What we collect
- Pool owners: name, email, and a hashed password (or, if you sign in with Google, your Google account ID and verified email — we never see your Google password).
- Friends joining a pool: just the name and email you type in when you join via an invite link. No password, no separate account.
- Photos and videos you upload: the files themselves, plus metadata embedded in them — including GPS location, if your photo has it and you haven’t stripped it before uploading.
- Face detection data: when you upload a photo, your device (not our server) briefly scans it to find face positions — bounding boxes only, so we can show a “faces detected” indicator and let people tag themselves. We never try to identify whose face it is, and no facial-recognition matching happens anywhere in this app.
- Usage data: reactions, comments, and basic request metadata (like IP address) used for spam/abuse rate limiting.
How we use it
Strictly to run the product: showing pools and photos to the people in them, sending transactional emails (verification, password reset, invite-link recovery, notifications), processing subscription payments, and preventing abuse. We don’t sell your data, and we don’t use your photos or personal info for advertising.
Who can see your photos
Only people who’ve joined that specific pool via its invite link. Photos are never public — every photo is served through an access-checked endpoint, not a public URL. The one exception is a Trip Recap: if a pool owner explicitly turns one on, a curated highlight reel of the most-reacted-to photos becomes viewable by anyone with that recap’s link, without needing to join the pool. Pool owners can revoke a recap at any time.
Third parties we use
- Storage (Cloudflare R2 or similar) — hosts the actual photo/video files.
- Resend — sends transactional emails on our behalf.
- Google — optional sign-in (OAuth), and the source of the pretrained face-detection model your browser downloads on first use. Your photos are never sent to Google — the model runs entirely on your device.
- Stripe — processes subscription payments. We never see or store your card details; Stripe handles that directly.
Deleting your data
Pool owners can permanently delete their account at any time from Settings — this removes every pool they own and everything in it (photos, comments, reactions, invite links) right away, including the underlying files in storage. It cannot be undone.
Friends who joined a pool don’t have a separate account to delete — if you want your name, email, or uploaded photos removed from a pool, ask the pool owner to remove them, or contact us directly and we’ll help.
Questions
Reach out to the site operator for anything not covered here — data access requests, corrections, or deletion help.