AlbumHive Privacy Policy

Effective date: April 10, 2026
Last updated: October 1, 2026

This Privacy Policy describes how HiveApp Technologies LLC, a Texas limited liability company (“AlbumHive,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal information in connection with AlbumHive’s websites, mobile applications, and related services (collectively, the “Service”). We aim to use clear, plain language suited to the people who use AlbumHive.

It applies where AlbumHive acts as a controller or business (as those terms are defined in applicable privacy laws) of personal information. Where we process personal information on behalf of another party, additional terms may apply.

This Policy should be read together with our Terms of Service.

1. Who we are and contact details

Controller / business name: HiveApp Technologies LLC
State of formation: Texas, United States
Mailing address: 11639 Creek Point Drive, Frisco, TX 75035, United States

General inquiries, support, and privacy requests: [email protected]
Abuse reporting (trust and safety): [email protected]
Copyright / DMCA (U.S.): Use the designated agent and contact details in the Terms of Service — §10.3 ([email protected]).
Transactional mail From address: [email protected] (automated notices only; that mailbox is not monitored for replies).

2. Personal information we collect

The categories below depend on how you use the Service. Not every user will provide every category.

Data minimization. We limit collection of personal information to what is reasonably necessary for the purposes described in this Policy—including providing and securing the Service, meeting legal obligations, and the legitimate uses in later sections—and we retain information only as described in §7.

2.1 Account, Hive identity, and sign-in

AlbumHive is part of the Hive network operated by HiveApp Technologies LLC. AlbumHive, VaultsHive, and LooksHive share one Hive identity (the same email and credentials). Signing in to any of those three apps authenticates that identity. SlamHive is a separate product with its own accounts and is not part of this Hive identity, Hive storage meter, or Hive-wide deletion.

Creating an AlbumHive account does not automatically create VaultsHive or LooksHive product data. The first time you sign in to VaultsHive or LooksHive with that Hive identity, that app provisions its own library. Albums, vaults, and Looks libraries stay in the app where you created them in the current product (no AlbumHive hub of sibling albums).

Shared Hive storage. Billable files in AlbumHive, VaultsHive, and LooksHive count against one Hive storage quota, which is purchased and managed in AlbumHive. VaultsHive and LooksHive paid packs are features and credits, not a second storage plan.

We may collect:

• Identifiers: name, email address, account identifiers (including Buzz Profile fields you choose to provide)
• Date of birth — required to finish registration (entered as MM/DD/YYYY and stored as YYYY-MM-DD) to verify that you meet the minimum age and eligibility requirements in our Terms of Service.
• Phone number — optional. Registration (including after Sign in with Google or Sign in with Apple) does not require a phone number. If you add one, it lets people who already have you in their contacts find you and invite you to their Albums and Collages, and it may be used for verification (e.g., SMS via Twilio), security, and account-related communications. You can add, change, or remove it in your profile settings.
• OAuth identifiers when you use Sign in with Google or Sign in with Apple: the email and name the provider shares, the provider’s subject / user ID, and short-lived identity or access tokens used only to complete sign-in. We do not receive your Google or Apple password.
• Billing country and related eligibility fields for paid plans
• Authentication data: passwords or credentials managed by our authentication flows (we do not store passwords in plain text); OAuth accounts may have no AlbumHive password
• Device and session identifiers (for example, a device ID supplied by the client for session management and security; each Hive app has its own device slots)
• On Android and iOS, device identifiers (for example the Android Advertising ID) may be received by our ad provider as described in §2.8 when ads are shown (non-personalized ads only)
• Profile information you choose to add (such as display name or avatar references)

2.2 Photos, videos, and related media (“User Content”)

• Images and videos you upload
• Derived files created to operate the Service, such as thumbnails, transcoded versions, preview assets, and similar
• Metadata associated with media (for example, filenames, timestamps, album structure, contributor attribution)

2.3 Collage Builder, search indexing, and HiveMind AI

• Collage Builder and related search: search queries you enter and indexing outputs used to power search, such as text extracted from images (OCR), embeddings or similar vectors, labels, and related technical representations — processed in AlbumHive’s and its non-OpenAI infrastructure unless we tell you otherwise in-product
• HiveMind AI (OpenAI / ChatGPT API): HiveMind AI is not intended for processing sensitive personal data (for example, health, financial account, or government-identifier information, and similar categories treated as sensitive under applicable law). As of the Last updated date, AlbumHive does not send your photos, videos, or other stored User Content to OpenAI. AlbumHive does not attach account personal information (such as name, email, phone number, or account ID) to API requests. Only what is strictly necessary under our current design is transmitted (for example, user-typed prompt text). Your prompts are processed by OpenAI; do not enter sensitive personal information in HiveMind AI prompts. If you type personal information into HiveMind AI yourself, that text may be processed by OpenAI; avoid entering sensitive data unless you accept that risk. The app displays this notice in the HiveMind AI screen.
• Model training (OpenAI): We do not permit OpenAI to use submitted data for model training where such controls are available through the API and our account configuration, and we configure API usage accordingly. OpenAI’s own business, API, security, and subprocessor terms describe how they may process, cache, or retain API traffic; those terms may change over time and should be read on OpenAI’s official site.
• HiveMind application logs: We do not intentionally store or maintain application-level logs of HiveMind AI prompts or responses (or conversation history) in our application data stores for that feature. We do not design the Service to retain an AlbumHive-stored transcript or chat history for analytics, quality review, or training on our systems. Incidentally, debug, infrastructure, hosting, or security telemetry from service providers (for example, GCP request or error diagnostics), or processing and retention by OpenAI under their terms, may still occur and is not the same as a dedicated AlbumHive HiveMind conversation log; see §5.1 and Processing and retention at OpenAI below.
• Processing and retention at OpenAI: Prompts and responses are transmitted to OpenAI for the API call and are processed under their terms. OpenAI’s business, API, and security documentation describes their retention, abuse handling, and subprocessors for API traffic. We select vendors with reasonable privacy and security practices for the services they provide to us (including OpenAI for HiveMind AI), while recognizing that each vendor operates its own systems and policies. We do not control OpenAI’s internal systems; refer to OpenAI’s published materials for details beyond our disclosures here.

2.4 Communications

• Transactional emails (welcome, security alerts, billing notices, share notifications, account and deletion notices) sent via providers such as Zoho Mail from [email protected]. That address is a send-only From line; replies are not read. Write [email protected], [email protected], or [email protected] as appropriate.
• SMS or voice messages sent via Twilio (or similar) for phone verification
• Support messages when you contact us
• Push notifications on iOS and Android when you grant permission: a device push token (via Expo Push, Apple Push Notification service (APNs), and/or Firebase Cloud Messaging (FCM)) so we can deliver social, share, billing, security, and similar alerts while the app is in the background or not running. Web does not use the same OS push path. You can refuse or later disable notification permission in system settings; we then stop using that token.

2.5 Payment information

AlbumHive may use Stripe, Apple, and/or Google Play for paid subscriptions, depending on how and where you subscribe.

Stripe (web). Card and bank data are generally collected and processed directly by Stripe subject to Stripe’s privacy policy. AlbumHive typically receives limited billing metadata (such as subscription status, partial card details, billing address fragments, and transaction references).

Web and mobile apps. Paid subscriptions may be purchased and managed:

(a) on the web through Stripe (for example at https://app.albumhive.com); and/or
(b) in the iOS and/or Android apps through Apple App Store and/or Google Play in-app subscriptions, where that option is offered in-product.

• Stripe: Card and bank data are generally collected by Stripe; AlbumHive receives limited billing metadata.
• Apple / Google: Payment is processed by Apple or Google under their terms and privacy policies. AlbumHive receives purchase/subscription status and related entitlements (for example product identifiers, transaction references, and renewal/cancellation signals via store server notifications), not full payment card numbers.

Which store or processor applies depends on how and where you subscribe. Managing, cancelling, or changing a store subscription may require using Apple or Google subscription settings as well as (or instead of) AlbumHive. If you open a web billing flow from the app, Stripe may process payment data in the browser under Stripe’s privacy policy.

2.6 Technical and usage data

• IP address and derived approximate location (for example, country via GeoIP for security notifications and fraud prevention)
• User agent, browser or app version, operating system, language preferences
• Logs and diagnostics: timestamps, request paths, error reports, performance metrics
• Cookies and similar technologies on web surfaces, where used (see Section 8)

2.7 Abuse reports and safety

When you use Report or similar flows on shared links, we may collect:

• Report content (description, category, and related fields)
• Optional file attachments you choose to upload (for example supporting documents); these are stored with the report and may be included on operational notices to the inboxes described under Routing below
• Identifiers tying the report to the album, share link, media item, or comment
• Reporter technical data such as hashed IP, user-agent, and optional contact email you provide
• CAPTCHA signals (for example, Cloudflare Turnstile tokens) to reduce automated abuse

Routing. In-product Report submissions on shared links are routed by issue type: Abuse (trust and safety) generates operational notices to [email protected]; Copyright / IP is routed to [email protected]. For other communications, use [email protected].

We generally do not notify the content owner that a report was filed only because a report was submitted, unless required by law or in specific enforcement situations.

2.8 Advertising (AdMob) and device advertising identifiers

Free AlbumHive may show third-party ads (currently Google AdMob inline banners in the iOS and Android apps). Web may show Google AdSense in the same page slots when that surface is enabled. We do not use your photos or videos as an advertising product.

Who sees ads. Ads are per app. AlbumHive ads are off while your AlbumHive storage plan is a paid tier (Worker / Drone / Queen) and that paid access is still in effect — including Live (renewing), pending downgrade to a lower paid tier, and pending cancel (scheduled to end at period end). Ads stay off until the paid period actually ends and the plan becomes Free. AlbumHive ads are on on the Free plan (or if paid access has lapsed). Removing ads this way applies in AlbumHive only. It does not remove ads in VaultsHive or LooksHive. A VaultsHive or LooksHive credit pack does not remove AlbumHive ads.

Data used for ads. AlbumHive shows non-personalized ads only. When ads are shown, Google AdMob (and AdSense on web, if enabled) may receive device identifiers (for example the Android Advertising ID or an app-level identifier on iOS), IP address, user agent, approximate location (for example country), app and placement identifiers, and ad performance signals, which Google uses to serve and measure ads and to prevent fraud. We do not request App Tracking Transparency permission on iOS and do not use your data for personalized or cross-app targeted advertising. You may reset or limit advertising identifiers in device settings. Users known to be under 18 are not treated as an audience for targeted advertising (see §11).

Sale / sharing. We do not sell personal information for money. Because AlbumHive shows non-personalized ads only, we do not share personal information for cross-context behavioral advertising under the CCPA/CPRA. See §8.1 and §10.2. We do not sell your private User Content.

Android AD_ID. The Android app includes the Advertising ID permission both for AdMob and because Google Play Billing and related Play libraries may declare it.

2.9 Trust and safety processing (automated and manual)

AlbumHive may use automated analysis of User Content and derived metadata to detect abuse, enforce policies, and prioritize human review, including:

• CLIP-style embeddings or similar signals for internal triage (not marketed as definitive “moderation AI”)
• OCR or keyword cues for admin review queues
• Manual review by authorized personnel when investigating reports

Automated signals may not be the sole basis for account-level enforcement; human review may apply depending on the product workflow.

2.10 Legal and compliance

• Records required for tax, accounting, billing disputes, or regulatory obligations
• Preservation of information subject to legal holds or lawful requests

2.11 Device contacts (optional)

If you allow Contacts permission on iOS or Android, AlbumHive uses it only when you choose to search your contacts to add people to an album or a Collaboration Group. The app searches your device contacts on your phone and sends only the last seven digits of the matching phone numbers to our servers to find people who already have a Hive account. We do not upload or store your contact list or those partial numbers.

When you add a registered user from the results, we store that person as a member of the album or group (their Hive account ID and the phone number on their account) so sharing works. You can remove members at any time, and you can decline or later withdraw Contacts permission in system settings — searching by phone number still works without it. AlbumHive never writes to or changes your device contacts.

3. How we use personal information

We use personal information to:

1. Provide and operate the Service (hosting, Hive authentication including email/password and Sign in with Google / Apple, sharing, collaboration, push and email notifications)
2. Process payments and manage Hive storage subscriptions (via Stripe on the web and/or Apple / Google Play in-app subscriptions where offered; see §2.5)
3. Communicate with you (service-related email from [email protected], SMS, and push when permitted; marketing only if you opt in where required)
4. Verify phone numbers and protect accounts (via Twilio or similar)
5. Deliver AI features — Collage Builder (search and indexing) on our infrastructure; HiveMind AI via OpenAI only as described in §2.3 (no User Content or account personal information sent to OpenAI under current design)
6. Maintain security (fraud prevention, abuse detection, session limits, rate limits, logging)
7. Enforce our Terms, including moderation and compliance strikes
8. Comply with law and respond to lawful requests
9. Improve the Service (analytics, debugging, product development), consistent with applicable law and your choices
10. Show ads on Free AlbumHive as described in §2.8

4. Legal bases (EEA, UK, and similar jurisdictions)

Where GDPR or similar laws apply, we rely on one or more of the following:

• Contract: processing necessary to provide the Service you request
• Legitimate interests: security, fraud prevention, product improvement, moderation, and analytics (balanced against your rights)
• Legal obligation: compliance with law
• Consent: where required (for example, certain cookies or marketing, or optional features where we ask explicitly)

You may withdraw consent where processing is consent-based, without affecting processing prior to withdrawal.

5. How we share personal information

We do not sell personal information for money. We do share information with service providers and, when Free AlbumHive shows ads, with Google AdMob / AdSense as described in §2.8 (non-personalized ads only, which is not “sharing” for cross-context behavioral advertising under the CCPA/CPRA). We do not sell your private User Content.

5.1 Service providers (subprocessors)

We use third parties that process personal information on our behalf or receive it to deliver the Service, including:

We may update our list of service providers from time to time. Material changes will be reflected in this Policy (including the Last updated date at the top of this document). Links to each provider’s privacy policy are available on their official websites.

5.2 Legal and safety

We may disclose information if we good-faith believe it is necessary to:

• Comply with law, regulation, legal process, or government requests
• Protect safety, rights, or property of AlbumHive, users, or the public
• Detect, prevent, or address fraud, security, or technical abuse
• Enforce our Terms or policies

This may include CSAM reporting or preservation where applicable law requires.

5.3 Business transfers

If AlbumHive is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will require the successor to honor this Policy or notify you of changes.

6. International transfers

AlbumHive’s operator is based in Texas, United States. We currently process and store personal information in the United States in systems operated by us or our service providers. AlbumHive does not commit to EU-only or other single-jurisdiction residency unless we explicitly offer a specific product or region in the future.

Where personal information is transferred across borders and required by law (for example, EEA/UK), we implement appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms when applicable.

7. Data retention

We aim to minimize retention and delete personal information when it is no longer needed for the purposes described in this Policy, consistent with legal, safety, and legitimate business requirements. In practice, we retain information as long as needed to provide the Service and for those purposes, including:

• Account records and credentials — While your account is active or suspended (deactivated) in-product, we retain identifiers and authentication-related data (for example, hashed passwords and OAuth provider subject IDs) needed to operate the Hive identity. Suspension is per app only: you can suspend AlbumHive and still use VaultsHive or LooksHive (and the reverse). Hive storage stays available so the other apps can keep working. Suspending AlbumHive ends AlbumHive paid-plan access for that app and keeps the Free 5 GB Hive allotment for siblings. AlbumHive share-link entitlements stay with the Hive storage plan (they are AlbumHive album links, not a VaultsHive/LooksHive link pool). Suspension is not Hive-wide deletion.
• Voluntary complete account deletion — After you follow the in-product Delete account flow in AlbumHive, VaultsHive, or LooksHive (including the acknowledgement checkbox described in our Terms of Service), deletion is immediate and Hive-wide: it removes the single Hive identity and cascades deletion of your data in AlbumHive, VaultsHive, and LooksHive (where used). SlamHive is not deleted. Deletion removes your albums, collages, share links, groups, vaults, Looks libraries, credits, and related User Content you own, OAuth links, and push tokens, and removes your membership from albums and groups where you were a contributor or invitee. Media you contributed to another user’s album may remain in that album so the host’s collection stays intact; attribution for those items may show as “Unknown” if your account no longer exists. You are responsible for cancelling recurring billing in Stripe, Google Play, and the Apple App Store; any cancel we attempt is best effort only and does not stop Apple (and may not stop Stripe or Play). Deletion may take time to propagate and may be subject to technical or backup retention for a limited period, and we may retain certain records where law, safety, or legal process requires (for example, abuse reports, billing, or tax records), as described below and in the Terms.
• Push tokens — Retained while the device is registered; removed on logout, token rotation, permission withdrawal, or account deletion.
• User Content — You may be able to delete or remove certain User Content through in-product controls where available. User Content may also be removed by AlbumHive as described in our Terms of Service (for example, moderation, over-quota enforcement, or link / metadata hygiene). Removed items may persist in technical or backup systems for a limited period (typically short-term rolling deletion).
• Billing records for periods required by tax and accounting law
• Stripe webhook logs or similar operational records for fraud and reconciliation for a limited period
• Report and moderation records as needed to investigate, audit, and defend claims, subject to law
• Expired share link metadata may be deleted after extended periods (for example, after one year in expired state in some cases) per system hygiene
• HiveMind AI — AlbumHive does not intentionally store or maintain application-level logs of HiveMind AI prompts or responses on our systems as described in §2.3; vendors and infrastructure may retain incidental data under their policies.

In-app notifications (including those shown in Social Feed or similar surfaces) may be purged after a limited period (for example, 90 days, where implemented).

8. Cookies and similar technologies

We use cookies, local storage, and similar technologies on web surfaces, for example to:

• Keep you signed in
• Remember preferences
• Secure public forms (e.g., CAPTCHA)
• Measure performance and usage (if enabled)

Where required by law, we will obtain consent before non-essential cookies.

8.1 Global Privacy Control and Do Not Track

We honor Global Privacy Control (GPC) signals where required by law. Depending on jurisdiction and product surface (for example, web browsers that send a valid GPC signal), we apply GPC in line with applicable rules (including, where applicable, California requirements to treat GPC as an opt-out of sale or sharing for cross-context behavioral advertising, to the extent those concepts apply to our processing).

Do Not Track (DNT). The legacy Do Not Track browser setting is not consistently standardized across browsers and services. We do not guarantee a specific response to DNT signals alone; where you seek to exercise opt-out rights that GPC can signal under applicable law, we prioritize recognized mechanisms such as GPC as described above.

9. Security

We implement technical and organizational measures appropriate to the risk, including:

• Encryption in transit (for example, TLS/HTTPS) between clients and our services
• Access controls and authentication for administrative systems
• Presigned URLs or equivalent time-limited access to stored objects where designed for private media
• Server-side encryption for object storage and databases as provided by our vendors (for example, Cloudflare R2, MongoDB Atlas)

No method of transmission or storage is 100% secure. You use the Service at your own risk.

Breach notification. In the event of a data breach, we will notify affected users and regulators as required by applicable law.

10. Your rights and choices

Depending on your location, you may have rights to:

• Access personal information we hold about you
• Correct inaccurate information
• Delete certain information (subject to exceptions)
• Export or port information in a machine-readable format
• Object or restrict certain processing
• Withdraw consent where processing is consent-based
• Opt out of sale or sharing for cross-context behavioral advertising (CCPA/CPRA concepts) if applicable

Data export and portability. We provide data exports in a structured, commonly used format where feasible, consistent with applicable law, technical limits, and security review. To request an export, contact [email protected].

Account deletion and erasure requests: Depending on your jurisdiction, you may have a right to delete or erase certain personal information. AlbumHive provides self-service complete account deletion for eligible accounts through the in-product flow described in §7 and the Terms of Service. That wipe is Hive-wide (AlbumHive, VaultsHive, LooksHive). Suspend is different: it is per app and keeps Hive storage for the other apps. You must cancel Stripe, Google Play, and App Store subscriptions yourself; our billing cancel is best effort. Accounts subject to compliance suspension or other restrictions may require support review. Where the law applies, we will also respond to valid requests by deleting or limiting information we can delete consistent with legal exceptions (for example, security, fraud prevention, billing, tax, and legal holds).

How to exercise: Contact [email protected]. We may need to verify your identity before responding. You may appeal a decision where applicable law requires.

Authorized agents: Some jurisdictions allow authorized agents to submit requests; we may require proof of authorization.

10.1 EEA/UK rights

If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority (for example, a Data Protection Authority).

10.2 California residents (CCPA/CPRA summary)

If you are a California resident, you may have additional rights under the CCPA/CPRA, including:

• Right to know categories and specific pieces of personal information collected
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing of personal information — we do not sell personal information for money; Free AlbumHive shows non-personalized AdMob / AdSense ads only and does not share personal information for cross-context behavioral advertising (see §2.8); we do not use or disclose sensitive personal information for targeted advertising to known minors as described in §11; Global Privacy Control (GPC) is addressed in §8.1

Sensitive personal information: We use sensitive personal information only as permitted by law and as described in this Policy.

Non-discrimination: We will not discriminate against you for exercising CCPA rights.

11. Children and teens

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent where the law requires it.

Age brackets. For minors who use the Service where permitted by law, we may categorize protections by age band—for example Children (under 13), Young Teens (13–15), and Older Teens (16–17)—to apply privacy protections required in California, Utah, the EU, and other jurisdictions as they apply to our Service.

Practices for users under 18. For users known to be under 18, we do not engage in targeted advertising, profiling for solely automated decision-making that produces legal or similarly significant effects, or the sale of personal information without the opt-in consent required by law (including consent of a parent or guardian for younger users, where applicable).

Data minimization for minors. We collect only the minimum personal information needed to provide the Service. We do not collect precise geolocation from known minors unless strictly necessary to provide the Service and with appropriate consent under applicable law.

Account registration is subject to the age and consent rules in our Terms of Service. If you believe we have collected information from a child in violation of this Policy, contact [email protected].

12. Automated decision-making

AlbumHive may use automated analysis of User Content and metadata for safety, search, and internal triage. Certain enforcement actions may involve human review depending on workflow. Automated outputs may be incorrect; you should not rely on them as definitive determinations of lawfulness or safety.

HiveMind AI uses a third-party model (OpenAI) under the limitations in §2.3; it is not used to make solely automated legal decisions about your account.

Where solely automated decisions with legal or similarly significant effects are restricted in your jurisdiction, AlbumHive will comply with applicable requirements.

Your rights. You may request human review of decisions affecting your account (for example, enforcement or access decisions). Contact [email protected]; we will handle requests consistent with applicable law and our Terms of Service.

13. Third-party links and viewers

The Service may include links to third-party sites or allow viewers to access shared albums without an AlbumHive account. Those third parties have their own privacy practices. AlbumHive is not responsible for third-party sites.

14. Changes to this Policy

We may update this Policy by posting a revised version and updating the “Last updated” date. For material changes, we will provide additional notice where required by law (for example, email or in-app notice).

15. Contact

Privacy questions, general support, and data rights requests: [email protected]
Abuse reporting (trust and safety): [email protected]
Copyright / DMCA: [email protected] (see the Terms of Service — §10.3)
Do not reply to automated mail from [email protected] — that mailbox is not monitored.

Legal notices

Operator: HiveApp Technologies LLC — 11639 Creek Point Drive, Frisco, TX 75035, United States.

© 2026 HiveApp Technologies LLC. All rights reserved. AlbumHive is a trademark of HiveApp Technologies LLC.

Document version 1.18 — Effective April 10, 2026 (revised September 21, 2026 — Hive identity; per-app suspend vs Hive-wide delete; user-owned store cancels; ads off while Live / pending downgrade / pending cancel; OAuth; AdMob; push; mailboxes; non-personalized ads only, no ATT; device contacts §2.11 — updated September 29, 2026)