Privacy Policy

Draft dated November 2, 2026

This policy explains what information PhotoChime ("PhotoChime", "we", "us") collects through photochime.com and the PhotoChime app for event photos, videos, text posts, audio messages and prints (the "Services"), how we use and protect it, who is responsible for it, and the rights you have under privacy laws including the GDPR and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and Australia's Privacy Act. Some features described here may not be available at launch; this policy covers each one when we make it available.

Our commitments

• No selling and no ads. We never sell or rent your personal information, photos, videos or recordings, and we never show third-party ads in event galleries.
• No AI training. We never use your event photos, videos, recordings or face data to train or tune any AI model, ours or anyone else's.
• No guest accounts. Guests scan an event QR code and share or view in their phone browser, without an account, an email address or an app.
• Deleted stays deleted. We keep a record of every deletion and withdrawal, so a deleted photo is never brought back when we restore from a backup.

1. Who is responsible for your data

PhotoChime serves both Organizers (hosts) and Guests, so responsibility depends on the kind of data:

• Organizer accounts, billing and running the service: PhotoChime decides how and why this data is used, and is responsible for it (the "controller"). The providers in section 6 process it for us.
• Event content and guest details (photos, videos, audio messages, guest names and consent records): the Organizer decides who gets the event link, whether guests can see the gallery or must be approved, whether a consent message is shown, and what is hidden, exported, printed or deleted. The Organizer is responsible for this data (for a personal or family event, privacy law may treat them differently). PhotoChime processes it on the Organizer's behalf.

2. Information we collect

From Organizers and Collaborators

• Account: name, email address, an identifier from Google if you sign in with Google, the organizations and events you belong to, and whether you use extra sign-in security such as a passkey.
• Event settings: event name (for example a couple's names), date and time zone, the parts of the day used to sort photos, theme choices, and an optional gallery passcode, which we store only as a one-way hash (Argon2id), never as the passcode itself.
• Billing and shipping: payments are handled by our payment processor (such as Stripe); we never see or store full card numbers. For print orders we collect the shipping name, address and phone number.

From Guests

• What you share: photos (JPEG, HEIC, WebP and others), videos (MP4, MOV), audio messages recorded in the browser, on a venue tablet or by phone, text posts, captions and overlays, comments and likes.
• Your name and consent: an optional display name (or none, where the Organizer allows), and a time-stamped record that you accepted the event's upload terms or consent message.

From your photos and videos

• Camera data: in an isolated processing environment, we read when a photo or video was taken and which way up it is, to sort it into the event's parts of the day and show it the right way round.
• Location removed from what others see: the previews, thumbnails, video posters and web videos shown in the gallery have their camera data, including GPS location, removed. Original files stay in private storage and only the Organizer can download them, unless the Organizer lets guests download originals.
• Duplicates: we compute fingerprints of each file to spot duplicates and group near-identical burst photos. These cannot be turned back into the photo.

Collected automatically

• Event links: QR links look like photochime.com/e#…. The part after # is the secret, and browsers never send it to servers or other websites. The page swaps it for a secure session cookie and loads no third-party scripts; we store only a hash of your session ID.
• Abuse protection: we use Cloudflare Turnstile, a bot check, when a guest starts uploading, and keep counts of wrong passcodes and of files that failed our malware scan.
• Performance: our photo delivery records about 1 in 20 requests as an anonymous sample (data center, cache status, file type and a response-time range). It never records the photo's link or file name, or your IP address. The guest app also sends how long uploads took to appear, with no information about who you are; we keep these for 30 days.

3. Face data

Biometric privacy laws (such as Illinois' BIPA, Texas' biometric law, Washington's My Health My Data Act and GDPR Article 9) protect face data. We use it only in two optional cases:

1. Find my photos: when a Guest or Organizer chooses to search the gallery with a selfie and agrees on screen, we compare the selfie with faces in that event's photos to show the ones they appear in.
2. Photobook drafts: when the Organizer asks for a photobook draft, we detect faces in that event's photos to group the people who appear most and avoid cropping through faces.

• One event only: face data is created and kept within that one event, never matched against identity databases, never used to name anyone, and never used across events or accounts.
• Never shared or sold: neither your photos nor face data are sold, leased or shared with outside AI services.
• Deleted promptly: a selfie used for a search is deleted when the search session ends. An event's face data is deleted when the Organizer turns the feature off, when the person shown asks, or when the event's hosting period ends, whichever comes first.

4. Why we use your data (legal bases)

• To provide the Services (contract): sign-in, hosting galleries, processing uploads, slideshows, downloads, cloud drive copies the Organizer asks for, and print orders.
• With your consent: sharing content or recordings to an event, accepting an Organizer's consent message, selfie search, and optional marketing emails. You can withdraw consent at any time.
• Legitimate interests: keeping events separate and secure, scanning uploads for malware, preventing abuse and attacks, and measuring performance without identifying anyone.
• Legal obligations: tax and accounting records for payments, and legally required reports such as those about child safety.

5. How we protect your data

• Events kept apart: our database itself enforces that each organization and event can only reach its own data.
• Uploads checked in isolation: every upload lands in private holding storage, is checked for integrity and malware, and is opened only inside a locked-down environment with no network access, before it reaches the gallery.
• Private storage and short-lived links: photo storage is never public. Every preview, video and download is delivered through a link that expires within 10 to 15 minutes and stops working once an item is hidden or deleted.
• Backups: we keep encrypted database backups and a second copy of original files with a separate provider, and a signed record of deletions so that a restore never brings back what was deleted.

6. Providers we use

We share data only with these service providers, under agreements that limit them to providing their service to us:

• Cloudflare (United States and worldwide network): website and photo delivery, primary photo storage, protection against attacks, and Turnstile. Processes stored files, anonymous performance samples, IP addresses and bot-check tokens.
• Backblaze (United States or EU): encrypted database backups, the deletion record, and the second copy of original files.
• Resend (United States): account and service emails, such as sign-in links, download-ready notices and gallery end reminders. Processes Organizer email addresses, event names and email content.
• Payment processor (such as Stripe; United States, UK or EU): payments, invoices and tax. Processes billing name, email, payment method and purchase history.
• Print partners (when you order prints): making and shipping printed products. Processes shipping name, address, phone number and the print files you approved.
• Google (United States), only if an Organizer chooses it: Google sign-in, and copying event content to the Organizer's Google Drive.

7. How long we keep data

• Event content is kept for the hosting period of the event's plan, shown at purchase. We email the Organizer at least 30 days before it ends.
• Uploads that never finish or are rejected are deleted automatically, normally within about two weeks.
• A Guest's own deletion, or a removal we make after a privacy request, takes effect immediately: links stop working, cached copies are cleared and download archives are rebuilt without it.
• An Organizer's deletion can be undone for 7 days, then becomes permanent.
• Backup copies are protected against change for a fixed period, so a deleted item can remain in backups for up to about 35 days before it is permanently erased. It is never shown or restored in that time.
• Accounts: Organizers can delete their account and events at any time. We keep invoices and payment records only as long as tax and accounting law requires.

8. Your rights

Whether you are an Organizer, a Guest who uploaded, or someone who appears in a photo another guest uploaded, you can:

• See and take your data: ask what we hold about you and get a copy in a portable format.
• Delete or remove: as a Guest, delete your own uploads in "My uploads" from the browser you used. If you appear in something another guest uploaded, ask the Organizer, or email privacy@photochime.com with the event link and a description or screenshot of the item. We answer privacy requests within 30 days, and usually much sooner.
• Correct, restrict or object: ask us to fix inaccurate data, limit how we use it, or stop using it where we rely on legitimate interests.
• California residents: you can ask what we collect, and ask us to delete or correct it. PhotoChime does not sell or "share" personal information as the CCPA defines it, and we never treat you differently for using your rights.
• EEA, UK and Swiss residents: where data leaves your region, we rely on the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. You can also complain to your data protection authority.
• Australian residents: we follow the Australian Privacy Principles. If we do not resolve a complaint, you can contact the Office of the Australian Information Commissioner.

For requests about event content, we may involve the event's Organizer, who is responsible for it.

9. Cookies and browser storage

• Guest session cookie (__Host-pc_guest, secure, not readable by scripts): remembers your browser for an event, so "My uploads" and deleting your own uploads work without an account. It ends after 30 days without use.
• Organizer sign-in cookie (secure, not readable by scripts): keeps you signed in.
• Upload progress in your browser's storage, so an upload interrupted by poor venue Wi-Fi can continue.

Event pages load no advertising or tracking scripts. Our public website uses no analytics today; if we ever add analytics there, we will ask for your consent first where the law requires it.

10. Children

PhotoChime is not aimed at children under 13 (under 16 in the EEA and UK), and we do not knowingly create accounts for them. Family events naturally include photos of children taken by parents, relatives and guests; these stay in the Organizer's private, unlisted gallery under the Organizer's control. A parent or guardian who wants a photo or recording of their child removed can email privacy@photochime.com and we will remove it promptly.

11. Security incidents and changes to this policy

If a security incident affects your personal data or event content, we will tell affected Organizers by email and post a notice without undue delay, as the law requires. If we change this policy, we will update the date at the top and email Organizers about important changes.

12. Contact

• Privacy questions and removal requests: privacy@photochime.com
• Help with an event: support@photochime.com