GDPR and data rights

Depending on your location, you may have rights to access, rectify, delete, restrict, object to processing, request portability, and lodge a complaint with a supervisory authority.

Send requests to privacy@joinalbum.com. We may need information to verify that you are the host or the guest connected to the requested data.

We process host account and album data to perform the service contract, process payments, meet legal obligations, and protect legitimate security interests.

Guest uploads and names are processed to provide the album requested by the host and guests.

For private albums, JoinAlbum processes the minimum data needed to deliver the service. When a host makes an album public or password-protected, the host determines that guests' content and names are shared with other guests and is the data controller for that processing; JoinAlbum acts as a processor.

Guests who want their content removed from a shared album should contact the host. JoinAlbum will support hosts in fulfilling deletion and access requests.

Some processors may process data outside your country, including the United States. We rely on provider data processing terms and transfer mechanisms where applicable.

Firebase Authentication is part of the authentication flow; Cloudflare R2 stores private media objects used by the album.