Draft. This text hasn't been reviewed by a lawyer yet.
Privacy Policy
Last updated: 14 October 2026
PartyBuckets is an app for collecting everyone's photos from one event in one shared place, called a bucket. This policy explains what we collect, why, who we share it with and what you can do about it. We don't show ads, we don't track you across other apps or websites, and we don't sell your data.
Who we are
PartyBuckets is run by [Tangenta: full legal name, address, registration number] (“we”, “us”), the controller of your personal data. Questions or requests: [email protected].
What we collect
| What | When | Why |
|---|---|---|
| An account ID | The first time you open the app, we create an anonymous guest account for you. | So the app knows which buckets and photos are yours. |
| Your name | When you join or create a bucket. | So people in your buckets know who you are. |
| Email address and password | Only if you create an account (needed to create a bucket). We store a hash of your password, never the password itself. | To sign you in, send you sign-up and password reset codes, and reply to you. |
| Name and email from Apple or Google | Only if you sign in with Apple or Google. | To create and sign in to your account. |
| Profile photo | Only if you add one (accounts only). | Shown to people in your buckets. |
| Photos you throw into a bucket | When you add them. The app re-saves each photo at a smaller size before upload. | To store them and show them to the people in that bucket. |
| Buckets you're in, and when you joined | When you create or join a bucket. | To run the bucket: who's in it, who owns it, who added which photo. |
| Purchases | When you or someone in your bucket buys a bigger bucket. | To make the bucket bigger and to keep records required for accounting. We never see your card details. |
| When you accepted the Terms | When you create an account with email. | To show you agreed to them. |
| Technical data (IP address, device and app version, error logs) | When the app or website talks to our servers. | To keep the service running and secure. |
The app asks for camera access (to take photos and scan invite QR codes) and photo library access (to add photos and save a bucket's photos to your phone). It only uploads the photos you choose to throw into a bucket.
Who can see your photos
- Everyone in a bucket can see and download all of its photos, and see the names and profile photos of the people in it.
- Anyone who has a bucket's invite code or QR code can join it. Only share it with people you'd show the photos to.
- When a bucket is full, extra photos are kept but hidden from everyone, including the person who added them, until someone in the bucket makes it bigger.
- We don't look at your photos, except when we have to: to investigate a report of illegal or abusive content, or when the law requires it.
Legal basis
- Contract: most of the above is what's needed to provide the app you asked to use.
- Legitimate interests: keeping the service secure, preventing abuse and fixing errors.
- Legal obligation: keeping purchase records for tax and accounting.
Services we use
These companies process data for us, only to provide the service:
- Supabase: database, sign-in and photo storage. Data is stored in the EU (Frankfurt, Germany).
- Resend: sends our emails (sign-up and password reset codes).
- RevenueCat: manages purchases. It gets your account ID and purchase details.
- Google Play and Apple App Store: process payments made in the app, under their own privacy policies.
- Stripe: processes payments made on our website.
- Cloudflare: hosts this website and protects it from attacks.
- Apple and Google: sign-in, if you choose “Continue with Apple” or “Continue with Google”.
Some of these companies are based in the United States. Where data leaves the EU, it is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. [Check each provider's transfer basis.]
How long we keep it
- Photos are deleted when their bucket closes: 30 days after it was created for a Small bucket, 6 months for Medium, 1 year for Large. Making a bucket bigger restarts that period. The app shows the date in the bucket's info. After that, the bucket stays in your list as a memory (its name, members and photo count) without the photos.
- Your account is kept until you delete it.
- Guest accounts are kept until they are merged into an account you sign in to, or deleted at your request. [Decide: delete guest accounts after a period without use?]
- Purchase records are kept as long as tax law requires, without your account once you've deleted it.
Deleting your data
- Your account: in the app, tap your profile picture, then Delete account. Or see how to delete your account without the app.
- A bucket: its owner can delete it with all its photos in the bucket's info. Anyone else can leave it there; the photos you added stay in the bucket.
- A single photo: email us with the bucket name and which photo, and we'll remove it.
Your rights
Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to get it in a portable format. Email [email protected] and we'll reply within one month. You can also complain to your data protection authority; in Slovenia that's the Information Commissioner (ip-rs.si).
Children
PartyBuckets isn't meant for children under 16. If you think a child has given us personal data, email us and we'll delete it.
Changes
If we change this policy in a way that matters, we'll tell you in the app before the change applies. The date at the top shows the latest version.