Privacy
Private event photo sharing, described exactly
Private event photo sharing means an address that is not listed anywhere, a page search engines are told to leave alone, and a switch that holds each submission until you accept it. It does not mean a login.
Collecting everyone's pictures into one place, whatever the occasion.
The word private is used loosely on this side of the internet. A storage service means a folder is not world-readable. A messaging app means the thread is locked. A printing company means they will not email you afterwards. What a host of photographs actually wants is narrower and more concrete: that the pictures from Selma's first birthday are reachable by the people who were invited and by nobody else, that nothing appears anywhere it was not deliberately put, and that a photograph of a child does not surface in a search result under her name in a decade. Here is what private event photo sharing consists of, item by item, including the parts it does not include, named plainly rather than glossed over — because a host who assumes the wrong kind of privacy makes worse decisions than one who assumes none.
Private has a specific meaning here
The address is unlisted
A collection sits at a short web address that is not entered in any directory, not offered to anybody browsing the site, and not joined to a list of events. There is no public index in which to search for a name or a date. The only route to the page is a route you gave somebody: a message, a printed card, a stand on a table, a line in the invitation.
Guest pages are kept out of search indexes
The pages a contributor opens are deliberately excluded from indexing, which is why a wedding album forwarded to a colleague on the other side of the country does not begin appearing for other people who type the couple's names into a search box. It is not merely absent from one site's directory; the crawlers are asked to leave it alone as well.
Nothing is published on your behalf
There is no feed, no showcase, no featured-events page and no directory in which a collection appears. Being private here is not a setting that can be missed in an onboarding flow; it is the shape of the thing. The photographs go where you put them and nowhere else, which is the promise the whole arrangement rests on.
Approval holds a submission back
With approval turned on, a photograph or a clip waits until the host accepts it. Nothing shows in the gallery, nothing plays on the room screen, and anything rejected is left out of the archive entirely. That is the difference between privacy as a fence around the collection and privacy as a fence around what the collection is allowed to display.
The gallery is optional, and so is the screen
The public gallery switch can be turned off, and the guest page becomes upload-only: a contributor sends their photographs and sees no set of anybody else's. The slideshow is a separate token-gated address, handed to whoever is running the projector and to nobody else, so a venue can be given a screen without being given the collection or the dashboard.
The address is the only door
- What a contributor has to have
- The address, and nothing else. No account, no password, no verification mail, no app to install. At every tier, including the paid ones, a guest is simply a person who opens a web page. That is a privacy decision as much as a convenience one: a system with logins keeps a list of identities attached to your event, and this one does not.
- What a contributor gives
- A name, in one field, remembered for twelve hours so that a second round of uploads is not a second form. The name is for the host's benefit — it is how you find the person who has the video of the speeches — and it is the only personal thing the page asks, because every extra field is a guest who sends nothing.
- Where the address can sensibly go
- A message to the people you invited, an email carrying the day's schedule, a printed stand on the tables, a card by the door, a line in the invitation. Each of those is a decision about audience. Writing the guest list before you write the message is the part that prevents a week of quiet regret afterwards.
- What the address cannot be
- A password. Anyone holding it can open the page, so a link pasted into a public feed is not a private collection with a nice address; it is a public one, and no setting will undo the forwarding. The controls you actually have are the gallery switch, the approval switch, and care about where the link goes next.
- The guestbook is its own switch
- Written messages on Gather and above can be open while photographs are being reviewed, or shut entirely if a host wants photographs and no writing. Entries can be moderated and featured, which is how a page of wishes stays a page of wishes rather than becoming whatever the last guest on the third glass typed.
- The plan says how long it stays up
- Seven days on the free tier, then six, twelve or twenty-four months, with paid extensions of six or twelve more. Privacy here includes an ending: nothing sits online indefinitely, and the warning mail before a collection comes down is the host's cue to take the archive while it still exists to be taken.
- What the storage promises afterwards
- The file a guest sent is kept as it arrived, which is what makes the download worth taking, and the whole collection comes down as one streamed archive. Rejected submissions are excluded from it. The set of photographs a host can produce at the end is exactly the set they accepted, and nothing they refused is hiding inside it.
Approval, and what it holds back
Moderation is the privacy setting with the most ordinary use and the most misunderstood scope. It is available on Celebrate and Keepsake, and when it is on, a submission does not exist publicly until the host says yes: it is not in the gallery, not on the room screen, and not in the archive if it is refused. That is what makes it the right choice for a hall with a projector, a conference with delegates you did not invite, or a family event where the plus-ones are strangers to you. It is not a filter for quality, and hosts who treat it as one spend the evening editing rather than hosting and end up rejecting the sloppy, wonderful frame they will want in five years.
What private does not mean
Assumptions worth correcting
- That guests need an account, a password or an app before they can send anything.
- That the collection lives in a public gallery with other people's events beside it.
- That the photographs stay online indefinitely, whether or not anybody looks at them.
- That knowing the address is the same thing as being allowed in.
- That moderation is a filter deciding what is aesthetically worth keeping.
What is actually true
- A name is the only thing a contributor gives, at any tier, and the page remembers it for twelve hours.
- The address is not listed anywhere, and guest pages are kept out of search indexes.
- Every plan states a period counted from the event date, with warning mail before deletion.
- The address is the door, so the audience is decided by wherever you choose to send it.
- Approval is a yes or no on a submission, not a curating pass: it protects the room, not the composition.
The uncomfortable one is the fourth row on the left. A private collection with a careless host and a link pasted into a public feed is a public collection. Everything else on that side is a feature that does not exist; that one is a habit, and it is the only real risk in the arrangement.
The settings, in the order you will use them
- Public gallery: decide whether contributors may browse what has arrived, or only add to it. Off means upload-only.
- Approval: on if a projector is running, if children are in the room, or if you have not met half the guests. It is a switch on the collection settings, and it starts off.
- Guestbook: its own switch, because some hosts want photographs and no writing, and some want the writing and no browsing of photographs.
- Closing date: check the event date is right, since the period is counted from it and a wrong date shortens a collection quietly.
- Where the link goes: write that list before you print the card, because a forwarding is the one thing no setting can recall.
Decide these before the address is sent. Changing the audience of a collection after three dozen people have the link is not a settings change; it is an apology, and it arrives too late to matter.
The two rooms where privacy needs deciding first
A child's party
The photographs are of somebody who cannot consent to anything, and the guest list includes parents who do not know each other. The usual settings are approval on, the guest gallery off, and the address sent only to the people who were invited by name. The slideshow can still run, because it plays only what the host accepted, and the closing date is short on purpose: the archive comes home the week after, and the online page is not where the pictures live long-term.
A conference or a corporate day
Here privacy has a compliance shape rather than an emotional one, and the same two switches carry it: moderation on so that nothing reaches a room screen unreviewed, gallery off so that delegates contribute without browsing each other's files. The archive goes to whoever runs communications, and the retention period is chosen around that handover rather than around an anniversary. The download is ordinary files, which is where your own policies take over.
After the period ends, only the download is left
A collection comes down on the date its plan states, and the photographs inside it come down with it. The archive the host took is the copy that survives, along with any individual files pulled earlier. If privacy means control over where the set exists afterwards, that control is exercised at the download, not at the closing.
Retention and deletionHow long the privacy lasts
Privacy has a duration as well as a boundary, and it is worth being precise about both. The boundary is the address: unlisted, unindexed, handed out by you. The duration is the period in the plan you chose, counted from the event date rather than from the day you bought it, with extensions of six or twelve months available while the collection is still open. Warning mail goes out before deletion, and after that the collection is simply gone rather than archived somewhere behind your account. Hosts who want the photographs for decades get them by downloading them, once, into a place they already trust.
Questions about keeping a collection private
Can a search engine find my collection?
No. Guest pages are kept out of search indexes and the address is not listed anywhere, so there is no path from a search result to your photographs. The exception is a link you posted somewhere public yourself, which is why the address goes to invited people and printed tables rather than to feeds.
Do my guests need to create an account?
Never, at any tier. A contributor opens the address in their browser, chooses files, gives a name and sends. There is no registration step, and therefore no list of guest identities attached to your event that has to be maintained, exported or deleted later.
Can I stop guests seeing each other's photographs?
Yes, by switching the public gallery off. The page still uploads. The slideshow is separate and token-gated, and with approval on it plays only the photographs the host accepted, so you can give a venue a screen without giving it the whole collection.
What does approval actually keep out?
Everything, until you say otherwise. With moderation on, a submission does not appear in the gallery or on the room screen until the host accepts it, and rejected files are excluded from the archive. It is the setting for an audience you did not choose: a hall, a conference room, a wedding with plus-ones.
How long do the photographs stay online?
Seven days on the free tier, six months on Gather, twelve on Celebrate, twenty-four on Keepsake, with paid extensions of six or twelve more. Warning mail goes out before deletion, and after that the download is what remains, which is the whole reason the archive exists.
Can more than one person look after a private collection?
Keepsake includes two extra people helping to manage a collection. Below that tier, one account holds it, and the way other people get a private copy of the photographs is the archive rather than a shared login, which is usually the tidier arrangement anyway.
Is an unlisted address the same as a protected one?
It is the protection there is, and it is a real one: nothing is listed, nothing is indexed, and no directory joins your event to anybody else's. What it cannot do is stop a guest forwarding a link they were sent, which is why the audience is decided by where you send the address rather than by a permission nobody can grant.
Set the doors before you hand out the address
Gallery on or off, approval on or off, guestbook open or shut, and a date that is right. Then send the link to the people you meant, and let the photographs arrive while the evening is still going.
Event photo sharing
Put one link on the tables and let everyone contribute.
Create a collection, print the table stands, and the photographs your guests took are waiting for you the morning after. Guests never install anything and never make an account.