Skip to content

Privacy Policy

Last updated: November 3, 2026

1. Information We Collect

Information you provide:

  • Email address and name when you create an account
  • Event names and gallery settings
  • Guest names when uploading photos
  • Photos, videos, guestbook messages and hearts left in events
  • A shipping address when you order printed cards, collected by Stripe

Information collected automatically:

  • Device information and browser type
  • IP address
  • Usage data and analytics
  • Session information for guest interactions

2. How We Use Your Information

  • To provide and maintain our service
  • To manage your account and events
  • To save photos and videos to the cloud storage you connect
  • To send email notifications about uploads
  • To improve our service and user experience
  • To comply with legal obligations

3. Data Storage and Security

Guests upload photos and videos to Cloudflare R2 storage. We then copy the originals to the cloud storage account the event organizer connects: Google Drive, OneDrive, or Dropbox. For Google Drive we can only reach files this app creates; for OneDrive and Dropbox we can only reach this app's own app folder.

We also keep copies on Cloudflare so galleries can show them, and create smaller image versions with Cloudflare Images. Videos are sent to Mux, which prepares versions for streaming and measures playback, such as load times, buffering, and how long a video is watched. Those measurements do not use cookies and carry no names or email addresses. Event metadata is stored securely in our database with encryption at rest and in transit.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

4. Third-Party Services

We use the following third-party services:

  • Google Drive, Microsoft OneDrive, and Dropbox: To save photos and videos to the storage account you connect
  • Google, Microsoft, and Dropbox sign-in: For authentication
  • Resend: For sending email notifications
  • Cloudflare: For hosting, database, media storage, and image processing
  • Mux: For video streaming and anonymous playback analytics
  • Google Gemini API: When an organizer uses the straighten action, to detect rotated photos
  • Stripe: For payment processing
  • Printify and Prodigi: To print and ship the cards you order, using your shipping address
  • PostHog: For product analytics and error tracking

5. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share information:

  • With your consent
  • To comply with legal obligations
  • To protect our rights and safety
  • With service providers who assist in operating our service

6. Your Rights

You have the right to:

  • Get a copy of your personal information
  • Correct information that is wrong
  • Delete your account yourself, in your account settings under Profile
  • Remove this app's access to a connected storage service from that service's account settings

For a copy or a correction, email us.

7. Guest Privacy

Guests can upload photos without creating an account. We collect minimal information from guests (optional name and session data). Event privacy settings determine whether guests can view uploaded photos.

8. AI Assistants

You can let an AI assistant, like Claude or ChatGPT, set up and manage your events. You approve it on our site first, and the approval screen says what it can do.

  • We get what the assistant sends to our tools, like an event name or a co-host's email, and the assistant's name. We do not get your chat with the assistant.
  • We use it only to do what the assistant asked for you. We count which tools are used, in PostHog.
  • The assistant stays connected until you remove it in your account settings under AI assistants, or delete your account. Removing it stops it at once.
  • What you type to the assistant is handled by the company that makes it, under that company's privacy policy.

9. Data Retention

  • We keep your account until you delete it.
  • Events and galleries stay until the host deletes them. They do not expire.
  • The copies on Cloudflare stay while the gallery shows them. They are deleted when the host deletes the photo, the event or the account. Uploads to our public demo gallery are deleted after 24 hours.
  • Originals in your Google Drive, OneDrive or Dropbox stay there until you delete them.

When you delete your account, we delete your events, galleries, guest uploads, sign-in details and AI assistant connections. We end our access to your connected storage and remove you as a co-host of other events. Stripe keeps its records of your payments, which tax and accounting rules require.

10. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal information from children under 13.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

If you have questions about this privacy policy, please contact us at hello@galleryqr.com