Privacy policy

Who is responsible for your data?

The operator of this site is the data controller for information processed through the service. If you have questions, use the contact details in the Contact and data requests section below.

What we collect

• Account information: email address, password (stored as a secure hash), display name, and a security question and answer (answer stored as a hash) for password recovery.
• Gallery content: photos and videos you upload, optional captions, and related metadata such as file name, file size, and upload time.
• Wedding information: wedding title, tagline, join code, and membership or host status.
• Technical data: your browser may send standard request data (such as IP address and user agent) to our servers and hosting providers when you use the site. We use IP addresses temporarily in memory to limit repeated login attempts.

Uploaded photos and videos may contain embedded metadata (for example location or device information). We do not intentionally extract this metadata for display, but it may be stored as part of the file you upload.

Photos and videos may show identifiable people. Only upload content you are allowed to share with other wedding guests.

How we use your information

We use personal information to:

• create and manage your account;
• host wedding galleries and display shared media to authorised guests;
• let you upload, browse, and delete your own content;
• let wedding hosts manage people where that feature is enabled;
• protect the service (for example CSRF protection, rate limiting, and session security).

Our lawful bases under UK GDPR typically include contract (providing the service you sign up for) and legitimate interests (keeping the service secure and running reliably). Where required, we rely on consent for optional information such as display name or email.

Cookies

We use one essential cookie named session. It keeps you signed in and helps protect forms against cross-site request forgery. It expires after 14 days of inactivity or when you log out.

We do not use advertising cookies or analytics cookies. Fonts are served from this site only — we do not load fonts from third-party providers.

Because we only use strictly necessary cookies, we do not ask for cookie consent before you use the site. You can control or delete cookies through your browser settings, but signing in requires the session cookie.

Where data is stored and who processes it

Data is stored using Microsoft Azure services, including Azure Database for PostgreSQL (account and gallery metadata) and Azure Blob Storage (photo and video files), when configured for production.

Microsoft acts as a data processor on our behalf. Processing is covered by Microsoft’s standard contractual terms, including Microsoft’s Data Protection Addendum (DPA) available through the Microsoft Products and Services Data Protection Addendum.

Data may be processed in the region where our Azure resources are deployed. We do not sell your personal information.

How long we keep data

We keep account and gallery data while your wedding gallery is active and for a reasonable period afterwards unless you ask us to delete it sooner. Hosts may remove people; users can delete their own uploads.

Server and security logs retained by Azure are governed by Microsoft’s retention practices and our configuration of those services.

Your rights

Under UK GDPR you may have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability where applicable. You may also complain to the Information Commissioner’s Office (ICO).

To exercise your rights, contact us using the details below. We may need to verify your identity before responding.

Contact and data requests

For privacy questions or data subject requests, contact the operator of this site.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the service after changes means you accept the updated policy.