Draft — written from how the system actually behaves, but not yet reviewed by a lawyer. Do not rely on it as a binding agreement until it has been.

Data processing

Last reviewed 26 August 2026

For an organiser who needs to record what happens to personal data at their event — a company, a conference, or a venue acting for a client.

Roles

For an album you own, you are the controller and we are the processor. We handle the photographs and the guest display names on your instructions, for as long as the album exists.

What is processed

Guest display names, the photographs and videos guests upload, and the technical records needed to run the album — upload counts, storage usage and abuse limits.

Sub-processors

We use four, and we will tell you before adding another.

Neon — PostgreSQL database hosting
Cloudflare — object storage (R2) and delivery
Vercel — application hosting
Google — sign-in for hosts (OAuth); used only when a host signs in, never for guests

Security measures

Access tokens are stored as SHA-256 hashes and compared in constant time. The guest token is additionally kept encrypted with AES-256-GCM under a key held in the application environment rather than in the database, so that a host can be shown the link to their own album; the owner token is stored as a hash only and is never recoverable. Session cookies are signed, bound to a single event, and the owner and guest cookies are signed with deliberately different keys so that one can never be substituted for the other. Quota limits are enforced by database constraints rather than only in application code.

Retention and deletion

Data is held for the album's lifetime and deleted or made inaccessible after its end date. If you need a specific deletion before then, ask us and we will carry it out.

Breach notification

If we become aware of a breach affecting your album we will contact you without undue delay with what we know, what we are doing about it, and what we recommend you tell your guests.