Privacy Policy

1. Who are we?

PicEvent is a mobile app for sharing photos and videos between participants of the same event (wedding, birthday, trip, corporate event…). It also lets you order prints of those photos.

2. What data do we collect?

• Profile: the first name (or nickname) you enter, an automatically generated username, an avatar colour or photo if you choose one, and the account creation date.
• Technical identifier: an anonymous identifier provided by Firebase Authentication. Joining an album and posting in it requires no e-mail address, phone number or password.
• Permanent account: creating an album or ordering prints requires a lasting account, with an e-mail address and password, Google or Apple. We then keep the account's e-mail address. With “Sign in with Apple”, this may be a relay address provided by Apple. The password is managed by Firebase Authentication; we never have access to it.
• Content: the photos, videos, comments and likes you post in albums, and the list of albums you create or join.
• Reports: if you report a photo or comment, we record the identifier of the content, of the album, the reason chosen and any details you add. Your account identifier is stored separately, out of the organiser's reach.
• Print orders: the recipient's name and address, the photos, sizes, crops and quantities ordered, the amounts, dates and order status.
• Payment: card details are entered in Stripe's secure form and processed by Stripe. We never have access to them: we only receive the payment status and its references. Your account's e-mail address is passed to Stripe so it can send you the receipt.
• Event Pass: it is bought in the app, through Apple's App Store or Google Play, which collect the payment. We never have access to your payment method: we only receive the proof of purchase, which we have verified by Apple or Google, and we keep the transaction identifier, the album concerned and your account identifier, so that a purchase can only be used once.
• Notifications: a token specific to your device, provided by Firebase Cloud Messaging, so we can tell you about a new photo, comment or like. You can turn notifications off in your phone's settings.
• Diagnostics: if the app crashes, a technical report (device model, system and app version, error trace), linked to your account's technical identifier, via Firebase Crashlytics.
• Security: a device attestation (App Check, based on Apple's DeviceCheck or Google's Play Integrity), which checks that requests really come from the official app.
• Data stored only on your phone: your chosen language, the list of content you have hidden, the last delivery address entered, so you don't have to type it again, and the list of photos being uploaded, so the upload can resume if the app is closed.

3. Why this data, and on what legal basis?

• Running the service (albums, sharing, account): performance of the contract between us, the terms of use.
• Handling your orders and Event Pass purchases (production, delivery, Pass activation, complaints): performance of the sales contract. Keeping accounting records: legal obligation.
• Notifying you: your consent, given by allowing notifications on your phone.
• Fixing crashes and protecting the service against abuse: our legitimate interest in providing a reliable and secure app.

PicEvent shows no advertising, does not sell your data and does not use it for profiling.

4. Who has access to your data?

• Album members: photos, videos and comments posted in an album are visible only to people who have its invitation code. They are not public.
• The live slideshow (Event Pass): an album's organiser can create a secret link that shows the album's photos on a screen (TV, computer, projector), with their author's first name. Anyone who has this link sees those photos, without an account or code. Videos and comments do not appear. The organiser can create a new link at any time, which disables the old one.
• Our service providers, only for what concerns them:
  • Google Firebase: authentication, database, photo and video storage (in the European Union, in Belgium), notifications, diagnostics and security;
  • Cloudinary: storage of photos and videos posted before 7 October 2026, until their album is deleted;
  • Apple and Google: payment and verification of the Event Pass;
  • Stripe: payment of print orders;
  • Familink, our printer: it receives the recipient's name and address and the photos ordered, to print and ship them. It receives neither your e-mail nor your phone number.

Google, Cloudinary and Stripe may process data outside the European Union. These transfers are covered by appropriate safeguards: the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

5. How long do we keep your data?

• Albums: each album expires automatically 5 months after its creation. Its photos, videos, comments and reports are then permanently deleted, including from the storage servers.
• Photos ordered as prints: if a photo is part of an order in progress when you delete it, or when you delete the album or your account, its file is kept, outside the app, until the order ships and for 60 days at most. It is needed to fulfil your order, and is then destroyed automatically. Everything else is deleted immediately: the photo in the album, its comments, the album and the account.
• Profile: as long as your account exists. You can delete it at any time (see below).
• Orders: the delivery name and address are erased six months after the order, once it is complete. The content, amounts and dates are kept for ten years, the legal retention period for accounting records (article L. 123-22 of the French Commercial Code).
• Unpaid orders: cancelled after 48 hours, with the name and address erased.
• Event Pass purchases: the transaction identifier, the album and the date are kept for ten years, as accounting records. The link to your account is erased if you delete your account.
• Crash reports: 90 days.

6. Your rights (GDPR)

You have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability.

• Access and portability: the “My data” section of the app lets you view and export your data in JSON format.
• Erasure: deleting your account, available in the app, genuinely removes your profile, photos, videos, comments and likes, from both our database and media storage. The only exception: a photo needed for a print order in progress, whose file is kept until the order ships (see “How long do we keep your data?”). Your orders, which are accounting records, are kept but anonymised: name, address and link to your account are erased. A paid order not yet shipped stays intact until it is delivered, then is detached from your account as soon as it ships; its name and address are erased six months after the order, as for all orders.
• For any other request: piceventcontact@gmail.com.

You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

7. Minimum age

In accordance with French law, PicEvent is reserved for people aged at least 15, or under 15 with the permission of a holder of parental authority. This condition is accepted when the account is created.

8. Security

Exchanges with our servers are encrypted (HTTPS) and access to data is limited by strict security rules. As no system is infallible, we invite you to post only content you are happy to share with the members of your albums.

9. Reporting and moderation

Any guest can report a photo or comment they consider inappropriate, directly from the app.

The album's organiser is then notified and can see the content concerned, the reason and the details, to decide whether to delete it. However, they have no way of knowing who reported it: your identity is only accessible to our internal systems, and is used solely to deal with abuse of this feature.

10. Hidden content

You can hide a photo or comment for yourself alone, without reporting it. That list is stored only on your phone and is never sent to our servers: neither the organiser nor other guests can tell what you have chosen not to see. It is removed if you uninstall the app.

11. Changes

This policy may be updated; the date at the top of the page shows the latest version. In the event of a significant change, you will be informed in the app.