Privacy policy

The data controller is JoinAlbum. For privacy requests, contact privacy@joinalbum.com. For product support, contact support@joinalbum.com.

This generic legal identity should be replaced with the final company details before relying on these pages in production.

Hosts provide account details through Firebase Authentication, event titles, event dates, plan/payment status, and album settings.

Guests provide a display name or identifier and upload photos or videos. The browser also stores an anonymous guest token so guests can identify their own uploads.

Uploaded files are stored privately in Cloudflare R2. The app creates short-lived signed links to show files in the gallery.

We process data to create and manage albums, let guests upload media, let hosts download media, provide support, secure the service, and process one-time payments.

We do not run a photo compression pipeline: files are uploaded to storage as received from the guest device.

JoinAlbum currently uses Firebase/Google for authentication and Firestore, Cloudflare R2 for private file storage, Lemon Squeezy for checkout, and Vercel for hosting.

These providers process data only to provide the service to JoinAlbum, subject to their own processing terms.

By default an album is private: each guest only sees the photos and videos they upload, and only the host can view or download the whole album.

The host may instead make the album public (anyone with the link or QR sees everything) or password-protected (guests see everything after entering a password). When the host enables either option, the host decides that guests' photos, videos, and names are shared with other guests and becomes the data controller for that shared content under the GDPR. JoinAlbum acts only as a processor on the host's behalf.

Hosts must only enable shared visibility with the consent of the people in the album and are responsible for handling access, rectification, and deletion requests for the content they chose to share.

Hosts can delete individual uploads, delete all uploads, and download the album. We keep account, event, payment, and media data while needed to provide the service or meet legal obligations.

Privacy requests can be sent to privacy@joinalbum.com.