standard contractual clauses. We share data with others only if the law requires it.

Your rights

Under the GDPR you can ask us:

to see what we keep about you, and have a copy of it;
to correct it — most of it you can change yourself on your account and profile pages;
to delete it — you can delete your account yourself on your account page, or ask us;
to limit what we do with it while a question about it is settled;
to move it — to have what you gave us in a form another service can read;
to stop using it where we rely on our legitimate interests — you can object at any time, and we will stop unless we have a compelling reason that outweighs yours;
to withdraw your agreement where we asked for it, without affecting what was done before.

Write to us at the contact address above once it is published. We answer within a month, and it costs nothing. We may need to check it is really you, usually by asking you to write from the email address on your account.

If you are unhappy with how we have handled your data, you can complain to the data protection authority in the country where you live or work. We would like the chance to put it right first.

Children

35mm.org accounts are for people aged 16 or over. If you think a child has made an account, tell us and we will delete it.

Changes

When we change this notice we change the date at the top. If a change matters to how your data is used, we will tell members by email or on the site before it applies.

What we keep, and why.