Privacy policy
Last updated 4 September 2026
1. Who is responsible
The company named in the legal notice is the controller for everything described here. Data protection questions go to the address given there.
2. These pages
This site sets no cookies, loads nothing from third parties and serves its fonts from our own server. No analytics software runs here and no access log is kept for this domain, so reading these pages leaves no data with us.
3. When you create an album
A host account needs your name, your email address and what you tell us about the celebration. The legal basis is Art. 6(1)(b) GDPR: without those details there is no contract to perform. Nothing obliges you to give them, but an album cannot be created without them.
4. What your guests upload
Guests upload without an account. You decide what happens to the photos, videos and voice notes in your album: for that content you are the controller and we act on your instructions under Art. 28 GDPR. Voice notes are transcribed automatically so they can be read and searched; the transcription runs at Cloudflare, and the recordings train nothing.
5. The host dashboard
The host area — its address begins with app. — measures use with Google Analytics and Google Ads, and with an OpenAI advertising pixel once you accept. All of them start denied under Google Consent Mode v2: before you accept, nothing is written to your device and no identifier is set. The cookie banner lets you change or withdraw that choice at any time.
6. Who else processes it
Spaceship, a Namecheap brand (our servers, in Phoenix, Arizona, USA), Cloudflare (media storage and the voice transcription), Stripe (payment), Resend (email), Google (sign-in, analytics, advertising) and PostHog EU (product analytics, only after consent). Each acts on our instructions under a processing agreement. Where a provider is based in the United States the transfer rests on the EU standard contractual clauses, and on the EU-US Data Privacy Framework where that provider is certified.
7. How long we keep it
Albums are deleted at the end of their retention window. Account data is kept while the account exists.
8. Your rights
You can ask for access, correction, deletion, restriction and portability, object to processing, and withdraw a consent at any time with effect for the future. You can also complain to a supervisory authority; ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.