Privacy & security
You're handing us photos of
the best day you've had.
So here is precisely what we store, who can see it, when it's destroyed — and, at the bottom, the things our protections don't cover. No badges, no vague reassurance.
Private by default
Your gallery isn't public and never has been. Only you, logged in, and guests who have uploaded from their own device can see the photos. Everyone else gets an upload prompt.
Invisible to search engines
Galleries are excluded from our sitemap and blocked in robots.txt, and there's no browsable index of galleries anywhere on the site. The only route to yours is your link.
Deleted, permanently
A job runs every night at 3am and deletes the photos of any gallery past its 30-day window — from the database and from storage. There's no archive behind it.
Never used for anything else
Your photos are not licensed, published, sold, or used to train any model. Every photo on this website is our own or properly licensed stock. None of it is a customer's.
Access
Who can see your gallery
You, when you're logged into your account. Your session is a signed token in an httpOnly cookie, which means JavaScript running in the page can't read it, and it's only sent over HTTPS in production.
Guests who have contributed, and only from the device they contributed on. A guest who lands on your gallery link sees an upload prompt rather than your photos. Once they've uploaded something, that device gets a cookie that opens the gallery to them. This is why forwarding your link to someone who wasn't there doesn't expose anything.
Anyone you deliberately publish to, if you switch on a public highlights gallery after unlocking. You choose each photo that goes in it, it gets a separate link from your private gallery, and that link asks for your event's date before it opens. Everything you didn't pick stays private.
Us, technically — we operate the database and the storage, so we have the access any service operator has. We use it to fix things people email us about, and for nothing else. There is no internal browsing tool, no analytics on your photo content, and no third party we hand it to.
Data
What we store
- Your email address
- So you can log in and so we can reach you about your gallery.
- Your password, hashed with bcrypt
- Stored as a one-way hash. We can't read it, and we couldn't tell you what it is if you asked.
- Your name and your event's name and date
- Shown on your dashboard and used to set the deletion deadline.
- The photos your guests upload
- Stored exactly as sent, at full resolution.
- A first name per photo
- Typed by the guest so you know who took what. It's the only thing we ask a guest for.
- An optional caption per photo
- Up to 200 characters, written by the guest.
- Whether your gallery has been paid for
- A yes/no flag, plus the Stripe session reference for the transaction.
Data
What we don't
- Card details
- Payment happens on Stripe's own hosted checkout. Card numbers never reach our servers — we're only told whether the payment succeeded.
- Guest accounts
- There aren't any. No email address, no password, no profile. A guest supplies a first name and nothing else.
- Guest contact details
- We never ask for a guest's email or phone number, so we can't leak, sell or lose them.
- Advertising or third-party trackers
- There is no ad network, no analytics pixel selling your behaviour on, and no data broker in this stack.
Retention
When your photos are destroyed
Every gallery gets a deadline the moment it's created: your event date plus 30 days. A scheduled job runs at 3am every night, finds any gallery past its deadline, and deletes its photos — the files from storage and the records from the database.
This is a real deletion. There is no archive, no cold storage, no soft-delete flag and no backup of your photos to restore from. Once that job has run, nobody can get them back — including us, and including if you offer to pay for it.
We know that's a blunt policy, and we've kept it because the alternative is us quietly accumulating an archive of thousands of strangers' weddings and children indefinitely. That archive would be worth something to somebody, and it would be our responsibility forever. We'd rather not have it.
What this means for you, practically: download your zip the day you unlock it, and put the copy somewhere durable. If you need the deadline extended, email us before it passes and we'll move it — afterwards there's nothing to move.
Payments
Payment runs through Stripe's hosted checkout. You're handed over to a page Stripe controls, you enter your card there, and your card details never pass through our servers at any point. We receive a confirmation that a payment succeeded and a reference for it — that's the entirety of what we learn.
We take card payments only, deliberately: they settle immediately, so a confirmed payment means an unlocked gallery with no reconciliation delay and no pending state to get stuck in. There is no stored card, no subscription and no recurring charge of any kind.
Where it runs
The application is hosted on Vercel. The database is Postgres, provided by Neon. Photo files are held in Vercel's blob storage, each gallery under its own path with randomly generated filenames. Everything is served over HTTPS.
Account passwords are hashed with bcrypt before they touch the database. Sessions, the admin area and the public gallery gate each use separately signed tokens, so a token for one can't be repurposed for another. Signing keys live in environment variables and aren't in the codebase.
The other half of the story
What our protections don't cover
Every security page on the internet lists its strengths. Here are the weaknesses, because you're deciding whether to trust us with something irreplaceable and you can't do that on a list of wins alone.
The preview watermark is an overlay, not burnt into the file
It sits over the image in the page rather than being baked into the pixels. It's there to make previews useful before you've unlocked, not as a copy-protection measure — a determined person could get past it, and we'd rather say so than imply a guarantee we can't make.
Photo files live at unguessable, but publicly addressable, URLs
Each upload gets a random filename in your gallery's storage path. Nobody can find or guess it, and it isn't linked from anywhere public — but if that exact URL were deliberately shared, it would open. Access control is on the gallery, not on each individual file.
The public gallery's question is a gate, not a password
Anyone with your public link who knows the date of your event can get in. That's the deliberate trade — it keeps a forwarded link from being browsed by strangers without making your relatives ask you for credentials. It isn't encryption and shouldn't be treated as such.
Photos keep whatever metadata the phone attached
We store files exactly as uploaded, which means EXIF data comes along — including GPS coordinates, if that guest has location tagging switched on. We don't read it or use it for anything, but it's in the originals you download, and you should know that before you publish them anywhere.
We hold no formal security certification
We are not ISO 27001 certified and we have not completed a SOC 2 audit. Two people running a small UK product haven't been through either process, and claiming a badge we don't hold would be worse than not having one. What we can offer is this page: the actual practices, in detail, so you can judge for yourself.
There's no two-factor authentication, and no self-serve password reset
Your account is protected by a password alone today. Both of these are on the list; neither is built. If you're locked out, email us and we'll verify you and get you back in manually.
Found a problem, or want something removed?
If you've found a security issue, email us before disclosing it publicly and we'll fix it and credit you if you'd like. If you want a photo taken down, or your account and everything in it deleted right now rather than at the deadline, say so and we'll do it.
info@tcgcommunityapps.comMore on how the product works day to day in the questions and answers.