Privacy

UploadQR is run by Stratara OÜ, Estonia. This page says what we store and why.

What we store

For each album: its name, its date and a scrambled copy of the host’s private key. For each upload: the file itself and, if the guest typed one, the name they gave. We store files with Vercel’s storage service.

Your email, if you give it

Giving an email when you make an album is optional. If you buy a pass, the email you pay with is used the same way when you haven’t given one. We use it only to send your private album link and notices about that album: when it is nearly full, when it is full, a week before it closes, and when a pass is bought. If the address on an album is changed, the previous address is told. No newsletters, no marketing. The address, and the lookup that lets you ask for your album links by email, are deleted with the album. To send those notices we keep your album key encrypted alongside the address. Emails are sent through Resend.

Who can see uploads

Only someone with the album’s private host link can list, view or download its uploads. Guests can send files but cannot browse the album. Each file sits at an unguessable address, so treat any file link you share as public.

How long we keep it

Free albums are kept for 30 days after the event date (or after the album was made, if it has no date). A Party pass keeps the album for 3 months from purchase and the Event pass for a year, and a pass never shortens the free window. After that the album and every file in it are deleted automatically. The album page shows the exact date.

Deleting

Hosts can delete any upload from their album page. To delete a whole album sooner, email hello@uploadqr.com with the album link.

Payments

Passes are paid through Stripe. Stripe handles your card details and email address; we never see your card number. We keep a record of the payment against the album.

Analytics

We use PostHog, hosted in the EU, to count visits and see which steps people complete, such as making an album or sending photos. We strip private album keys from everything we measure, and we never look at the contents of an album. We don’t sell data or show ads.

On our public pages (the home page, guides and album creation) PostHog may also record how the page is used, such as scrolling and clicks, so we can fix what’s confusing. These recordings never include album, guest, transfer or find-my-album pages, never show photos or videos (they appear as blank boxes), and anything typed into a form is hidden.