Privacy Policy

Account details: your name, email address and a password (stored only as a one-way hash), plus the business name, country and currency you enter.

If you sign in with Google or Apple, we receive your name, email address and an account identifier from them, and never your Google or Apple password. With Apple’s “Hide My Email”, we only see a private relay address that forwards to you.

Workspace content: events, booth settings, layout designs, and the logos, backgrounds, frames and sounds you upload.

Booth devices: the tablet’s model, app version and when it was last online, so you can see and unpair your booths.

How the app is used: when it is opened, its version, the device model, language and timezone, a random identifier for the installation, and what happens in it (events created, booth sessions, photos emailed). No contacts, no photos from your library, no advertising identifier.

An approximate location (country, region and city), worked out on our server from the internet address the app connects from. We keep the area, never the address itself, and the app never asks for your device’s location.

Subscriptions are purchased through the App Store or Google Play and managed with RevenueCat. We receive your plan, renewal date and store; we never see your card details.

Photos taken at the booth, and the photo strip made from them.

An email address, only if the guest types one in to receive their photos, and a name if the event asks for one.

Whether the guest ticked the separate, optional box to hear from the organiser. Receiving photos never depends on it.

A count of how often a guest’s photo link is opened, and the approximate area it was opened from (worked out from the internet address, which is not kept). A guest is never identified: repeat visits on the same day are recognised by a code that changes daily.

To run the service: capture and store photos, render photo strips, show them on a private link, and email them when asked.

To send account email, such as confirming your address or resetting your password.

To show organisers real statistics about their own events.

To understand how the ShutterTrax app is used (which features, on which devices, in which countries) and to spot problems, from our own service records. We do not sell personal data.

The public marketing website can use Google Analytics when you choose Allow analytics. It measures page visits, clicks toward the download section and clicks to the app stores. It does not track activity inside the ShutterTrax app or the admin area.

The website does not load Google Analytics before your permission. Your choice is saved in this browser. Use Cookie settings to change it later. If you decline, you can still read the website and download the app.

When allowed, Google Analytics uses cookies to measure visits and receives technical information from your browser. Our integration removes query strings and fragments from page URLs, does not send form entries, guest photos or account identifiers, and disables Google advertising signals and ad personalisation. Google processes analytics information through its service.

Withdrawing permission stops further analytics events and clears the Google Analytics cookies accessible on this website. It does not erase information already collected. Contact us if you have a privacy request.

Data is hosted with DigitalOcean (application servers, database and file storage). Subscription status is processed by RevenueCat, Apple and Google. Email is sent from our own mail service.

On the Free plan, guest photos are never uploaded: they stay on the booth tablet that took them until the organiser deletes them there. We receive only a record of each session (time, number of photos, filter) for the organiser’s statistics.

On Creator and Pro, photos are uploaded to our storage so guests can open them by QR code or email and the organiser can see them on any device. The tablet’s copy is removed once the upload is complete.

Uploaded photos are kept for at most 30 days on Creator and 90 days on Pro, counted from when they were taken, then deleted automatically. Each event can also be set to delete sooner (for example, the day after the event). Guest details follow the event’s setting.

Guest photo links expire as the event is configured, and can be set to never expire.

Account data is kept until you delete your account. A deleted account is closed straight away and removed for good 30 days later; until then it can be restored with the link we email.

Usage records are kept for up to two years. When an account is removed, its usage records lose everything that links them to the person or workspace and only anonymous counts remain.

Organisers can export their workspace data and delete their account from the app (Settings › Account & workspace › Delete account), which also deletes the workspace, its events, guest photos and guest details. See /delete-account.

Guests can ask the event organiser, or us, to delete their photos or email address.

Questions or requests: [email protected].

ShutterTrax accounts are for adults running events. The service is not directed at children.