Someone else’s wedding photos
You’re trusting us with media that can’t be re-shot. Here’s how it’s protected, and how long we keep it.
How the platform is built
Plain descriptions of the controls that are actually in place today.
Encrypted in transit and at rest
All traffic is served over TLS. Uploaded media is stored in Amazon S3 with server-side encryption enabled.
Signed, expiring media URLs
Photos and videos are never publicly readable. Every view or download uses a short-lived signed URL, so a copied link stops working.
Unguessable event links
Upload, display, and host links use long random tokens. Host portal links are only ever sent to the host's email address.
Moderation before display
Guest uploads are private until a host approves them. Nothing is shown on a screen or in the gallery by default.
Isolated per business account
Events, media, and storage totals are scoped to the owning business account and checked on every request.
No card data on our servers
Payments run entirely through Stripe Checkout and the Stripe billing portal. We never see or store card numbers.
Deletion actually deletes
Deleting an event removes both the database records and the underlying files. Automatic cleanup runs 30 days after each event date.
Rate limiting on uploads
Per-event, per-IP upload limits keep a single client from flooding an event with files.
What we store and for how long
If it isn't on this list, we don't collect it.
| Data | Why | Kept for |
|---|---|---|
| Account details | Sign-in, billing, and support | Until you delete your account |
| Event metadata | Running the event and its links | Until the event is deleted |
| Guest photos & videos | The slideshow, gallery, and downloads | 30 days after the event date |
| Guest names & messages | Slideshow captions, if enabled | Deleted with the media |
| Hashed upload IP | Abuse prevention and rate limiting | Rolling, short-lived window |
Reporting a vulnerability
Email security@crowdsnaps.com with steps to reproduce. We’ll acknowledge within two business days and keep you updated until it’s resolved. Please don’t run automated scans against live events — they contain other people’s photos.
See also our Privacy Policy and Acceptable Use Policy.