Draft — written from how the system actually behaves, but not yet reviewed by a lawyer. Do not rely on it as a binding agreement until it has been.
Privacy
Last reviewed 26 August 2026
This describes what the system actually holds, taken from the database schema rather than from a template. Where something is a deliberate design decision we say so, because the reason usually matters more than the fact.
What a guest gives us
A guest joining an album provides one thing: a display name, so the album can show who added what. There is no account, no email address, no password and no profile.
- A display name, between 1 and 60 characters
- The photos and videos they choose to upload
- A signed cookie tying their browser to that one event
What the cookie is
The session cookie is signed rather than stored — it carries a session id, an event id and a signature, and nothing else. It is bound to a single event, so it is worthless on any other album. It expires after 30 days.
Where photographs are kept
Photo and video files are stored on Cloudflare R2. The application records only metadata — dimensions, byte size and the storage keys — in a PostgreSQL database hosted by Neon. The files themselves never pass through our application servers.
Each album is reachable only from a link containing a long random token. The database holds a SHA-256 hash of that token, which can confirm a link but never reproduce one, together with a copy encrypted under a key that is held in our application environment and never stored in the database. So a copy of the database on its own still cannot reconstruct the link; reconstructing it needs both the database and that key.
IP addresses
Guest activity is rate-limited by session and by event, not by IP address. That is deliberate: everyone at a wedding shares the venue's router, and an IP-based limit would treat seventy guests as one person.
There is one exception. Orders placed on this website are rate-limited by IP, because someone ordering is a stranger on the open internet rather than a guest behind a known router. Those records are swept periodically and are not used for anything else.
What an order contains
Ordering an event stores the event name and date, a contact name, and one free-text contact field — which may be an email address, a phone number or a messaging handle, whichever you prefer to be reached on. Any note you add is stored with it, along with the language you ordered in.
How long any of it lasts
Every album has an explicit end date, set by its package. After that date guests can no longer view or add photographs. Download your archive before then; that file is yours and does not depend on us.
Deleting an account does not delete an album's photographs, deliberately — a wedding album does not belong solely to whoever happened to create the event.
Who processes data for us
Neon for the database, Cloudflare for file storage and delivery, and Vercel for application hosting. We do not sell data, we do not share it with advertisers, and there is no analytics or tracking script on the albums.
Asking us about your data
Write to us using the contact details on this site and we will tell you what is held about you and remove what we are able to remove. If you are a guest at someone else's event, we may need the album owner's involvement, because the album is theirs.