LAST UPDATED · 12 SEPTEMBER 2026
Your people.
Your privacy.
This notice explains how Revelsnap uses personal information. The service operator and controller for our account, security and billing activities is Herman Vermaak, trading as StartMadeSimple, 9 Holder Close, Reading, RG2 9HQ, United Kingdom. Contact support@startsimple.cc about privacy or removal requests.
What we collect
We store a host identifier and a hash of your private host key, along with event details, settings, payment references, plan and purchase consent. Existing hosts who choose ChatGPT sign-in also provide their site account identifier and email. Stripe handles payment details; we do not store full card numbers.
When you contribute, we store the name you enter, your photos or videos in their original format, any caption or guestbook message, and upload time. Original files may contain camera, date and location metadata. Remove metadata before uploading if you do not want the host or permitted guests to receive it. Please avoid adding sensitive information that is not needed for the event.
We keep security and service records, including errors, request information and short-lived hashed network identifiers used for rate limits. Hosting providers may process IP addresses and request logs to operate and secure the service. We record aggregate daily counts such as page views, events created, checkout starts and successful or failed uploads. These counts are not a list of individual visitors.
On our own servers, we keep aggregate daily counts of public page views and product steps, grouped by a small set of campaign labels, for up to 90 days. These counters do not store your stories, files, full URLs, IP addresses or a persistent visitor identifier. Repeat visits can be counted again. Browser Do Not Track and Global Privacy Control signals disable these optional counters.
Anonymous event names and campaign labels are also sent from our server to PostHog in the United States for reporting. No customer content, IP address or visitor identifier is sent. Person profiles and session replay are disabled.
Why we use it
We use host and payment information to deliver the service you request and perform our contract with you. We process event contributions to provide the gallery requested by the host, and use proportionate security records to protect the service and prevent abuse. Our legitimate interests include operating the service, resolving problems and understanding aggregate usage. We retain records where necessary to meet accounting or other legal obligations. We use consent where a particular optional activity requires it.
Who can see your contributions
The host can view, download and remove contributions. Anyone with the event link and, when enabled, the PIN can contribute. They can also view and download when the host enables guest browsing. Turning browsing off does not undo copies already downloaded. A shared link is not identity verification. The host decides whom to invite and how they use their downloaded memories. An organisation hosting an event may have its own privacy responsibilities and notice.
We do not sell your contributions or use them to advertise Revelsnap without separate permission. We do not submit guest uploads to an AI model to generate or train content. Illustrative images on our marketing and sample pages are separate from guest galleries.
Service providers
We use OpenAI’s Sites service and Cloudflare infrastructure for hosting, account access, database and file storage, and Stripe for payment processing. These providers process information as needed to provide and secure their services. Information may be processed outside your country; applicable provider contractual safeguards govern international transfers. See the OpenAI privacy policy, Cloudflare privacy policy and Stripe privacy policy for their activities, including accounts you hold directly with them.
Email access
When email access is available, we store your verified email and account reference so you can return to your galleries. Resend delivers requested sign-in codes. Codes expire after 10 minutes and work once; secure sign-in cookies expire after 30 days. Expired codes and sessions are cleared during later email requests. Contact support to request account deletion.
Cookies and storage
A secure, necessary host cookie keeps your access on this browser for up to 90 days. Save your private host key to return on another device or after clearing cookies. Replacing the key invalidates the old key on all devices.
We use necessary authentication and security mechanisms. A preference cookie remembers your language for up to one year. If a gallery has a PIN, a secure cookie keeps that gallery unlocked for up to seven days. Changing the PIN invalidates existing guest sessions. We do not place advertising or optional analytics cookies in the Revelsnap application. Stripe and ChatGPT explain the cookies they use on their own services.
How long we keep it
Free previews are accessible for seven days. Paid galleries are accessible for 12 months from the event date. Expired gallery files are scheduled for deletion within 30 days; removed contributions and events are queued for earlier deletion. Gallery access ends immediately when an event is removed. Security rate-limit records and expired PIN sessions are regularly cleared. Account, support, transaction and audit records may be retained longer where necessary for support, fraud prevention, disputes or legal obligations. We do not promise recovery after deletion.
Your choices and rights
Hosts can change access settings and remove contributions or whole events in their dashboard. Guests can ask the host to remove a contribution or contact us with the event link and details sufficient to locate it. Depending on applicable law, you may have rights to access, correct, erase, restrict or transfer personal information, or object to processing. We may need to verify a request without collecting more information than necessary. We normally respond within one month.
If you have a concern, please contact us first. You may also complain to the UK Information Commissioner’s Office or your local data protection authority.