Privacy

Who we are

Night Album (nightalbum.com) is a private guest photo album for parties and events. The operator of this site is the controller for host accounts, billing, and running the service. Contact: hello@nightalbum.com.

For the photos and names inside an album, the host is the controller. They created the album and invited people with a code or QR. We store that content on the host’s behalf.

Who the pictures belong to

Night Album does not take copyright in your photos. The person who took the picture (or who already owns it) keeps their rights.

By adding a photo to an album you let that private album keep and show it to anyone who has the code, for as long as the album exists. The host may download the album or order prints if their plan allows it. We do not sell photos, license them to advertisers, or put albums in a public search or feed.

What we store

• Hosts: name, email, sign-in (email, Google, or X), and which albums they own.
• Guests: the first name they type, a random id kept in their own browser (not an account), and the photos and optional captions they add. Guests do not create a login.
• Album: title, code, plan, and whether uploads are open.
• Technical logs needed to run the site (for example an IP used to stop upload abuse). We do not build advertising profiles.

Where it lives

Album records and host accounts sit in a database in the EU (Frankfurt). Photo files sit in a private Cloudflare R2 bucket — not on a public CDN, not searchable. Each file is encrypted before it is stored, so opening the bucket shows ciphertext, not pictures. Photos are only decrypted when someone with the album code (or the host) views them through this site. The website itself is hosted on Vercel.

Payments go through Stripe. We do not store card numbers. Optional sign-in with Google or X happens on their sites; we only receive the identity they send back. If the host orders prints, selected photos and a shipping address go to Gelato to make and ship the order.

Encryption

Every photo is encrypted with AES-256-GCM before it is written to storage. Opening the bucket shows ciphertext, not pictures. Weyland Yutani OÜ (Night Album) does not run a staff photo gallery and does not browse albums in the course of business.

A file is decrypted only to show it to someone who has the album code, to let the host download the set, or to send a print job you asked for. Photo URLs are signed — knowing a photo id is not enough to open the file. A print job unlocks only the pictures you chose, for a few hours, so Gelato can fetch them. We do not use photos for advertising, model training, or a public feed. There is no staff gallery. Every unlock is logged.

How long we keep it

Photos stay until the host deletes them, or the plan ends. Then we delete the album files from storage.

• Free — 14 days
• Night — 30 days
• Event — 1 year
• Pro — 2 years

The guest name in the browser stays on that phone until they clear the site data. Host accounts stay until the host asks us to close them.

Who can see an album

Only people with the code or QR. There is no public explore page. Anyone the host shows the code to can view (and, while uploads are open, add) photos. The host can close uploads. Treat the code like a house key.

Your rights (EU / GDPR)

You can ask to access, correct, or delete personal data we hold, or get a copy, or object to processing. Email hello@nightalbum.com. If you are a guest, the fastest path is often the host: they can remove a photo from the album. You can also complain to your local data protection authority (in Portugal, the CNPD).

We process host accounts to run the contract (providing the album service). We process guest photos because the host invited you to a private event album and we store what you choose to add. You do not have to upload.

Weyland Yutani OÜ · VAT ID EE102985764 Sepapaja tn 6, Tallinn, Estonia

Digital plans are sold from Estonia. EU consumer VAT is charged at the rate of the buyer’s country via Stripe Tax (OSS). Contact hello@nightalbum.com for invoices.

Analytics

If you allow it, we use Vercel Web Analytics, Vercel Speed Insights, and Google Analytics to understand traffic and performance. These set cookies or similar identifiers. You can refuse analytics and still use the albums. Session cookies for sign-in are necessary.

Children

Night Album is for event hosts, not for children to open an account. A host who collects photos of minors is responsible for having a lawful reason to do so (usually a parent or guardian at the same event).

Changes

If this page changes in a material way we will update the date above. The terms cover use of the service. Terms.