Privacy policy

Unposed is a disposable camera for events. A host creates an event on an iPhone and puts its code on the tables, and guests take photos and short clips with their own phones. This policy says what we collect, why, who sees it and how long we keep it.

Who we are

Unposed is run by Davit Khaburdzania in Georgia (“Unposed”, “we”). Write to hello@unposed.camera about anything in this policy.

The short version

• Guests don’t need an account. We keep the name they type, if any, and the photos and clips they take.
• Hosts sign in with Apple or Google. We keep their name and email address.
• Photos are shared only inside their event, by the host’s settings. We never sell them, never watermark them, and never use them for ads or to train AI.
• We don’t ask for your location, and we remove it from photos before they’re uploaded.
• Photos stay until the host deletes the event or their account.

What we collect from hosts

• Account: your name and email address from Apple or Google. Apple may give us a private relay address instead of your real one. We never receive your password.
• Events: the name, type, date, time zone, the place if you add one, the cover picture and the event’s settings.
• Purchases: Apple takes the payment. We and RevenueCat receive the transaction record (product, price and transaction number) with your account id, to unlock guest places and to hear about refunds. We never see card details.
• Notifications: your device’s push token, if you allow notifications.
• Support: what you write in the app’s support form, with the event, app version and iOS version attached so we can help.

What we collect from guests

• Your name, if you type one. You can change or clear it.
• Your photos and clips: photos you take in Unposed or add from your camera roll, and clips you record in Unposed, with the time taken, size and length. Photos lose their location before upload, and clips never record it. Clips include sound if you allow the microphone.
• A guest key: a random code saved on your phone so Unposed knows you’re the same guest next time. We store only a scrambled copy of it.
• Your account, if you sign in to the Unposed app as a guest: your guest entry is tied to it, so the event and your own photos show on your other phones.
• Reports, if you report a photo: which photo, and that you reported it. The host is told a photo was reported, not by whom, and we receive the report by email so we can look at it.
• Gallery reminders, if you ask for one: your email address on the website, or your phone’s push token in the App Clip. We use them only to send that reminder, and the host never sees them.

What we collect from everyone

• IP address: used to stop abuse, such as one address joining an event hundreds of times. It’s kept only in the counters that do this, never with your name or photos, and deleted about a day after your last visit.
• Usage counts: through TelemetryDeck we count actions such as “an event was created” or “a photo was uploaded”. These counts carry random ids for the event, guest and photo, never names, email addresses, photos or IP addresses.
• On the website, your guest key is kept in a cookie and in your browser’s storage so you stay the same guest. We use no advertising cookies and no cross-site tracking.
• Website visits: on the home page, this policy and the terms, Google Analytics counts visits: the page, the site that sent you there, your browser and device type, and your approximate location, which Google works out from your IP address without keeping the address. In the EEA, the UK and Switzerland it sets no cookies. Elsewhere it sets one first-party cookie to tell a returning visitor from a new one. Its advertising features are off. It never runs on event pages, so it never sees an event code, a name or a photo.

We don’t collect your precise location, contacts or advertising identifier.

Who sees your photos

• The host sees every photo and clip at their event and the name of each guest who took it.
• Before the gallery opens, each guest sees only their own photos.
• When the gallery opens, at the host’s chosen time or right away for a live event, guests see the event’s photos and who took them. If the host chose to review photos first, guests see only their own until the host shares the rest.
• Anyone with the event’s code can open its page (name, date, place and cover) and join as a guest. The code works like an invitation, so share it the way you would one.
• The host can hide or delete any photo. When the host saves photos to their phone, each one carries the guest’s name and the time it was taken.
• The host can remove a guest from their event, which deletes that guest’s photos and stops their phone taking or seeing photos there.
• Guests can save the opened gallery to their phone.

Photos are kept in private storage and shown through links that expire after an hour. Event covers are public pictures.

Why we use your data

• To provide Unposed: accounts, events, uploads, galleries, purchases and the reminders you ask for.
• To keep it safe and working: stopping abuse, fixing problems, learning which features are used and how people find the website.
• To meet legal duties, such as keeping purchase records.
• With your permission: camera, microphone, photos and notifications, which you can turn off in iOS Settings at any time.

Who we share it with

These companies run parts of Unposed for us and may use your data only to do that:

We don’t sell personal data or share it for advertising. We disclose data only if the law requires it or to protect someone from harm.

Your data may be processed outside your country. Where the law requires it, our providers’ standard contractual clauses or equivalent safeguards protect it.

How long we keep it

• Photos, clips, guest names and event details stay until the host deletes the event or their account. They don’t expire on their own.
• A deleted event stays in Recently deleted for 7 days, then is erased with its photos, guests and reminders.
• A deleted account can be restored for 30 days. Then the account, its events, photos, purchase records (ours and RevenueCat’s) and support messages are erased. Photos you took as a guest at someone else's event stay with that event, no longer tied to you.
• IP addresses are deleted about a day after your last visit.
• Website visit details stay in Google Analytics for 2 months. After that only totals remain.
• Copies people saved to their own phones stay with them, and we can’t delete those.

Erased data can remain in our providers’ backups for a short time until they’re overwritten.

Your choices and rights

• Guests can change or clear their name on the event page. To remove a photo, report it from the photo, ask the host, or email us the event code and which photo.
• Hosts can edit or delete events and photos in the app, and delete their account in Settings.
• Anyone can stop Google Analytics counting their visits with a content blocker or Google’s opt-out add-on.
• Depending on where you live, you may have the right to see, correct, delete or export your data, and to object to how we use it. Email us and we’ll answer within 30 days. You can also complain to your local data protection authority.

Children

Hosts must be 18 or older. Guests under 13 should use Unposed only with a parent’s permission. If you think a child gave us personal data without one, email us and we’ll delete it.

Security

Each guest key reaches only its own event, and the database enforces who can see what. Photos sit in private storage and travel encrypted. No system is perfectly secure, so tell us at once if you find a problem.

Changes

When this policy changes, we update this page and the date at the top. We tell hosts in the app about significant changes. The terms of service cover the rest of how Unposed works.

Contact

hello@unposed.camera