Security

Updated 11 September 2026

Your URSY ID password is entered at URSY ID. Photos receives a service-specific identity and the permissions you approve. An agent connects through an ID approval page; it does not need your password.

Control a connection

Review and revoke connected apps. Revocation stops future authenticated access. It cannot recall files an application or a sharing recipient has already downloaded.

Photo protection

Originals and generated previews are stored outside the public website directory and served through access checks. Previews are re-encoded without EXIF metadata. Unchanged originals can contain location and camera metadata, so original downloads require both original-file and location permissions. This is server-managed storage, not end-to-end encryption.

Report a concern

Contact [email protected] for support, privacy requests, account closure or complaints. Please describe the request without sending a password, access token or private photo.

If you suspect account misuse, revoke unfamiliar connections and use account recovery. For a vulnerability report, include the affected URL and reproducible steps using your own test account. Avoid accessing other people’s data.