Draft — written from how the system actually behaves, but not yet reviewed by a lawyer. Do not rely on it as a binding agreement until it has been.
Security
Last reviewed 26 August 2026
Specific rather than reassuring. Everything below is a property of the code, not an aspiration — if a claim here stops being true, the claim should be removed rather than softened.
Album access
An album is reachable only from a link containing a 32-byte random token. The database holds a SHA-256 hash of it, and comparisons are done in constant time so that timing cannot be used to probe for a valid value. The guest token is also held encrypted with AES-256-GCM, under a key derived inside the application environment and never written to the database, so that the dashboard can show a host the link to their own album. The owner token — the one that permits moderation and downloading the archive — is stored as a hash only, and cannot be recovered by anyone, including us.
A wrong token and an album that does not exist return exactly the same response, so the endpoint cannot be used to discover which event codes are real.
Two separate identities
Guests and owners both hold signed cookies, and those cookies are signed with different keys. That is the whole of the separation: a guest cookie renamed to an owner cookie fails its signature check before its contents are ever examined, so a guest cannot promote themselves to moderator.
Cookies
Session cookies are HTTP-only, same-site, and carry a session id, an event id and a signature — nothing else. Each is bound to one event and is worthless anywhere else. They expire after 30 days.
Quotas enforced by the database
Upload and storage limits are database constraints, not only application checks, and the reservation that consumes quota is a single atomic statement. Concurrent uploads from a full room therefore cannot oversubscribe an album's limit, even if the application code has a bug.
Storage
Files live in Cloudflare R2 and never pass through the application. Uploads go directly to storage using short-lived credentials issued per upload.
What we do not claim
Photographs are not end-to-end encrypted — we could technically read them, and so could anyone holding both a database dump and our environment. Album privacy rests on the unguessability of the link. That is the honest boundary of this design, and it is worth knowing before using it for something genuinely sensitive.
Reporting something
If you find a vulnerability, contact us before disclosing it publicly and we will work with you. We are a small team and we will answer.