Privacy Policy

What I collect

• Hosts: your email address, when you last signed in, your albums' details (names, event date, welcome message, folders, QR card design), your plan, and any requests for more photos, including a phone number and message if you give them.
• Guests: the photos you add, the name you type, and a random ID your browser keeps so your uploads can be told apart. Guests don't need an account.
• Reports: what you write on the report form, and your email if you give it.
• Technical data: IP addresses, kept briefly to stop abuse, and kept with a report or an admin action when one is made. Error details if something breaks. Page views are counted without cookies.

Why

To run the album: signing hosts in, storing photos, showing them to the hosts and to guests if the hosts allow it, sending sign-in codes and notices about an album, and keeping the service safe from abuse. I don't sell personal data, and there are no ads.

Who can see the photos

• The album's hosts see every photo added to their album.
• Anyone with the album's link can upload, and can see photos too if the hosts turned that on. Hosts can also add a password or review photos first. The album's link is the key, so share it like one.
• I can see albums as the administrator, and I look when it's needed to run the service, deal with a report, or fix a problem.

Services I use

• Cloudflare hosts the website, database and photos, counts anonymous visits, and provides the bot check (Turnstile) on forms.
• Google (Gmail) sends sign-in codes and notification emails.
• Google Drive, only if you choose to save an album there. That happens between your browser and Google.

Security

Connections to the site use HTTPS, so photos are encrypted on the way. Cloudflare encrypts stored data on its disks. The photo storage is private: photos can only be opened through links that expire. Location data and other metadata are removed from photos when they upload, and sign-in codes and session tokens are only stored as hashes.

Photos aren't end-to-end encrypted, because the site has to be able to show them to hosts and guests. No online service can promise perfect security. If a breach affected you, I'd tell you and do what the law requires.

How long it's kept

Albums and photos stay until the host deletes them or I remove them; nothing is deleted automatically today, and photo files have no separate backup, so please keep your own copy. Deleting an album deletes its photos. Sign-in codes last 10 minutes and sessions 30 days. Error records are cleared after about 60 days.

Cookies

Only what the site needs: a cookie that keeps hosts signed in, and one that remembers a guest typed an album's password. Your browser also stores your name for the next upload. Cloudflare's bot check may use its own technical data. There are no advertising cookies.

Your rights

You can ask me for a copy of your data, to correct it, or to delete it, including a photo of you in someone else's album. Email me@dealwithmuhammad.com or use the report form. I'll reply as soon as I can, and within 21 days. Malaysia's Personal Data Protection Act 2010 gives you these rights; if you're in the EU or UK, the GDPR does too, and you can also complain to your data protection authority.

Your data may be stored and handled outside your country, because the services above run worldwide.

Children

Hosts must be 18 or older, and the site isn't aimed at children under 13. Family events often include photos of children: parents or guardians can ask me to remove one at any time.

Changes

If this policy changes, I'll update this page and the date at the top.