Every photo I take — at a rugby tournament, a rowing regatta, a portrait session, or anywhere else — is my work. The copyright belongs to me, Zach Franzen, from the moment I press the shutter. That doesn't change when you buy a download.
What you're purchasing is a personal use license, issued on my behalf by A to Z Images LLC, the company I run my photography business through — the right to use the photo for yourself. You're not buying the copyright, and you're not getting permission to use it commercially unless we've specifically agreed to that in writing.
Simple version: Buy it, use it for yourself, enjoy it. Want to use it for a brand, sponsor, product, or anything that makes money? Talk to me first.
If you're a team, federation, club, or university athletics department looking to use images on your official website, social channels, or publications — that's a team license, not a personal download. Get in touch and we'll work out fair pricing.
Journalists, publications, and media outlets — I'm happy to license images for editorial use. Please contact me before publishing. Using my photos without permission is copyright infringement regardless of whether you credit me.
A photo credit is always appreciated but not required for personal use. If you do credit me, © Zach Franzen or @dayabay works perfectly.
This policy covers hizach.com, photos.hizach.com, rowing.photos, and photos.rugby — run by me, Zach Franzen, through my company A to Z Images LLC (doing business as Zach Franzen Photography), based in San Francisco, California. Where this page says "I" or "me", it means Zach Franzen and A to Z Images LLC.
I take privacy seriously. I collect only what I need, use it only for the purpose you gave it to me, and don't sell it to anyone.
Contact forms: Your name, email address, and any message you send me. Used only to respond to your enquiry.
Photo search & event registration: Your name, email address, the selfie(s) you upload, and event details you provide. The facial recognition process also generates a mathematical representation of your face (a face embedding) — this is biometric data. See the dedicated section below for full details on how this is handled.
Permanent athlete profiles: If you opt in at registration or via hizach.com/profile — your name, email, reference photos, and face embedding stored indefinitely until deletion request. See the dedicated section below.
Purchases on photos.hizach.com: Payments are processed by Stripe. Your card details go straight to Stripe and never reach me. I keep a record of each order — your email address, your name if you give it, what you bought and what you paid — to deliver your files, email your receipt, and keep tax records.
Cookies on photos.hizach.com: Only the few that the site needs to work — to remember your cart, and the galleries you've opened with a password or a share link. No advertising or tracking cookies.
Website analytics: Basic anonymised traffic data via Cloudflare. No cookies, no tracking pixels, no personal identifiers.
Contact enquiries: Retained for up to 2 years for correspondence records, then deleted.
Selfies — Find My Photos: Permanently deleted from R2 storage automatically once your search is complete.
Selfies — Event Registration: Retained in encrypted R2 storage until photos from your event are processed (typically within a few days of the event). Deleted automatically once the search runs.
Registration records: Your name and email address are permanently deleted from the registration record as soon as the search runs. Only non-identifying fields (registration ID, event name, search outcome, timestamp) are retained as a minimal audit log. Email me to request deletion of even that record at any time.
Permanent athlete profiles: Retained indefinitely until you request deletion. Email [email protected] with subject "Delete My Profile" — all records deleted within 5 business days.
Private gallery thumbnails: Automatically deleted from R2 storage 7 days after your gallery is created.
Purchase records: Retained for 7 years as required by tax law — order records in my own system (hosted on Cloudflare), payment records with Stripe.
You have the right to request access to any personal data I hold about you, ask me to correct inaccurate data, and request deletion of your data at any time.
To exercise any of these rights, email me at [email protected] with the subject line "Privacy Request". I'll respond within 5 business days.
If you're a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act. I do not sell personal information. Face embeddings generated by the Find My Photos feature are biometric identifiers under CPRA and are treated with the highest level of protection — collected only with your consent, used solely for photo matching, and deleted upon request. You have the right to know what data I've collected, request deletion, and opt out of any future collection. Contact me at the address below to exercise these rights.
If you're accessing this site from the European Union or United Kingdom, you have rights under GDPR including the right to data portability and the right to lodge a complaint with your local supervisory authority. The legal basis for processing your data is your explicit consent, given when you submit the contact or photo search form.
Cloudflare — hosting, DNS, Workers, and R2 encrypted storage. Privacy policy at cloudflare.com/privacypolicy.
Stripe — payment processing for purchases on photos.hizach.com. Privacy policy at stripe.com/privacy.
SmugMug — automated photo delivery for Find My Photos. When your selected photos are ready, they are uploaded to a private, unlisted SmugMug album and a download link is sent to your email. Their privacy policy applies to that delivery. Privacy policy at smugmug.com/about/privacy.
Resend — transactional email delivery (gallery invites, confirmations, order receipts and download links). Privacy policy at resend.com/privacy.
There are two ways to use facial recognition on this site: Find My Photos (you submit a selfie and I search immediately) and Event Registration (you register at an event and I notify you when photos are processed). Both use the same facial recognition technology and the same privacy protections — the only difference is timing.
Consent: By submitting either the Find My Photos form or the Event Registration form, you explicitly consent to facial recognition processing for the sole purpose of locating photos of you in my archive. You can request deletion of your data at any time by emailing [email protected].
1. Submission. Your selfie(s) and details (name, email, event) are uploaded securely to Cloudflare R2 storage, encrypted at rest, and accessible only to me. Selfie files are permanently deleted from R2 automatically once your search completes.
2. Face detection. Facial recognition software detects your face in each submitted photo and generates a face embedding — a mathematical vector representing the geometry of your face. The embedding itself is not a photo; it cannot be reverse-engineered into an image. This is processed entirely on my own hardware in San Francisco.
3. Archive search. Your face embedding is compared against embeddings pre-computed from my photo archive (sports events, regattas, and other shoots). No third-party facial recognition service is used — all matching runs locally on my machine.
4. Private gallery creation. Matching photos are assembled into a private, password-free gallery hosted on hizach.com. The gallery is accessible only via a unique private link sent to the email address you provided — it is not indexed, not publicly listed, and not accessible to anyone else.
5. You review and select. You browse your gallery and check off the photos you want. Submitting your selection sends me a notification and triggers an automated confirmation email to you.
6. Delivery. Your selected full-resolution photos are uploaded to a private, unlisted album on SmugMug and a download link is sent to your email. The album is accessible only via that unique link.
7. Gallery expiry. Your private gallery on hizach.com — including all thumbnail images — is automatically and permanently deleted from R2 storage 7 days after it was created.
1. Registration. At the event you visit hizach.com/register and submit your name, email, a selfie, and the event name. Your selfie is stored in encrypted Cloudflare R2 storage, accessible only to me, until photos from your event are processed.
2. Face detection & search. When I process photos from the event, your selfie is run through the same facial recognition pipeline described above. This typically happens within a few days of the event.
3. Notification. If I find photos of you, you receive a gallery invitation email with a private link — identical to the Find My Photos flow from step 4 onward. If I don't find a match, you receive a notification with a link to try the full Find My Photos search manually.
4. Selfie deletion. Your selfie is permanently deleted from R2 once the search runs, regardless of whether a match was found.
5. Registration record. Your name and email address are permanently deleted from the registration record the moment the search runs. Only non-identifying fields (event, search outcome, timestamp) are kept as a minimal audit log. Email me at any time to request deletion of even that record.
1. Opt-in. When registering for an event, you can check "Also notify me about future events." You can also create a profile directly at hizach.com/profile. This is entirely optional — the one-off search works without a profile.
2. What's stored. Your name, email address, reference photos (selfies), and face embedding are stored in encrypted Cloudflare R2 storage. Unlike the one-off search, this data is retained indefinitely — until you request deletion.
3. How it's used. When I process photos from any future event, your face embedding is compared against the archive automatically. If you're found, you receive a gallery invitation with no action needed on your part.
4. Deleting your profile. Email [email protected] with the subject line "Delete My Profile" and I will permanently delete your name, email, reference photos, face embedding, and all associated records within 5 business days. Your profile dashboard also includes a self-service deletion option.
Some galleries on photos.hizach.com have a Find me button that shows only the photos you appear in.
1. Your selfie stays on your device. When you take or choose a selfie, it is analysed by your own browser and is never uploaded. Your browser turns it into a face embedding (a set of 128 numbers describing the geometry of your face, which can't be turned back into a picture).
2. One search, nothing kept. That embedding is sent to the gallery server, compared once with the faces in that gallery, and discarded. It is not stored or logged, and no name or email is asked for.
3. The gallery's face index. To make the search possible, I index the faces in that gallery's photos (in my own browser) and store their embeddings with the gallery on Cloudflare. They're only used to answer Find me searches in that gallery.
4. Automatic deletion. A gallery's face index is deleted automatically 30 days after Find me is turned on (I can extend it for another 30 days while a gallery is still in use), and immediately if I turn Find me off or delete the gallery or photo. When it's deleted, the Find me button disappears.
If you'd like to be left out of a gallery's face index, or want a photo of you removed, email [email protected].
Your face embedding and submitted photos are never shared with any third party, never used to train or improve any external AI model, never used for identification outside of finding your photos in my archive, and never sold or licensed to anyone under any circumstances.
No third-party facial recognition API (such as AWS Rekognition, Google Vision, Apple Vision, or similar) is used. Find My Photos, event registration and athlete profiles are processed locally on my machine in San Francisco; Find me in a gallery runs in your browser and mine, with the comparison done by my own gallery software on Cloudflare.
Find My Photos sends up to three emails: a gallery invitation when your photos are found, a selection confirmation when you submit your picks, and a download link when your full-resolution files are ready.
Event Registration sends up to two emails: a registration confirmation immediately when you register ("you're on the list"), and either a gallery invitation if photos of you are found, or a no-match notification if they are not.
All emails are sent via Resend. These are the only emails you will receive — there is no marketing list and you will not be contacted for any other purpose.
When you buy or download a photo or video from my galleries at photos.hizach.com, you're getting a license as described in the Copyright & Usage section above — a personal use license unless you chose a commercial license at checkout. The seller is my company, A to Z Images LLC (doing business as Zach Franzen Photography); it may appear under either name on your card statement and receipt. Payments are processed securely by Stripe. Here's what you need to know about the transaction itself.
All digital download sales are final (except where the law requires otherwise). Because digital files are delivered instantly and can't be returned, I don't offer refunds on downloads. If you have a technical problem with your download — corrupted file, wrong resolution, delivery failure — contact me and I'll sort it out immediately.
Downloads are delivered at the resolution specified in the gallery. Full resolution files are large — make sure you have adequate storage before purchasing.
After payment you get your download links on your order page and in your receipt email. Each link works for 30 days and up to 10 downloads (50 for a whole-gallery ZIP). If a link runs out, email me and I'll send a new one.
Some galleries offer free downloads. Free downloads come with the same personal use license as paid ones.
Prints aren't sold through the galleries at the moment. You're welcome to print a personal use download for your own home or office. If you'd like a professionally made print, email me.
Need a photo for commercial purposes? Some galleries offer a commercial license at checkout. It covers business use: websites, advertising, team and sponsor promotion, and editorial. It doesn't cover resale, sublicensing, or products for sale. If a gallery doesn't offer one, or your use goes further than that, don't purchase a standard download — contact me first. Commercial licensing is priced based on usage type, duration, and distribution. I'm straightforward to deal with and won't price gouge athletes or small organisations.
Unauthorised commercial use of my photos is copyright infringement. I actively monitor for unauthorised use. If you're caught using a photo commercially without a license, you'll owe retroactive licensing fees plus legal costs. It's always cheaper and easier to just ask first.
The images you see while browsing the galleries are web previews, for viewing only. Saving, screenshotting, or downloading them for use — other than through a gallery's own download or buy buttons — is not permitted and constitutes copyright infringement.
Questions before you buy? Email [email protected] — I'm happy to answer any questions about licensing or resolution before you commit.