Privacy Policy

The short version

Toast Album exists to collect your event's photos privately. Galleries are private by default, we never sell personal information, photos are never used for advertising or AI training, and hosts can delete their event media at any time.

Who we are

Toast Album, ABN 60 422 621 849 ("we", "us") provides QR-code photo sharing for weddings and events. For customer or legal enquiries, contact us at support@toastalbum.com.au. For privacy enquiries, contact privacy@toastalbum.com.au.

What we collect

Hosts (account holders): name, email address, password (stored as a secure hash by our authentication provider), event details you enter (event name, date, type, optional passcode stored as a hash), and payment records. Card details are processed by Stripe and never touch our servers.

Guests: the photos you upload, an optional display name, and standard technical logs (such as IP address) used for security and rate limiting. Guests do not create accounts.

How photos are stored and who can see them

Uploads are stored in private cloud storage operated by Supabase and are only reachable through short-lived signed links issued to people with access to the event: the host, and guests who have the event link and, where enabled, the event passcode. Galleries are never public or indexed.

How we use information

To run the service: showing galleries to authorised guests, letting hosts retrieve original event files, processing payments, preventing abuse, and providing support. We do not sell or rent personal information, and we do not use your photos for marketing, advertising, or model training.

Payments

Payments are processed by Stripe. We keep records of what was purchased for which event (amount, plan, payment status) for accounting and support. See Stripe's privacy policy for how they handle card data.

Retention and deletion

Free events include 60-day gallery retention; paid events retain their gallery under the purchased plan. Hosts can delete individual photos or all event photos from the event management page at any time, and deleting an event removes its stored media. To request deletion of personal information or an account, email privacy@toastalbum.com.au.

Guests' rights and host responsibilities

Hosts are responsible for telling guests that photos uploaded at their event are shared into the event's private gallery. If you appear in a photo and want it removed, contact the event host or email privacy@toastalbum.com.au with the event details and we will help.

Cookies and browser storage

Essential authentication cookies keep hosts signed in. A private guest-link credential is stored in local browser storage for that event, an optional passcode is kept in session storage, and an interrupted upload queue may be kept in IndexedDB for up to 24 hours, subject to browser limits. The queue is capped at 25 photos and 500 MiB and can be cleared from the upload page or by clearing site data.

We use Vercel's privacy-focused analytics on public marketing pages to understand basic site usage. It is not loaded on account, host-management, private guest upload, or gallery pages. We do not use advertising pixels on private guest or host-management pages, and we do not sell browsing data.

With your permission, we also use Google Analytics on an explicit set of public marketing, signup, and login pages to measure campaign attribution and completed purchases. Allowing measurement can let Google set analytics and advertising-measurement cookies. Personalized advertising and advertising user-data features remain disabled. URLs and events sent to Google exclude private guest credentials, event codes, authentication callbacks, payment callback identifiers, names, email addresses, event names, and photo information. You can change your choice at any time using Privacy & cookie settings in the footer.

Your rights

You can request access to, correction of, or deletion of your personal information by emailing privacy@toastalbum.com.au. We handle requests in line with the Australian Privacy Principles and, where applicable, the GDPR.

Changes

If this policy changes materially we will update this page and the date above. Continued use of Toast Album after changes means you accept the updated policy.