Privacy Policy

1. Who this policy covers

Uplodeo has two distinct types of users, and the data we collect differs for each:

• Hosts — people who create an account to set up and manage photo collections. Hosts provide personal information during account creation and payment.
• Guests — people who upload photos by scanning a QR code or following a link. Guests do not create an account and are not required to identify themselves.

2. Information we collect from hosts

Account information

When you create a host account we collect:

• Email address — used to sign you in, send transactional notifications (upload alerts, expiry reminders), and respond to support requests.
• Display name — an optional name shown on your Collection pages and in notification emails. You may leave this blank.
• OAuth profile data — if you sign in with Google, we receive your Google account email and profile name. We do not receive your Google password.

Payment information

When you purchase a plan, payments are processed by Stripe. Uplodeo never receives or stores your full card number, CVV, or bank details. Stripe shares with us a limited receipt (amount, plan purchased, last-four card digits) for your records. You can review Stripe’s privacy practices at stripe.com/privacy.

Usage data

We collect server-side usage data including IP address (for rate limiting and abuse prevention), browser and device type, and activity timestamps. We do not use third-party advertising trackers.

3. Information we collect from guests

Guests do not create an account. The information we collect is limited to:

• Uploaded files — photos and videos you upload to a Collection. These are stored privately and are only visible to the host who created the Collection (and, if the host enables a shared gallery, to other people the host shares a gallery link with).
• Optional name and caption — if the host’s Collection form asks for your name or a caption, you may enter one. This information is visible only to the host.
• Anonymous session token — we generate a random identifier and store it in your browser’s session storage. This token is used only to enforce per-guest upload limits during your session. It is not linked to your real identity and expires when you close the tab.
• IP address — used for rate limiting (preventing spam uploads) and is not linked to your name or identity.

Guests are not required to provide their real name, email, or any contact information. If a Collection form requests a name and you prefer to remain anonymous, leave it blank or use a pseudonym.

4. How we use your information

We use the information we collect only to:

• Create and maintain your host account
• Deliver the service — storing, organizing, and presenting uploaded media to the host
• Send transactional emails to hosts (upload notifications, expiry warnings, account confirmations). We do not send marketing emails without your explicit opt-in.
• Process payments and issue receipts
• Prevent abuse, spam, and fraudulent uploads
• Diagnose technical issues and improve the reliability of the service
• Comply with legal obligations

We do not sell your data. We do not share your personal information with advertisers or data brokers. We do not use uploaded photos or videos to train machine learning models.

5. Information we share with third parties

We use the following service providers to operate Uplodeo. Each receives only the data necessary for their function:

We may also disclose information: (a) if required by law or valid legal process; (b) to protect the rights, property, or safety of Uplodeo, our users, or others; (c) in connection with a merger or acquisition, in which case the successor entity will be bound by this policy or provide notice before using your data differently.

6. How we store and protect your data

All data is stored on Supabase’s infrastructure in the United States. Uploaded files are stored in private storage buckets — they are never publicly accessible via a direct URL. Access is granted only through time-limited signed URLs generated by our servers, which we provide to the host who owns the Collection.

We use HTTPS for all data in transit. Row-level security policies in our database ensure that hosts can only access their own events and uploads.

Despite these measures, no system is completely secure. We cannot guarantee absolute security of your data. If we discover a breach that affects your personal information, we will notify you as required by applicable law.

7. Data retention

Host account data is retained for as long as your account is active. If you delete your account, your profile and event metadata are deleted. Uploaded files associated with deleted events are also deleted.

Collection data (uploads and metadata) is retained for a grace period after the Collection expires to allow you time to export. After the grace period, it may be permanently deleted. We aim to give hosts reasonable notice before permanent deletion.

Guest session tokens expire when the browser session ends. We retain server-side guest session records (upload counts, timestamps) for the lifetime of the Collection, then delete them with the Collection data.

Payment records are retained for as long as required by tax and accounting law (typically 7 years).

8. Cookies and local storage

Uplodeo uses the following browser storage:

• Authentication cookies — set by Supabase when you sign in as a host. These are strictly necessary to keep you logged in and are not used for tracking. They expire when your session ends or after a period of inactivity.
• Session storage (guest token) — a randomly generated upload token stored in sessionStorage while you are on a guest upload page. It is cleared when you close the tab and is never synced to a server in a way that links it to your identity.

We do not use advertising cookies, tracking pixels, or third-party analytics on guest-facing pages.

9. Your rights and choices

Depending on where you live, you may have rights regarding your personal information:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — ask us to delete your personal data. Host accounts can be deleted from your account settings. This deletes your profile and all associated Collections and uploads.
• Portability — request your data in a machine-readable format.
• Objection or restriction — object to certain uses of your data.

To exercise any of these rights, email us at legal@uplodeo.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

Guests: Because we do not collect your name or email, we cannot verify your identity to process access or deletion requests for specific guest upload records. If you are a guest and want photos you uploaded removed, contact the host of the Collection. Hosts can delete individual uploads from their dashboard at any time.

10. Children’s privacy

Uplodeo is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at legal@uplodeo.com and we will delete it promptly.

11. International users

Uplodeo is based in the United States. If you access the service from outside the US, your data will be transferred to and processed in the United States. By using Uplodeo you consent to this transfer. We rely on standard contractual clauses and our service providers’ data processing agreements to protect cross-border transfers.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where practical, notify active hosts by email. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions, concerns, or data requests? Email us at legal@uplodeo.com. We aim to respond within 5 business days.