Legal
Privacy policy
Last updated 4 October 2026
This policy explains what personal data Friends Camera (the “Service”) handles, why, where it is stored, how long we keep it and the choices you have. If anything is unclear, write to us at contact@craftoz.com.
The short version
- We collect only what is needed to run a shared event camera.
- We do not sell personal data, show ads, use tracking cookies or use photos to train AI.
- Location and other hidden data are removed from photos on the guest’s phone before upload.
- Photos are stored in the European Union.
- Hosts and guests can delete photos at any time; deleted means permanently deleted.
- Photos are deleted automatically 30 days after an event’s access period ends.
- Payments are handled by Lemon Squeezy; we never see card details.
1. Who we are
The Service is operated by Craftoz (“we”, “us”). Contact: contact@craftoz.com.
Hosts create an account and an event. Guests join an event by scanning its QR code or opening its link.
We are the controller of host account data. For the photos and names collected at an event, the host decides to run the event and whom to invite, so the host is the controller and we process that data on the host’s behalf and on their instructions given through the Service.
2. What we collect
From hosts
- Name and email address.
- Password — stored only as a one-way hash (bcrypt). We cannot see it.
- Event details: name, type, date, welcome photo, colour and settings.
- Plan and order records: which plan was bought, when, the amount and currency, and the payment provider’s order number. We never receive card numbers.
- Account dates: sign-up, acceptance of the terms, last login.
From guests
- The first name or nickname typed when joining.
- The photos they take, and when.
- A random session code that keeps them signed in on their phone; we store only a hash of it.
Guests do not create an account and never give us an email address.
Technical data
- IP addresses, used briefly in memory to stop abuse (such as repeated login attempts) and kept in our hosting provider’s short-lived server logs.
- Anonymous page-view statistics (page, country, device type, referring site), collected without cookies or any identifier stored on your device. Event links are removed before they are recorded.
What we never collect
- Photo location (GPS) or other embedded camera data — each photo is re-drawn on the guest’s own phone before upload, which removes it.
- Card or bank details, contacts, phone numbers or social-media profiles.
- We do not run face recognition or any automated analysis of photos.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing accounts, events, the camera, albums and downloads | Performance of our contract with the host |
| Storing guests’ names and photos for the host | On the host’s behalf, as their processor |
| Activating paid plans and keeping order records | Performance of contract; legal obligations |
| Password-reset emails | Performance of contract |
| Security, abuse prevention, enforcing our terms | Legitimate interests |
| Anonymous visit statistics | Legitimate interests |
We do not send marketing emails.
4. Who can see what
- Each guest sees only the photos they took.
- The host sees every photo from their event, with the name each guest gave.
- There is no public gallery; event links are long random codes that cannot be guessed.
- Photos are private and only shown through signed links that expire within an hour.
- We access content only when needed to run or secure the Service, to answer your support request, or when required by law.
5. Where data is stored
- Photos and welcome photos: Cloudflare R2, European Union.
- Account, event, guest-name and order records: Neon (PostgreSQL), United States.
- Website hosting and statistics: Vercel (global network).
- Password-reset emails: Resend, sent from the European Union.
- Payments: Lemon Squeezy (see section 7).
Where data leaves your country, transfers are protected by safeguards such as the European Commission’s standard contractual clauses in our providers’ data-processing agreements.
6. How long we keep it
| Data | Kept until |
|---|---|
| Photos and guest names | Deleted by the host or guest, cleared with “reset”, or automatically 30 days after the event’s access period ends (30 days for the free trial; 12 months after payment for a paid plan) |
| Welcome photo and event details | Deleted with the photos as above, or with the account |
| Host account and order records | Until you delete your account. Accounts whose photos have been removed and that are not used again are deleted after a further 12 months |
| Password-reset links | Expire after 1 hour; deleted within a day |
| Server logs and backups | Short periods set by our providers, then deleted |
Deleting a photo removes the file from storage, not just from view. It cannot be recovered by us or anyone else.
7. Payments
Paid plans are sold by Lemon Squeezy, our reseller and Merchant of Record. Lemon Squeezy collects your payment and billing details, handles taxes, receipts and refunds, and is the controller of that data under its own privacy policy. We receive only the order number, plan, amount, currency and the email used, to activate your plan.
8. Cookies and storage on your device
We use only cookies and device storage that are strictly necessary for the Service, so we do not show a cookie banner.
| Name | Purpose | Lasts |
|---|---|---|
| fc_host | Keeps a host logged in | 30 days |
| fc_guest | Keeps a guest in their event, with their shot count | 120 days |
| fc_lang | Remembers a language chosen from the language menu | 1 year |
| fc_token (local storage) | Restores a guest’s session if their browser drops the cookie | Until cleared |
| Upload queue (IndexedDB) | Holds photos on the guest’s phone until they have uploaded | Until uploaded |
9. Service providers
Vercel (hosting, statistics), Neon (database), Cloudflare (photo storage), Resend (email) and Lemon Squeezy (payments). They process data only to provide their services, under data-processing terms. We may also disclose data if required by law, to protect rights and safety, or as part of a transfer of the Service — in which case this policy continues to apply.
10. Your rights
Depending on where you live (for example the EU/UK GDPR, Türkiye’s KVKK, the UAE PDPL or US state laws), you may have the right to access, correct, delete or receive a copy of your data, to object to or restrict its use, and to complain to a data-protection authority. We do not sell or share personal data for advertising.
- Hosts can do most of this from the dashboard: edit details, delete photos, download my data and delete my account.
- Guests can delete their own photos at any time from “Your photos”. For anything else, contact the host, or email contact@craftoz.com and we will help or pass the request to the host.
We reply within one month.
11. Security
- HTTPS everywhere; private storage reached only through short-lived signed links.
- Passwords hashed with bcrypt; session and reset codes stored only as hashes.
- Changing or resetting a password signs out every other device.
- Sign-up, login and other sensitive actions are rate-limited.
No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
12. Children
Host accounts are for adults (18+). Guests must be at least 13 to use the guest camera themselves. Children may appear in photos; the host is responsible for making sure guests — and parents of any children — agree to photos being taken and shared. We do not knowingly collect data from children under 13; if you believe we have, contact us and we will delete it.
13. Changes
We will update the date above when this policy changes and, for meaningful changes, tell hosts by email or in the dashboard before they take effect.
14. Contact
Craftoz — contact@craftoz.com. See also our terms of service.