Privacy policy

Confetti Gallery is run by TCG Community Apps Ltd, in the United Kingdom. For the account you create with us, we are the data controller. For the photos and names your guests upload to your gallery, we hold them so that you can collect them — you decide to run the gallery and who to invite, and we store and delete them as described below.

Contact for anything on this page: info@tcgcommunityapps.com.

If you host a gallery: your email address, a password (stored only as a bcrypt hash we can't reverse), the name you give us, and your event's title, type and date. If you were referred by another host, we record which gallery referred you. If you pay, we store the Stripe checkout reference and the amount — never your card details, which you enter on Stripe's own page.

If you upload photos as a guest: the photos, exactly as your phone saved them, the first name you type, and an optional caption. We don't ask guests for an email address, phone number or account. Photo files keep any metadata your phone attached, including location if you have location tagging on — we don't read or use it, but it stays in the file.

If you write us a testimonial: the name you want to be credited as, your words, an optional star rating, and, if you choose one, a photo from your gallery to go with it.

Our own code doesn't record your IP address or device. Our hosting provider, Vercel, keeps standard server request logs, which include IP addresses, for operating and securing the service.

• Running your gallery — your account, your guests' uploads, the download you pay for. Lawful basis: performing our contract with you.
• Guest names and captions — so a host can see who took what. Lawful basis: legitimate interests; the guest chooses to type them and can use any name they like.
• Payment records — to unlock your gallery, handle problems and keep accounts. Lawful basis: contract, and our legal obligation to keep financial records.
• Testimonials — published on our homepage only after you've submitted one and we've approved it. Lawful basis: your consent, which you can withdraw at any time by emailing us.
• Security and fixing faults — server logs and error reports. Lawful basis: legitimate interests in keeping the service working and safe.

We don't sell or rent personal data, we don't run advertising or analytics trackers, and we don't use your photos to train any AI model, or license or publish them. The one exception to "we don't publish them" is a photo a host chooses to go with a testimonial they've written for us.

We use a small number of companies to run the service:

• Vercel — hosts the website and stores photo files.
• Neon — hosts our Postgres database (accounts, gallery details, guest names and captions).
• Stripe — takes payments on its own hosted page. Stripe handles your card and billing details under its own privacy policy.

These providers may process data outside the UK, including in the United States. Where they do, they rely on the safeguards UK law requires for international transfers, such as the UK International Data Transfer Addendum or the UK–US data bridge. We don't use an email provider, analytics service or ad network.

• Photos, guest names and captions: permanently deleted by a nightly job 30 days after your event date, from the database and from storage. We can extend that if you ask before the deadline.
• Your account and gallery details (email, name, event title and date): kept after the photos are deleted so you can still log in, until you ask us to delete your account.
• Payment records: kept for as long as we need them for our accounts and tax records.
• Testimonials and their photo: kept and shown until you ask us to take them down, or we remove them.

We only use cookies that are needed for the site to work, so we don't show a cookie banner:

• confetti_session — keeps you logged in as a host, for up to 30 days.
• confetti_contrib_… — remembers that your device has uploaded to a gallery, so you can view it, for about 60 days.
• confetti_gate_… — remembers that you've answered a public gallery's date question, for 30 days.
• confetti_admin — used by us alone to run the site.

Your browser also remembers the name you last uploaded with, in local storage on your own device, so you don't have to retype it.

Under UK GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Email info@tcgcommunityapps.com — there's no form to fill in. We'll respond within one month.

Guests: if a photo of you, or one you uploaded, is in a gallery and you want it removed, email us with the gallery link and a description of the photo and we'll remove it. You don't need the host's permission.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

How we protect your data — and the limits of those protections, stated plainly — is set out on our privacy & security page.

If we change how we handle personal data, we'll update this page and the date at the top of it before the change takes effect.