Private by default
A shared private photo gallery that stays out of the index
A shared private photo gallery has to be two things at once: open enough that sixty guests can put photographs into it without asking permission, and closed enough that nobody outside the room ever finds it.
The word shared does most of the work in this phrase, and it is the word people mistrust. Sharing photographs sounds like publishing them, because on the platforms that came before this, it was. A collection built for one event is a different object with a different rule: many people can add to it, and only the people you told can look at it. Getting that rule to hold is not a matter of one setting buried in a menu. It is three separate things, and it is worth knowing what each of them does.
Shared does not mean findable
There are three ways a gallery becomes visible to people who were not invited, and a private one has an answer for each.
A search engine crawling it
This is the one people worry about and the one that is easiest to close. Guest pages are deliberately kept out of search indexes, so typing the name of the occasion into a search box does not surface somebody's wedding.
A directory or listing putting it in front of strangers
The address of a collection is not listed anywhere: no public index of events, no browse page, no catalogue that a curious stranger can walk through. The gallery exists because you have the link, not because it appears in a place.
A guest forwarding it to somebody else
This one cannot be stopped by software, and pretending otherwise is dishonest. A link travels. What you control is what the person holding it finds when they open it, which is the subject of the next two sections.
Privacy at an event is not a lock on a door. It is knowing exactly what somebody sees once they are through it.
The first control, and the one people forget
Whether a guest can browse the gallery at all is a switch you set, and switching it off changes the page from a room into a letterbox.
- Browsing on
- The guest page shows what has arrived. Contributors see the collection filling, which is encouraging and is how a room catches its own enthusiasm. This is the natural setting for a party where everyone knows everyone.
- Browsing off
- The guest page becomes upload-only. A person can send photographs and clips, and cannot see a single frame anybody else sent. You still see everything, and the room screen can still play the collection if you are using it.
- Why the off position exists
- Because contribution and spectatorship are different asks. A guest who only wants to hand over four pictures should not have to feel watched doing it, and a surprise should not be spoiled by a page anybody can scroll.
Hosts choose the upload-only position for three recurring reasons: the event is a surprise, the room contains people who should not see each other's photographs yet, or the collection is being gathered for somebody else and the pictures are not theirs to browse. None of those is a security decision. They are all about who the page is for at the moment it is opened.
The second control: approval
Browsing decides who may look. Approval decides what is allowed to be looked at, and it works on the way in rather than the way out. Turn it on and every submission waits for you before it appears anywhere; leave it off and contributions join the collection as they arrive.
A guest sends, and nothing is published
The upload arrives and is held. The contributor gets their receipt, the collection grows privately, and the room sees nothing yet.
You look, quickly, on your phone
The waiting pile is one screen. The judgement is not curation, it is a reflex: blur, elbow, somebody's worst angle, or something that should not be in a room at all.
Accepted files go where the settings allow
An accepted submission joins the gallery, the slideshow rotation and the download in the same moment, subject to whether browsing is on.
Refused files are left out
A rejected submission does not appear anywhere and is excluded from the archive you take at the end, so the download is the collection rather than the raw noise.
Switching it off later is allowed
It is a switch, not a contract. Plenty of hosts run the first hour with approval on to see what the room is doing, then leave it off for the rest of the evening.
Approval only protects you if you open it
A held submission is an invisible submission. With approval on and nobody watching the queue, a collection looks abandoned while forty photographs sit waiting on a screen that stayed in a bag. Decide before the doors open whether you are going to look, and how often.
Read the settings guideThe four combinations, and who each one suits
- Browsing on, approval off
- The open room. Family and friends who were all invited to the same thing, a slideshow running, contributions appearing as they arrive. Best for a birthday, a reunion, an engagement drinks.
- Browsing off, approval off
- The letterbox. Everyone feeds the collection, nobody reads it but you. Use it for a surprise, for photographs being gathered for somebody else, or for a room you would rather not have comparing notes.
- Browsing on, approval on
- The curated room. Guests browse what has been accepted, which is the arrangement most couples land on when a projector is involved and half the guests are their partner's colleagues.
- Browsing off, approval on
- The quiet collection. Nothing shows anywhere until you have looked, and the guest page never displays a frame at all. This is what an organisation running a conference or a leaving drinks usually asks for.
Where the privacy stops and the plumbing starts
Some assurances are worth stating plainly because they are the ones people ask for in a message rather than out loud, and a host who is being asked by a venue or a client needs to answer without guessing.
- The guest page is kept out of search indexes, so the photographs do not surface for whoever types the couple's names.
- The address is not listed anywhere, and there is no public catalogue of events to browse.
- Guests never pay, never register, and never see a price while contributing.
- A file is stored as it arrived on the phone, rather than squeezed on the way in.
- The room screen runs on its own separate address, so you can hand a venue one link without handing over the collection.
- Everything comes down as one archive when you take it, and after the closing date that download is the copy that survives.
The one thing a private gallery cannot do
An unlisted address is a lock with no bolts. If a guest forwards the link to a colleague, or prints it on a slide that gets photographed, the person holding it can open it, because the address is the whole admission. That is a deliberate trade. It is what makes it possible for a hundred people to contribute in an evening without you approving a hundred logins, and it means the real protection is not the obscurity of the link but the two switches above it. Anyone who tells you a shared web address can be made genuinely unreachable once it has been sent is selling you something.
What the address does not do
- It does not identify the person opening it.
- It cannot unsent itself to somebody a guest forwarded it to.
- It does not stop a determined stranger who guessed it, which is why it is long enough not to be guessed.
- It is not a password, and it should not be treated as one in a public channel.
What your settings do
- Decide whether the page shows anything at all to a visitor.
- Decide whether a submission is allowed to appear before you have looked.
- Decide when the whole thing comes down, with warning mail beforehand.
- Keep the page out of indexes and out of listings, so the only route in is one you sent.
Say the address where you want it known. A collection link belongs in an invitation and on a table card, not in a public post with the photographs already in it.
Which occasions want the closed setting
Corporate days and conferences
The room contains clients, and the photographs contain lanyards, whiteboards and other people's faces. Upload-only browsing and a held queue are the two settings every organisation reaches for, and the archive then goes to whoever handles communications.
Weddings with a mixed room
Your own family, your partner's work colleagues, a few people nobody knows. Approval costs a glance between courses; a photograph that should not have reached the projector costs considerably more.
Children's birthdays
Other people's children are in every frame. Keep browsing off, download early, and do not leave the address in a group chat where it outlives the party.
Surprises and farewells
The gallery must not spoil the event it is documenting. An upload-only page lets the room feed a collection that stays invisible until the moment you choose.
Reunions across households
Adults who have not met in thirty years, photographs of somebody's house, a hundred phones. The setting most families settle on is browsing on and approval on, which keeps the warmth and loses the accidents.
What to tell a guest who asks who can see the photographs
It is always one person at the table, usually the one who reads the small print, and the answer is worth having ready because a guest who feels unsure sends nothing rather than risk it. Three plain sentences, no hedging: the page lives at an address we only gave to people we invited, it is not in a search engine and it is not listed anywhere, and the photographs come to us rather than to a service anybody can browse.
- Guests never register, so there is no account of theirs that could be visible to anybody.
- A submission goes into one collection for one event, not into a feed, a profile or an album that outlives the day.
- Whatever the room screen is playing is the same set of files, under the same settings you chose.
- The whole thing comes down on a stated date, and the download you take is what your family keeps.
- A photograph you refuse never reaches the gallery, the screen or the archive you hand to anybody.
What privacy means after the event
The week after
Take the download
The archive is the moment the collection stops being a page and becomes files you own. Everything you kept is in it; everything you refused is not.
The following months
The address ages out of use
People stop opening it, the group chat scrolls, and a link that is not listed anywhere becomes effectively unreachable. Nothing about it needs to be advertised, and nothing about it should be.
The closing date
It comes down, and the download is what remains
Each plan states how long a collection stays online from the event date, and warning mail goes out before it goes. That is the point at which privacy stops being a setting, because there is no page left to see.
Questions about private galleries
Can people find my event gallery in a search engine?
No. Guest pages are kept out of search indexes and the address is not listed anywhere, so there is no route to a collection except one you sent somebody.
Can guests upload without seeing each other's photographs?
Yes. Switch browsing off and the guest page becomes an upload page. Contributors still send files and give a name, and they never see what anyone else sent.
Is approval the same as hiding the gallery?
They are separate controls doing different jobs. Browsing decides whether visitors may look at the collection. Approval decides whether a submission may appear in it before you have seen it. Either can be used without the other.
What happens to a photograph I refuse?
It never appears in the gallery, in the slideshow, or in the archive you download. Refused submissions are excluded from the collection you take away.
Does the room screen share the same address?
No. The slideshow runs on its own separate address, which is how you can hand a venue or a friend one link to plug into a television without giving them the whole collection.
Is the gallery public at any point?
It is not. The word public in the settings only refers to whether guests who already have the link may browse what has arrived. It is not a statement about anybody else being able to find the page.
How long does a private collection stay private?
For as long as it is online, which each plan states in months counted from the event date. After the closing date the page is gone, and the only copy that matters is the one you downloaded.
Decide who can see it before you send the link
The two switches are worth setting before the first guest opens the page, because changing them afterwards is a conversation with a room that has already looked. Open a collection and read both settings while it is still empty.
How it works
Put one link on the tables and let everyone contribute.
Create a collection, print the table stands, and the photographs your guests took are waiting for you the morning after. Guests never install anything and never make an account.