Privacy Policy

1. Operator and privacy contact

Lee Chein Wern operates Picosnap in Singapore and is the contact for personal data questions. Email leewilson88@gmail.com for privacy requests or complaints.

2. Information we process

• Host account details, including email address, authentication identifiers and sign-in records.
• Event settings, including event name, occasion, dates, guest capacity, photo limits, reveal time and visibility.
• Guest membership identifiers and optional names or table numbers when supplied.
• Submitted photos, thumbnails, upload status and related event and capture timestamps.
• Technical information processed by hosting, authentication and security providers, such as IP address, browser information and security challenge results.
• Messages and information you send to support. When paid checkout launches, order references and purchase information needed to fulfil and support orders.

3. Why we use it

We use this information to authenticate hosts and guests, create events, enforce access and shot limits, upload and display photos, apply reveal and retention settings, send requested sign-in emails, prevent misuse, provide support and meet legal obligations. Browser camera permission is requested for capture. Declining it prevents camera use but does not grant us access to your camera.

4. Who can see event information

Event photos are accessible according to membership, reveal time and the host’s visibility selection. Depending on that selection, photos may be visible to all event members, only to the uploading guest and host, or only to the host. Hosts can see event membership information supplied by guests. People who can view photos may retain their own copies.

Authorised administrators can manage host approvals and event metadata. Administrative status does not automatically bypass gallery access rules. Where necessary, the operator and service providers may process data to provide support, investigate abuse or comply with law. Private access controls do not prevent an authorised recipient from copying or sharing a photo.

5. Service providers and overseas processing

We use Supabase for authentication, database and photo storage; Cloudflare for website delivery and bot protection; and Resend for sign-in email delivery. These providers process information needed for their functions. The current backend is hosted in Singapore; email delivery, global website delivery and provider operations can involve processing outside Singapore.

Where personal data is transferred overseas, we are responsible for taking the steps required by applicable data protection law, including appropriate contractual and security safeguards. If Paddle checkout is enabled, Paddle will process payment information under its own Privacy Policy. Picosnap does not currently collect payment card details.

6. Browser storage

The app stores authentication sessions, event drafts and your selected pricing currency in browser storage. The pricing page uses Cloudflare’s country signal to select a supported local currency; this does not request your precise location. You can change the currency yourself. The camera can temporarily store queued photos in your browser until an upload is confirmed or you remove the local copy. These local copies are separate from server storage. Clearing browser data may remove drafts, queued photos and guest return access. Signing out does not necessarily clear every locally stored draft or photo.

The current app does not include advertising trackers or a third-party marketing analytics integration. Hosting and security providers may still process technical logs and use storage required for their services.

7. Retention and deletion

Event gallery access expires 90 days after the event ends. Stored-photo deletion is handled by a separate cleanup process; access expiry is not an assurance of instantaneous deletion from all systems. A photo deletion request removes album access first while stored-file deletion may still be processing. Copies saved by other participants and photos still stored on their devices cannot be removed remotely.

Account information, event metadata, security records and support correspondence may remain where needed to operate the service, resolve disputes or satisfy legal obligations. We retain personal data only while needed for these purposes or required by law. Contact us to request account closure or discuss retention; any exceptions will be explained when handling the request.

8. Your choices and requests

You may request access to or correction of your personal data, withdraw consent, request deletion, or raise a privacy concern by emailing the privacy contact above. We may verify your identity without asking for your password or sign-in link. Requests are handled subject to applicable law and lawful exceptions. Withdrawing information needed to provide an event or account may mean we cannot continue providing that part of the service.

Hosts should explain their event’s sharing settings to guests and obtain appropriate permission for photos, particularly those involving children. The pilot is for non-sensitive test photos; do not submit identity documents or other sensitive material.

9. Updates

We will update this page when our practices change and communicate material changes through the website or, where appropriate, email. The date above identifies the latest revision.