Skip to content

Privacy Policy

Last updated September 23, 2026

This policy explains what data Cullit collects when you use this website and your Cullit account, why, and who it is shared with. It reflects how the product actually works today. Cullit is operated by Brice Virassamy, entrepreneur individuel (sole proprietor under French law) ("we", "us").

The short version

Your photos are culled on your computer and never leave it — we never receive them. We do not store your card details. Our analytics use no cookies and do not identify you. You can access, correct, export or delete your data at any time.

Your photos stay on your computer

Cullit's culling — including face detection and the sharpness, eyes and smile signals — runs entirely on-device in the macOS app. Your photos, and any face or landmark data derived from them, are never uploaded to this website or our servers. Crash reports are stripped of filenames, email addresses and IP addresses before they are sent.

What we collect

To run your account and subscription we collect a small amount of data:

  • Account: your email address, plus a name and interface language if you choose to provide them. If you sign in with Google, Google gives us the email address and basic profile (name, profile picture) of that account — never your Google password. During the beta we also record the camera model you use, to prioritise support.
  • Payment: handled by Paddle, our merchant of record, in its secure checkout. Your card details go directly to Paddle — we store only a subscription reference with its status, plan and dates, never your card number. If you cancel, we keep the reason you give, to improve Cullit.
  • Product analytics: anonymous, cookieless usage events — page views, clicks on the download and call-to-action buttons, the sections of a page you reach as you scroll and how long each one stays on your screen, how quickly the page loads and becomes usable in your browser, the country you connect from (worked out from your connection by our host, Cloudflare: the events carry the country, never your IP address), and the steps you clear when creating an account or subscribing (for example “code sent”, “checkout opened”), together with the reason a step failed. These events never contain your e-mail address or anything you type into a form, and are not linked to your identity.
  • Region: our host, Cloudflare, works out your country from your connection, so this site can show prices in the currency Paddle will charge you; at checkout, Paddle determines your country to show a localized price and apply the correct taxes. Our own servers do not store your IP address.
  • Referrals: if you arrive through a referral link, the code is kept in a first-party cookie for 30 days so a discount can be applied at checkout.

Cookies and local storage

We keep these to a minimum:

  • A login cookie, set only when you sign in, keeps you authenticated.
  • A referral cookie: if you arrive through a referral link, the code is kept for up to 30 days. During checkout, Paddle sets its own strictly necessary cookies to run the payment securely.
  • Your theme preference lives in your browser's local storage and is never sent to us.
  • Our analytics set no cookies. There is no advertising or cross-site tracking, so we show no cookie banner.

Who we share data with

We rely on a small set of service providers (subprocessors) to run Cullit. Each one processes data only to provide its service:

  • Supabase — account database and authentication.
  • Paddle (Paddle.com Market Ltd, UK) — merchant of record: payments, subscriptions, taxes and invoicing.
  • PostHog — anonymous, cookieless product analytics. Hosted in the European Union.
  • Sentry — crash reporting, with personal data scrubbed out.
  • Cloudflare — hosting and delivery of this website.
  • Google (Google Ireland Limited) — identity provider, only if you choose to sign in with Google.
  • Brevo — sends the authentication emails (sign-in codes, password resets) and the acknowledgments of receipt we owe you by law, such as the one confirming a withdrawal. A French company; data is hosted in the European Union.

We do not sell your data or share it for advertising.

Where your data is stored

Our account database (Supabase) is hosted in the United States, and some providers process data outside your country. Where data leaves the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses. You can request a copy of the applicable safeguards at support@cullit.app.

How long we keep it

We keep your account and subscription records for as long as your account is active, and for a limited period afterward to meet legal and accounting obligations. In practice: account and profile data are kept while your account is active, then up to 3 years after your last activity; subscription and billing records are kept for 10 years (French commercial law); product analytics are anonymous and aggregated, with no per-person retention; crash reports are kept for about 90 days, with personal data scrubbed.

Your rights

You can access, correct, export or delete your personal data. Update your name and preferences from your account settings; for access, portability or deletion, contact us at support@cullit.app and we will respond within the applicable legal timeframe. If you are in the EU/EEA, you may also lodge a complaint with your local data-protection authority.

Emails we send

The only emails Cullit currently sends are account emails from our authentication provider — the six-digit code you use to sign in. Cullit has no passwords, so there is nothing to reset. We do not send marketing emails.

Children

Cullit is a professional tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

We will update this page when our practices change and revise the date above. Significant changes will be communicated before they take effect.

Contact

For any privacy question or request, contact support@cullit.app. We have not appointed a data protection officer; privacy requests are handled directly at this address.