their.photos

Privacy

Last updated 8 September 2026

The short version

Your album is private. Guests can contribute through your link; the signed-in event owner can view and download the collection. We do not sell your uploaded media or use it to train models.

What we collect

From you: your email address, your event date, and what you tell us about your event. From your guests: the photographs and videos they choose to send, their name if they give one, and their email if they ask for a reminder link.

What we do with it

We store guest uploads, show them to the event owner and prepare the original files for download. If a guest asks for an upload reminder, their email is used for that reminder.

Who else sees it

Our hosting and processing providers handle data needed to operate the service. Files are stored with Cloudflare, the database is Supabase, the site runs on Vercel, and configured email goes through Resend. Guest footage is not sent to an external AI model. If a recap was provided with an earlier booking, its optional sharing link remains under the owner’s control; recipients can forward it.

Who sees the album

The event owner always sees everything sent to their album. Guests see only their own uploads unless the owner opens the album to guests, which is off until they choose it and can be set to viewing only or viewing and downloading. Anything awaiting review, or removed, is never shown to a guest. Turning the album off again closes it immediately.

Deletion

Media access ends 14 days after the couple explicitly accepts delivery of the prepared album. The next daily cleanup removes hosted originals, working copies, thumbnails and recaps. Acceptance is a deliberate action; merely receiving an email does not begin the window. Account and payment records are separate from uploaded media. A guest can remove anything they added at any time before that, using the link they uploaded with. If you want it all gone sooner, ask and we will do it.

An album that is never accepted still ends. We delete it 90 days after the event date, or 90 days after it was created when no date was given, whichever is later. Nothing sits here indefinitely because someone stopped replying.

Where a visit came from

If you arrive from an advertisement or a search, the campaign labels in the link (utm_source and its relatives) and the click identifier the advertising network adds are kept for the length of that browser tab and recorded against an order if you buy. It tells us which advertisement paid for itself. We set no advertising cookie, run no third-party analytics or tracking pixel, and nothing follows you to other sites or back here on a later visit.

Children

Children appear in wedding photographs. We do not identify anyone by name, we do not build profiles, and the material is deleted on the schedule above.

Your rights

Ask us for a copy of what we hold about you, or ask us to delete it, and we will. Downloaded copies held by the couple or guests are outside our control.