Privacy

Who is responsible

[COMPANY NAME], [ADDRESS], is responsible for the personal data described here. Contact: [CONTACT EMAIL]. [LEGAL REVIEW: name a Data Protection Officer if required under the NDPA.]

What we keep, and why

• Your account: name, email, password (stored only as a one-way hash), optional photo and bio, your settings, and when you agreed to the terms. To run your account.
• Your albums: photos and their details (titles, dates, captions, places, people's names you type). Location data embedded in photos is removed from the copies guests see. To show your albums to you and the people you share with.
• Security: access codes and two-step login secrets are stored encrypted. We record the devices you're signed in on and limit repeated wrong codes and passwords, using the network address they came from.
• Guests: guests don't need an account. When a guest adds a photo or signs a guestbook we keep the name they give, and a random identifier for their browser so a heart counts once. We count how often an album is opened, not who opened it.
• Payments: Flutterwave processes card payments. We never see your full card number; we keep a reference Flutterwave gives us for renewals, the card's brand and last four digits, and your invoices.
• Support: messages and attachments you send us.

Our legal bases are providing the service you signed up for, our legitimate interest in keeping it safe, and the law (for example keeping invoices). [LEGAL REVIEW: confirm bases under the NDPA.]

Who helps us

We use a few providers who handle data on our behalf: Cloudflare (photo storage, R2), Resend (sending email), Flutterwave (payments) and DigitalOcean (our servers). Some of them store data outside Nigeria. [LEGAL REVIEW: cross-border transfer safeguards.]

Cookies

We use one cookie to keep you signed in and to remember which shared albums you've unlocked, plus your browser's local storage for your light or dark theme. No advertising or tracking cookies.

How long we keep it

For as long as you have an account. When you delete it, everything goes after a 14-day window in which you can change your mind, except invoices and payment records, which we keep for [RETENTION PERIOD] for accounting. Exports you request are deleted after 7 days.

Your rights

Under Nigeria's Data Protection Act 2023 you can ask to see, correct, move or delete your data, and object to how we use it. Most of this you can do yourself: edit your details in Settings, export everything from Settings → Data & privacy, or delete your account there. For anything else, write to [CONTACT EMAIL]. You can also complain to the Nigeria Data Protection Commission.

Changes

We'll update this page when what we do changes, and tell you by email if it's significant. See also our Terms of use.