Privacy
Short and clear: what happens to the photos and data you leave with us.
Updated 1 November 2026.
- Who sees the photos
The album’s host. Guests see only their own photos, unless the host shares the album after the event. Albums aren’t public and don’t show up in search engines.
- What’s removed before upload
Location (GPS) and other data your phone writes into a photo. The photo is processed on your phone before it’s sent.
- How long they’re kept
A free album for 30 days; Basic for 3, Standard for 12 and Premium for 24 months from the event date. The host can extend this. When the album expires, photos, videos, messages (voice and video messages too), the photo for the QR card, guests and RSVP replies are deleted for good. Messages sealed in the time capsule and the up to 12 photos in it are kept separately until one month after the capsule opens (a year after the event), and then deleted too.
- Time capsule
With Standard and Premium a guest can seal a message (written, and on Premium also voice or video) for a year after the event. They choose this themselves, for each message. Nobody sees a sealed message before then, not even the host: it doesn’t appear in the album or on the screen at the venue. Once guests can no longer send, we copy up to 12 of the album’s photos into the capsule (screen-sized versions, never hidden photos). The capsule is kept apart from the album, so it stays when the album expires. A year after the event the host gets an email with a private link, and one month later the capsule’s messages, recordings and photos are deleted for good. Reported content can be reviewed and removed by an administrator.
- How to delete
You can delete your own photo from the same phone: open it in the album and choose Delete. The host can delete any photo, reply or the whole album.
- Guests
Guests don’t sign in. The phone gets a random tag in a cookie, only to recognise your photos and replies. Your name is optional.
- Invitation and RSVP
If you reply to an invitation, the couple sees your name, whether you’re coming, your guest’s name, the number and ages of children and your message. Children’s ages are only for planning (venue, menu) and are seen only by the host.
- Find my photos
In a shared Premium album, a guest can look for the photos they’re in with a selfie. It’s optional and only the guest starts it. Face matching runs entirely on the guest’s phone: the selfie isn’t sent to us or anyone else, and neither are the face descriptions (numbers the phone works out from the selfie and the album’s small preview images). We don’t receive or keep them. To make the next search faster, the phone remembers the album’s face descriptions only in its own browser, and the guest can delete them with one tap. The recognition models come from our own site, not from third parties.
- Hosts and accounts
For an account we keep your email and password. The password is stored only as a cryptographic hash, never readable. We use your email for signing in, payment receipts and album notices, not for advertising.
- Payments
Cards are processed by Lemon Squeezy as the seller (Merchant of Record); we never see or store card details. From a payment we keep the amount, package and order reference.
- Who else processes data
Cloudflare (hosting, database and photo storage), Lemon Squeezy (card payments) and Resend (email). We don’t sell data or share it for advertising.
- Your rights
You can ask to see your data, correct it, or delete your account and albums. Write to info@qralbum.ba.