Privacy & security
A guest's face isn't content.It's theirs.
Built by an information security professional for the events where privacy matters most. Here's exactly what happens to a guest's selfie, and how long we keep everything.
What happens to a selfie
From the moment a guest scans the QR code to the moment the event is deleted.
- The guest agrees firstNobody's selfie is compared until they tick the box saying they agree.
- The selfie is compared, then discardedIt's matched against faces in this event's photos only, and never saved.
- They see shared moments plus their own photosCandids of other guests are never shown to them.
- Live updates are their choiceIf they opt in, we keep a face signature (a set of numbers, not a photo) and delete it when they stop, their session ends or the event is deleted.
- Everything is deleted on a scheduleBy default, 60 days after the event ends. The organiser can delete everything sooner with one click.
How long we keep things
The default schedule. Organisers can delete sooner.
| What | How long |
|---|---|
| Guest selfie | Not stored. Used once to find matches, then discarded. |
| Guest's gallery session | 30 days, so they can come back to their photos without another selfie. |
| Live face signature | Only while live updates are on. Deleted when the guest stops, their session ends or the event is deleted. |
| Event photos and face data | Until 60 days after the event ends, unless the organiser deletes them sooner. |
| Full-size originals | 7, 14 or 30 days, as the organiser chooses, or not kept at all when originals stay with the photographer. |
| Print orders | One year after payment. The copies made for printing are deleted after 90 days. Card details never reach us. |
| Organiser accounts | Until the account is closed. |
How we protect events
Every event kept apart
Each event has its own face collection. A face found at one event is never searched at another.
Codes kept scrambled
Event and upload codes are stored only in hashed form, so even we can't read them back.
Links that expire
Photos are served through private links that stop working after two hours.
Encrypted at rest
Photos and records are encrypted where they're stored, and sent only over HTTPS.
Off with one switch
Any guest or upload link can be turned off at once, and a new code issued.
Uncertain means private
When the AI isn't sure whether a photo should be shared, it stays private until a person decides.
The full detail is in our privacy policy and terms.
Privacy your guestswill notice.
Set up an event and see the guest experience for yourself.