Privacy Policy

1. What this covers

This policy explains what personal data Event Snaps Collective (“the Service”) collects when you join an event as a guest or run an event as a host, why we collect it, where it's stored, and how you can exercise your rights over it. Event Snaps Collective is built for use at events in the Philippines — weddings, debuts, showers, birthdays, reunions, anniversaries, graduations, corporate gatherings, and similar — and is written with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, “DPA”) in mind.

2. Data we collect

As a guest, joining and using an event collects:

• The first name you type in to join — shown next to your shots in the host's gallery.
• A device token — a random identifier saved as a cookie on your phone when you join, used to recognize your browser session on future visits and to prove you're the one allowed to delete your own shots. We store a one-way hash of this token, not the raw value; the raw token only ever lives in your device's cookie.
• Your table number, if the host has assigned one.
• The photos you upload, in full resolution, together with: file size, image width/height, file type, the embedded EXIF metadata your phone camera writes into the photo file (which can include the date/time the shot was taken and, depending on your phone's settings, GPS coordinates of where it was taken), and the server-recorded time of upload.

As a host, setting up and running an event additionally involves:

• the host/event name and date you enter at setup;
• a hashed copy of your host access token;
• every guest's name, table number, and photos, as described above, which you as host can view, filter, favorite, and export.

3. Photos may include images of minors

Weddings and similar events in the Philippines commonly include children as guests. Event Snaps Collective does not ask for or verify the age of anyone photographed, and photo prompts are not filtered by subject. If children are photographed through the Service, that is personal data (and potentially sensitive personal information) about a minor, and the DPA's heightened protections for children's data may apply. Hosts are responsible for ensuring guests understand that photos taken at the event — including of children — will be visible to the host in a shared gallery, and for obtaining any parent/guardian awareness or consent that applicable law requires before those photos are collected.

4. Where data is stored

Event, guest, and photo metadata (names, device-token hashes, prompt text, EXIF data, timestamps, and similar fields) is stored in a Supabase-hosted Postgres database. The photo files themselves — both the original full-resolution upload and generated thumbnail versions — are stored in Cloudflare R2 object storage. Guest photos upload directly from your phone to Cloudflare R2 using a short-lived, single-use upload link; the application server itself never receives or handles the raw image bytes.

5. No ad tracking or third-party analytics

Event Snaps Collective does not embed third-party advertising trackers or analytics scripts (no Google Analytics, Meta Pixel, or similar) on guest- or host-facing pages. We do not sell or share your data with advertisers. The only third-party infrastructure involved is Supabase (database hosting) and Cloudflare (file storage and, where applicable, hosting/CDN), which process data on our behalf as service providers, not as independent controllers of it.

6. How long we keep data

Today, Event Snaps Collective does not automatically delete photos or guest data after an event ends — there is no scheduled retention job. Photos and guest records persist until someone actively deletes them:

• a guest can delete their own shots from the “my shots” page for as long as their device session is active on that event;
• a host can delete any photo from their event's gallery console.

Deleting a photo removes the original file and its generated thumbnails from Cloudflare R2 and the corresponding database row — this is a permanent action, not a soft hide. Because there is currently no automatic expiry, hosts should not assume event data disappears on its own after the event; if you want your event and its guests' photos removed, contact us using the details below.

7. Your rights under the Data Privacy Act (RA 10173)

If you're a data subject under the DPA (which includes guests whose photos or name were collected through the Service), you have the right to:

• Be informed that your personal data is being collected and processed, which this policy is intended to satisfy;
• Access your personal data held by us or an event's host;
• Object to, or withdraw consent for, further collection or processing of your data;
• Correct inaccurate or outdated personal data (for example, a misspelled name);
• Erasure or blocking of your personal data under the conditions set out in the DPA;
• Damages for harm caused by inaccurate, incomplete, or unlawfully obtained personal data; and
• File a complaint with the National Privacy Commission (NPC) if you believe your rights under the DPA have been violated — privacy.gov.ph.

To exercise any of these rights against data held directly by us, contact us using the details in section 9. For data an event host controls (such as asking a specific host to remove your photo from their gallery), you may also need to contact that host directly, since hosts independently control their own event's guest list and gallery.

8. Changes to this policy

We may update this policy as the Service changes or as our legal obligations change. We'll update the “last updated” date above whenever we do. See also our Terms of Service.

9. Contact

Questions about this policy, or requests to exercise your data privacy rights, can be sent to [CONTACT EMAIL / DATA PROTECTION OFFICER PLACEHOLDER].