Privacy Policy

SnapEcho lets you collect photos, videos and audio from the people at your event. This page explains what we store, where it lives, who can see it, and how to get rid of it. It is written to be read, not to be survived.

Anyone with the link can see the gallery

Event galleries are not password-protected. Anyone who has the event link or can scan the event QR code is able to view everything uploaded to it and add uploads of their own, without signing in or identifying themselves.

Please treat an event gallery as a shared space rather than a private one, and do not upload anything you would not want seen by everyone holding that link. A person viewing a ready item can also download it or send a copy through their device's share sheet. Shared photos and videos are watermarked; voice notes are sent unchanged. Deleting the gallery later cannot recall copies people have already saved or sent elsewhere.

What we collect

If you create an account

Only event organisers need an account. We store your email address and a cryptographic hash of your password — never the password itself. Your email is used to confirm your address, to reset your password, and to contact you about your account.

We also store the name you give when you sign up. That name is shown publicly on your event pages, as "Hosted by …", so guests can see who is behind an event. Choose something you are happy for guests to see — it does not have to be your legal name, and you can change it at any time on your profile page. Your email address is never shown to guests.

You also choose a username. Your username is public: it is the address of your profile page (/u/your-username), which shows your name and only the events you choose to list there. Every event starts unlisted. You can change your username at any time. The old one keeps leading to your profile and is never given to anyone else while your account exists. Deleting your account deletes your usernames with it.

You can also add a profile picture. It is public: it is shown on your profile page and beside "Hosted by" on your event pages. We crop it to a square and remove the information phones attach to photos, such as where a photo was taken. Removing it, or deleting your account, deletes it.

Events you create

Creating an event requires a name, a start date, a location or venue, and a cover photo. A description and an end date are optional, and you can change any of them later.

Uploads

The photos, videos and audio recordings contributed to an event, any caption typed alongside them, and the date and time they were uploaded. Guests do not need an account, and we do not ask contributors for a name, email address or phone number.

Uploads made before August 2026 also carry the file's original name, as it was on the device it came from — which can itself contain a person's name, such as "kate-and-tom-wedding.jpg". We no longer record it: uploads from that point on store no filename at all. The older ones are still held, are not shown anywhere in the app, and will be cleared if you ask us.

How galleries get used

When a guest opens an event gallery or an upload page, we record that it happened, and each record holds: an identifier standing for that guest within that one event, which event it was, what happened — a gallery opened, an upload page opened, an upload finished or did not — and the time. No IP address, no browser or device details, no file names, and nothing anyone typed.

The identifier is worked out separately for every event, so these records cannot be put side by side to follow anyone from one organiser's event to another's. They exist to answer how many people looked and how many contributed, and they are deleted along with the event they describe.

Shared media copies

When someone chooses Share beneath a ready photo, SnapEcho reads the stored gallery photo to create a separate JPEG carrying the SnapEcho mark, snapecho.ca, and the event name when the watermark font supports its characters. This does not change the stored photo or create another persistent copy in the event gallery.

The generated JPEG may remain in a temporary server cache for up to five minutes so repeated shares do not reprocess the photo. That cache is cleared when the photo or its event is deleted and when the event name changes. Audio sharing reads the stored file without changing it or creating another server-side copy. Your device decides whether to send a shared file to an app you choose or save it as a download; copies outside SnapEcho are controlled by that device, app, and recipient.

Video sharing works differently, and stores a second file. A watermark cannot be added to a video while you wait, so after a video finishes processing SnapEcho prepares a separate watermarked copy in the background and keeps it alongside the original. It is smaller than the original, carries the SnapEcho mark and the event name, and is what Share sends. The stored video you uploaded is read but never changed, and Download still returns it.

That copy is deleted when the video, the event or the account is deleted, and it is deleted and prepared again when the event name changes, because the name is part of the watermark. Until the new copy is ready that video has no Share button.

Technical information

Standard web server logs, and four cookies. Three are strictly necessary for the site to function: one that keeps you signed in if you have an account, one that protects forms against cross-site request forgery, and a short-lived one that carries a status message such as "Upload complete" from one page to the next. Guests receive the last two when they upload, even without an account. The fourth is how we count how many people opened an event gallery and how many went on to contribute: it holds a random number and nothing else, it is set by us rather than by anyone else, it is never shared, it cannot follow you to another site, and it expires after 30 days. We do not use advertising cookies, and the site carries no third-party analytics or tracking scripts.

Location data in your photos

Phone cameras often embed hidden metadata in a photo, including the exact GPS coordinates where it was taken. We remove this from photos. Images are re-encoded in your browser before they are uploaded, and stripped again on our servers, which clears EXIF, ICC, IPTC and XMP data — so the location where a photo was taken is not stored or shown to anyone.

Two honest limits. A GIF or WebP file is kept exactly as uploaded, so its animation plays, only when it carries none of that metadata; one that does is re-encoded without it, as a still image. GIF and WebP files uploaded before we began checking them were kept as uploaded either way, so those may still carry metadata. And while we add no metadata of our own to video and audio, we cannot guarantee that we remove everything your device embedded in a recording. A watermarked photo created through Share is always re-encoded without EXIF, ICC, IPTC or XMP metadata, even when an older stored GIF or WebP retains it. A watermarked video is re-encoded too, which drops most of what a recording carries, but we make no guarantee that every embedded field is removed. Downloading the original still returns the stored file unchanged.

Where your data is stored

SnapEcho runs on Microsoft Azure in the Canada Central region, located in Ontario. Your account details and event records are held in a managed PostgreSQL database, and uploaded files in Azure Blob Storage. Both stay in Canada. Technical error reports are kept elsewhere: Sentry, described under "Who else is involved", stores them in the United States.

Uploaded files are kept in private storage — they are never publicly listable. When a gallery displays a photo, video or recording, the site generates a link that expires after a short period rather than exposing a permanent public address.

Who else is involved

We do not sell your information, and we do not share it for advertising. We rely on a small number of service providers to run the site:

• Microsoft Azure — hosting, database and file storage, in the Canada Central region described above.
• Resend — sends account emails such as address confirmation and password resets. It receives your email address for that purpose only. This applies to account holders; guests who only upload never trigger an email.
• Sentry — error monitoring, which stores its reports in the United States. When something goes wrong on our servers, Sentry receives a technical report: what failed and where in our code, the address of the page that was requested with any codes or tokens in it removed, the kind of browser that asked for it and the language it prefers, and identifiers of the account, event or upload involved, such as their internal ID numbers or a username. It also receives timing details for a small sample of ordinary requests, so we can see which pages are slow. It does not receive your IP address, your cookies or your sign-in credentials, and it is not sent the contents of forms or uploads. Nothing from Sentry runs in your browser.

We may also disclose information where we are legally required to do so.

Keeping and deleting things

We keep event content until it is deleted. The organiser who owns an event can remove any individual upload, or delete the whole event; either action deletes the underlying files from storage as well as the database records.

The gallery-usage records described further up are kept for the life of the event they belong to, and no longer. Deleting the event deletes them; there is no separate archive of them and nothing is kept once the event is gone. This holds whether or not counting is currently switched on — the setting decides what is written from now on, not what survives.

You can close your account yourself, from your profile page. Deleting your account deletes every event you own, which removes their files from storage, and then removes your account details. It is immediate and cannot be undone — we do not keep a copy to restore from.

One thing worth knowing as a guest: because uploading does not require an account, you cannot delete your own contribution yourself. Ask the event organiser to remove it, or contact us using the details below and we will help.

Security

Traffic to the site is encrypted with HTTPS. Passwords are stored only as salted hashes. Our servers reach the database and file storage using managed identities rather than stored passwords or access keys. No system is perfectly secure, but we aim not to hold anything we do not need in the first place.

Your rights

SnapEcho is operated from Edmonton, Alberta. Alberta's Personal Information Protection Act (PIPA), and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, give you the right to ask what personal information we hold about you, to have it corrected if it is wrong, to have it deleted, and to withdraw your consent to our using it.

Write to us at the address below and we will respond. If you are not satisfied with how we have handled your request, you may complain to the Office of the Information and Privacy Commissioner of Alberta.

Children

SnapEcho is not directed at children, and accounts are intended for adults. Children may of course appear in photos taken at an event; if you are a parent or guardian and want an image of your child removed, contact the event organiser or us directly and we will remove it.

When you send us feedback

If you use our feedback form we store what you wrote, the page you were on, the error reference if there was one, and your account if you were signed in. We ask for your email address, which we use only to reply to that report.

The form is protected by Cloudflare Turnstile, which checks that submissions come from a person rather than an automated script. The log-in, registration, password-reset and resend-confirmation pages are protected the same way. It loads only on those pages.

Changes, and how to reach us

If we change this policy we will update the date at the top of this page. Material changes affecting account holders will also be sent by email.

Questions, requests or complaints: snapecho.ca@gmail.com
SnapEcho — Edmonton, Alberta, Canada