Privacy

What we keep about hosts

When you create an album, you give us the kind of event, its name, date, start time and time zone, an optional welcome line, your email and, if you answer it, how you heard about us.

We also keep where you came from: the campaign tags and ad click ids on the link you first arrived on (utm tags, and Google's gclid, gbraid, wbraid and match type) and the first page you opened. Your browser keeps these in a note named vl:ft until you create an album, and then sends them with it.

We keep all of this until the album is deleted. Then we delete the event name, the welcome line, your email and the three click ids, and keep only which campaign or answer brought the album, with counts that hold no personal data.

We email you only about your album: your host link when you create it, a morning email the day after your event, a reminder the day before your download window closes, and your links again if you ask for them on the create page. Nothing else.

What we keep about guests

• The photos. Before a guest's phone sends a photo, it makes a small copy and a display copy, and then it sends the original file too. We store all three on every plan; on Free the originals stay locked until the host upgrades. A photo the phone cannot shrink arrives as the original only.
• Each photo's file name and, if the guest adds one, their name. A random id stored on the guest's phone puts their name on their own photos and lets us count guests and upload moments; we never fingerprint a device. For 60 minutes after a photo arrives, the guest can remove it from the same phone, with a receipt kept for that photo.
• An email, if the guest leaves one to get the album: one address per guest, offered on albums where the host lets guests see the photos. We use it for one email at 10:00 the day after the event, and delete the address when that email goes out. When it cannot go out (the album has no guest photo that guests can see, the album was closed after a report, or delivery keeps failing), we delete the address unsent, at the latest 24 hours after the send time. We use a guest's email for that album only. We never send guests newsletters or ads. If only the host sees the photos, guests aren't offered the email, and any address already left is deleted without sending. An album we keep for the authorities keeps its guests' email addresses until we release it.
• For each photo, the automatic check's result, and whether the photo is hidden and by whom (the host or the screen helper). All of it is deleted with the photo.

Who sees a guest's photo

The host always does. Everyone else follows the host's choice, made when creating the album and open to change later:

• Everyone with the link, as they arrive.
• Only the ones I approve: everyone with the link sees only the photos the host approves.
• Only me: only the host sees the photos, and each guest sees that their own photos arrived.

The family link on The Keepsake shows the album to whoever the host sends it to, whichever option is chosen.

How we use the photos

We use guest photos only to deliver them to the host and the people the host shares the album with, and for the automatic check below.

There are two exceptions. If the host asks us for help with their own album, we look at what they ask us to look at. If someone reports an album, we close it without opening its photos; if a photo must be seen to act on the report, only the person who runs Vayluma opens it. Reported child sexual abuse material is never opened or downloaded: we close the album, keep its record and refer it to the authorities.

If we close an album over suspected child sexual abuse material, we keep it unopened until the authorities or a lawyer answer us.

The automatic check

When a guest sends a photo, an automatic check inside Cloudflare, where Vayluma is hosted, looks at the photo's copies for nudity, sexual content or graphic violence. The check is on for every album unless the host turns it off. No person looks at photos for this check, and we keep nothing from it but the result.

If the check stops a photo, only the host sees it, under “Check these first”, until they let it through or delete it. The check never deletes a photo. A photo the check cannot read waits there too, until the host lets it through or deletes it.

If the check is slow or down, new photos wait for the host, who can let them through after looking at them. The host's screen helper can also let through photos the check failed on twice, without seeing them.

The check skips the host's own photos.

Hiding photos and the screen helper

The host can hide any photo from the guests' page, the screen and the family link, and show it again later. A hidden photo stays in the album. The host still sees it, and only the host can delete it. The screen helper still sees the photos they hid, so they can show them again, unless the host chose “Keep hidden”.

The host can also give a link to someone they trust, like a planner or the DJ, to be the screen helper. The screen helper sees the photos guests can see and can hide them from the guests' page and the screen, or show them again. Their page has no download or delete button.

What your browser keeps

• On the front door and these legal pages, your browser keeps the first-touch note described above (vl:ft).
• On an album's page, a guest's browser keeps, for each album: a random id for this phone, a mark that it was counted, which photos it sent, whether the guest asked for the album by email (never the address) and how they arrived (from a card, a shared link and so on). It also keeps the language they picked and the larger-text setting.
• While a host creates an album, the browser keeps a one-time code for 30 minutes that lets them fix a mistyped email.
• The screen helper's page keeps only the language and the larger-text setting, never its link, and an album where only the host sees the photos adds nothing more.

The original file

An original photo keeps what the phone wrote into it, such as where it was taken. Whoever downloads originals (the host, and the family on The Keepsake) gets that information with the photo.

How long we keep things

Every photo is deleted when the album's window ends, plus 5 days. We keep no photo backups. The one exception is an album we keep for the authorities after a report, as described above.

Cloudflare keeps 30 days of database history, so a deleted record can stay in that history for up to 30 days. Email delivery records stay in Cloudflare's email log for about 30 days. Our Worker logs are kept 7 days and hold no tokens, email addresses, IP addresses or page addresses.

Payments go through Polar, the merchant of record. We keep a receipt ledger with no personal data.

Who processes data for us

Cloudflare hosts Vayluma and runs its database, photo storage, bot check, email sending and the automatic photo check (on Workers AI). Polar takes payments. Proton runs our inbox.

No page here carries analytics or ad tags. The first-touch note stays in your browser unless you create an album.

Cloudflare sees IP addresses, and we use them for a moment to limit abuse, such as too many requests in a minute. We never store or log them.

Your rights

Write to hello@vayluma.com to see or delete what we hold about you. Hosts delete photos from their host page, and guests can remove their own photo for 60 minutes after it arrives.