Privacy

PartyBooth is a shared camera roll for one party. You join a specific event, add photos and video to it, and see what the host has approved. That is the whole product, and this page is the whole story of what it does with your data.

We do not sell anything to anyone, we do not run advertising, we do not build profiles of you, and we do not use your photos to train anything.

What we store

• Your account. Your email address, the name you chose, and — if you signed in with Google or Apple — the identifier they give us. Nothing else from those accounts.
• What you send. The photos and videos you add to an event, plus the technical facts that go with them: file size, format, dimensions, how long a video runs, and when it was sent.
• Who is in which party. Which events you have joined, when, and what role you have in them.
• A security log. Sign-ins, joins, uploads, moderation decisions and account changes are recorded so a host or an administrator can answer "what happened?". These records name accounts and actions, never the contents of a photo.
• Crash and error reports. When something breaks we get a report, with email addresses, tokens and URLs scrubbed out of it before it leaves your device.

Location data in your photos

Cameras write hidden information into every photo: where you were, to within a few metres, along with your phone's model and the exact time. We do not want it and we do not keep it.

Before a photo leaves your phone, PartyBooth re-saves it. That process keeps the picture and drops everything else — there is no location block left to strip, because one is never written. If your device cannot do that, the photo is refused rather than sent as-is.

Video is the exception, and we would rather say so than imply otherwise. A web browser cannot re-encode a video, so a clip is sent as your camera recorded it and may still carry that information inside the file. Only you and the party's hosts can ever play the original; everyone else sees a thumbnail we made ourselves. If that matters to you, turn location off in your camera settings before recording, or send a photo instead.

Who can see what you send

• Nothing is public. Files are stored privately. There is no such thing as "the link to a photo" — every view is checked against who you are and hands out an address that stops working within minutes.
• Waiting and declined items are nearly invisible. Until a host approves something, only you and the party's hosts can see it. If a host declines it, that stays true for ever: it is never shown to other guests.
• Approved items are visible to the people at that party — the guests who joined that event, and nobody else. Not other events, not the internet.
• Hosts see everything sent to their own party, because they cannot moderate what they cannot see.
• Administrators do not look at your photos. The people who run PartyBooth can see accounts, events and counts, and are not able to open the pictures.

No face recognition

We do not use facial recognition, face grouping, face matching, or any other biometric analysis — not to tag people, not to sort photos, not at all. No automated system looks at the content of your photos today; hosts approve or decline them themselves. If that ever changes, this page changes first.

Taking something back

You can withdraw anything you sent, at any time, whether or not it was approved. It disappears from every gallery and slideshow immediately and cannot be restored by you, by a host, or by us. The stored file is deleted.

You can also report another guest's photo to the party's hosts, and block another guest so their photos stop appearing for you. Blocking is silent — they are not told.

Deleting your account

You can delete your account from inside the app, in Settings — or on the web, at partybooth.app/account/deletion. Either way it takes effect at once: you lose access immediately and the account is scheduled for permanent erasure thirty days later.

When those thirty days are up, a scheduled job erases the lot: your photos and videos and the stored files behind them, your memberships, your blocks, your notification devices, and your sign-in with Google or Apple. What survives is an anonymous placeholder that nothing can sign into, because our security records and a host’s moderation history refer to it and a record that points at nothing is worse for everybody than one that points at “a former guest”.

Until the thirty days are up, your photos stay in the party with the attribution removed — they show as coming from a former guest — so that a host who is mid-event does not lose the evening. During that window you can also change your mind: ask us and the deletion is cancelled. After it, nothing can be brought back.

If you host a party and delete your account, the party is archivedrather than erased. Your guests’ photographs are not yours to delete.

How long we keep things

• Photos and videos stay while the event exists. An event you delete takes its media with it.
• Withdrawn items are removed from storage as soon as the withdrawal is recorded.
• Deleted accounts are erased after thirty days — the account, its media, the stored files, the relationships and the sign-in credential. Access ends the moment you ask, not thirty days later.
• Security records are kept longer than the rest, because their whole purpose is to be checkable after the fact.

Who else touches your data

PartyBooth runs on a small number of services, each doing one job: hosting the site, running the database, storing files, sending sign-in emails, and collecting crash reports. They process data on our instructions and are not permitted to use it for anything of their own.

Files are stored in the United States (Portland, Oregon) and the database in Virginia.

Age

PartyBooth is for adults — 18 and over. It is invitation-only and is not directed at children. If you believe a child has an account, tell the host of the party they joined and it will be removed.

Getting in touch

PartyBooth is in a private beta run by the person who invited you. Ask them first — they are the host of your party and can remove media, remove guests, and delete the whole event. For anything they cannot fix, reply to the email that sent you your sign-in code.