Privacy Policy
We built Gabyly so that you, and only you, control your family's memories. This Privacy Policy explains, in plain language, what information we collect, why we collect it, how long we keep it, and the rights you have over your data. We follow a privacy-by-design approach: we ask only for what we genuinely need to run the service, we never use your photos to train any model, and we never sell your information.
Who we are (data controller)
Gabyly is operated by Gabyly SNC, based in Lugano, Switzerland, which is the data controller responsible for your personal data. Switzerland is recognised by the EU as providing an adequate level of data protection, and for users in the EU/EEA we also act in line with the GDPR. For any privacy question, or to exercise your rights, contact our privacy team at privacy@gabyly.com. You also have the right to lodge a complaint with your national data protection authority (in Switzerland, the FDPIC).
What we collect
To create your account we store your email address and the name you choose. To run the service we store the media you upload (always end-to-end encrypted) and a minimal view counter for each shared link, just how many times it was opened and when. We do not collect, store or show the IP address, location, device or identity of the people who open your links. We do not build advertising profiles and we do not track you across other websites.
We can't read your shared memories
Memories you share are end-to-end encrypted on your own device before they are uploaded. The decryption key travels only inside the private link you send and is never transmitted to, or stored on, our servers. As a result we only ever hold unreadable ciphertext, by design, neither our team nor any third party can open your photos or videos. This is the strongest privacy guarantee we can offer, and it means that if you lose a link, even we cannot recover what was behind it.
How long we keep your data
Every shared memory has a lifetime that you choose, from ten minutes up to forever. When that lifetime ends, the underlying files are automatically deleted from our storage and the link stops working. You can also erase any memory instantly with one tap. Account information is kept only while your account is active; when you delete your account, we remove your personal data and your stored media. Payment and invoicing records are kept for as long as tax law requires (typically up to 10 years), and basic security logs are kept for a short period and then deleted.
Legal basis for processing
We only process your personal data where the law allows. We rely on: (1) performance of a contract, to create and run your account and deliver the memories you share; (2) your consent, for non-essential analytics storage and any optional marketing emails, which you can withdraw at any time; (3) legal obligations, for example keeping payment and invoicing records for the period required by law; and (4) our legitimate interests, keeping the service secure, preventing fraud and abuse, and improving reliability, always balanced against your rights. Because your shared media is end-to-end encrypted, we only ever process it as unreadable ciphertext on your behalf.
Your rights & control
You are always in control. You can delete any individual memory at any moment, export a copy of your data, and permanently delete your entire account from your profile settings. Under the GDPR you also have the right to access, correct, restrict or object to the processing of your personal data, and to lodge a complaint with your local data protection authority.
We never sell your data
We do not sell, rent, or trade your personal data or your photos, ever. Your memories are not a product, and we do not run advertising networks or social tracking pixels. The only third parties involved are the trusted providers that help us operate the service, such as payment processing, cloud storage and transactional email, and each one only processes the minimum data required to perform its task.
Data residency
When you create a memory you choose whether it is stored in our European or our US region. European memories are physically stored on servers located in the European Union to support GDPR data residency, and we do not move your data between regions without your consent.
Questions or requests
Have a question about your privacy, or want to exercise one of your rights? Email us at privacy@gabyly.com and a real person will help you, usually within a few days.
Last updated: 8/5/2026. Questions? privacy@gabyly.com
Your privacy, your choice
Gabyly uses only what it needs to work, plus optional functional storage to remember your preferences. We never use advertising or tracking cookies. Read our cookie policy