Privacy policy

Last updated 5 October 2026. Common Past is run by Orlando Andico, who is the data controller. See also the terms of service. Contact: orly.andico@gmail.com.

What Common Past is

A private website where a group of people who share a past build one timeline of their memories together. Everything a group adds is visible only to that group's approved members.

What we collect

• Your sign-in identity: your name and email address from Google when you sign in. We never see your Google password.
• What you contribute: photos you upload (including the original file and the information inside it, such as the date, camera and location), descriptions, dates and places you enter, and the people you name in them.
• People who are not members: members may name people who appear in photos or took part in events, including people who never sign in. Those names are visible only within that group.
• Membership and history: which groups you belong to, your role, and a history of changes (who changed what, and when) so that edits can be reviewed and undone.

How it is used

Only to run the service for your groups: showing the timeline to its members, keeping the history of changes, and suggesting where photos belong. We do not sell data, show advertising, or use tracking or advertising cookies. We use face detection to draw boxes that members can label by hand; we never use face recognition to identify anyone.

Where it is kept, and who processes it

• Amazon Web Services hosts the service. All data is stored in the European Union (Ireland).
• Google handles sign-in.
• Place search (Amazon Location Service, or OpenStreetMap-based services) receives the place names you type and the coordinates being looked up, never your photos or identity.
• Where enabled: Resend sends notification emails, and TypeSafe checks comments and descriptions for spam and abuse.

Cookies

Only those needed to work: keeping you signed in, and short-lived signed cookies that let your browser load your group's photos.

How long we keep it

For as long as the group exists, or until it is removed at a member's request. Removed photos are destroyed; superseded copies and backups expire within 30 days.

Your rights

You can ask for a copy of your data, to correct it, to have your contributions and personal data erased, or to object to how it is used, by emailing the contact above. Requests are answered within one month. You may also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.