Privacy Policy
Last updated 2026-11-11
GuestPOV is a shared disposable camera for events. This page explains what we collect, why, how long we keep it and what you can do about it. Plain language, no tricks.
Who is responsible
For the photos and clips guests take, the host who created the film decides what happens to them (the host is the controller) and GuestPOV stores and shows them on the host's behalf (we are the processor). For host accounts, payments, and how we run the service, GuestPOV is the controller. Contact: [email protected]. GuestPOV is operated from Lagos, Nigeria.
What we collect
Guests: the name you type to join (first name required, last name only if the host asks), optional email or phone if the host asks for it, your language, a random device ID kept on your phone, and the photos and clips you take. Hosts: email address, the film settings you choose, and payment records (Stripe handles card details; we never see or store card numbers). Basic technical data such as an IP address is used briefly for abuse protection and a country-based price; it is stored only as a one-way hash where we keep it at all.
How photos are handled
Photos are stored privately. Nobody sees a photo until its roll is revealed, except the guest who took it and the host. After the reveal, who can see them depends on the film's privacy setting: only the host and the people who took them (private), everyone who joined (guests), or anyone with the link (public). Downloads are off unless the host turns them on. We do not use guest photos in marketing without the host's consent.
How long we keep it
A film and all its photos and clips are deleted 12 months after its last reveal. A host can delete a film at any time from its settings, and can delete their account from the films page; both remove the database records and the stored files. Copies in backups and caches disappear within 30 days. A guest can ask the host to delete their photos, or write to [email protected].
Who we share data with
Only the providers that run GuestPOV: Supabase (database and sign-in), Cloudflare R2 (photo storage), Stripe (payments), PostHog in its EU region (anonymous product analytics, no names, emails or photo links) and an email delivery service for sign-in codes and notices. Data is processed in the EU and the US; where it leaves the EU or UK we rely on the providers' standard contractual clauses or the EU-US Data Privacy Framework. We do not sell personal data and do not run advertising trackers.
Cookies and analytics
We use a cookie that keeps a guest signed in to their film, a sign-in cookie for hosts, and a language preference. Analytics are cookieless and never include personal details, so there is no consent banner to click through.
Children
GuestPOV is not directed at children. Guests under 16 should join only with a parent or guardian's permission, and the host is responsible for who they invite. A parent or guardian can ask us to remove a child's photos at [email protected].
Your rights
Depending on where you live (GDPR and UK GDPR, CCPA/CPRA, Brazil's LGPD, Nigeria's NDPR, India's DPDP Act and similar laws) you can ask to see, correct, export or delete your data, object to how it is used, and withdraw consent. We use contract and legitimate interest (running the event) as our lawful bases. Write to [email protected]; we reply within 30 days. You can also complain to your data protection authority.
Security
Files are private and served through short-lived links; connections are encrypted. If a breach affecting you happens we will tell you and the authorities as the law requires.
Changes
If we change this policy in a meaningful way we will update the date above and, for hosts, email you. Questions: [email protected].