Your photos, your privacy.

What the site stores

Email codes are available only for @gmail.com addresses. When you use email sign-in, we use your email address to send a one-time code and identify your email account. Codes expire after ten minutes; we store a keyed hash rather than the readable code, a browser verification reference, an attempt counter and an expiry time. Expired challenges are removed during cleanup. Email delivery is handled by Resend. A verified Gmail address uses the same site account with either email codes or Google sign-in. We retain account associations to keep your photo ownership consistent between these methods. For signed-out visitors on the home and sign-in pages, Google Identity Services may display an account-selection prompt. Loading this service connects your browser to Google; whether the prompt appears depends on your browser and Google settings. You choose whether to continue. When you sign in with Google, we receive your Google account identifier, verified email and profile name. We use these to identify your Google account and protect access to your own photos; we do not request access to Gmail or Google Drive. It stores your uploaded photo, recipient name, message, recorded amount and timestamps to display your photo, calculate its place and remaining time, and let you manage it. Your sign-in email is displayed in your account. Contact is handled directly by email, not by a site form. Emails you choose to send are processed through the email service and are not stored as new support requests in this site database.

You choose and confirm a 4:3 crop in your browser before upload. Only the cropped WebP is uploaded; the full original is not sent to the site. If you protect a center photo, the site stores a salted password hash rather than the readable password.

What others can see

Every displayed photo has a public search code. Anyone with its code can locate it without signing in while it is displayed. A code does not bypass a center photo’s password or grant editing access. Codes stop locating photos at removal. To prevent code reuse, we keep a permanent counter containing no account identity, photo, name or message; we do not keep a historical code-to-photo directory.

People who can access the site can see active regular photos, recipient names, and their messages. An occupied center is represented on the wall by a pink photo area, a lock and the Center label. A protected center photo and message require the password or the uploader's signed-in account. The recipient name is not shown on the center tile, but is not private. Do not use a confidential name. Authorized operators can remove content and handle support requests. A password does not provide end-to-end encryption.

Storage and retention

Photos and messages uploaded for an unfinished initial purchase are kept privately and scheduled for removal after 24 hours. We retain the associated order reference and payment status to resolve delayed charges; clearing an upload does not confirm that a payment was cancelled. A delayed payment may require support before it can be resolved.

When you open an eligible top-up checkout, we keep a separate private copy of the photo, name and message for that pending payment. This copy is kept only until 24 hours after the original display deadline, and is then scheduled for deletion even if the payment is unresolved. Payment completed within that window after expiry starts a new display, with a new code and only the amount of that payment. When payment succeeds, the copy is either used for that display or queued for deletion; the unfinished-payment copy is not kept as an additional payment backup. An unused copy is also queued for deletion if the payment is conclusively closed. Order references and payment status remain for resolving delayed charges; a callback received after the copy has been cleared may require support. An expired checkout link alone does not prove the payment is closed. These copies are not publicly searchable or a photo archive.

Site records and images are stored with Cloudflare; the website is hosted on DigitalOcean. Each photo has a 24-hour display deadline. A successful eligible top-up resets it to 24 hours from that top-up; editing or changing pages does not. Photos and center content on every page become inaccessible when their 24-hour countdown ends, including through direct links and code search. Cleanup clears the recipient name, message, password hash and salt, then deletes the photo file and its entry. No public photo archive is kept. Cloudflare maintains database recovery history for a limited disaster-recovery window; it is not used to republish removed content. While a photo is actively displayed, we maintain a private recovery copy of its cropped image in separate storage to help if the display image is lost. Copies are created after publication and retried if storage is temporarily unavailable; protection is not instantaneous or guaranteed. A recovery copy can be used only while the same photo remains active and unexpired, with the same viewing permissions. It does not extend the display deadline. Expiry, replacement, early deletion or a refund that removes the display also makes its recovery copy unavailable and schedules it for deletion. Failed deletions are retried; a short-lived deletion reference may remain until cleanup completes. This is separate from the unfinished top-up copy described above and is not a historical photo archive. After the removal deadline, content remains inaccessible even if storage deletion is delayed. Failed deletions are retried using a retained deletion reference.

Amount-change activity is retained for up to 90 days and removed during cleanup. Legacy site support requests are removed during cleanup once older than 90 days, or when you delete your site data. New questions, reports and privacy requests go by email. Short-lived hashed request identifiers and counters help limit abuse. Traffic limits also use temporary, hashed network identifiers held in server memory. Security logs and operator alerts contain aggregate request counts and error categories, not uploaded photos, messages, passwords or raw network addresses. Hosting and sign-in providers may retain their own operational logs under their policies.

Your controls

Remove a photo from My photo, or use Delete my site data in your account to remove all your photos, activity and any legacy site requests. For privacy requests, email [email protected]. If a payment is still being processed or needs review, site-data deletion is paused until it is resolved; contact us for help with your request. Deleting site data does not automatically delete email correspondence. This does not delete your Google account or your email account.

Cookies and payment data

Authentication uses necessary, secure sign-in cookies. Login sessions expire after seven days; temporary sign-in requests expire after ten minutes. Expired records are removed during cleanup. Signing out removes the current server session. Deleting your site data removes all your server sessions and signs you out on every device. Google passwords are never stored by this site. This application does not add advertising pixels, analytics trackers, or optional marketing cookies. Waffo processes checkout and payments. We retain order and payment references, amounts, statuses and account associations to verify purchases, prevent duplicate processing and handle refunds. Deleting a displayed photo does not delete these payment records or the payment provider’s records. We do not collect or store payment card numbers.

Refund requests

We store the reason you submit, the merchant decision, and payment references to review and track refunds. Refund updates are shown in My account; we do not send refund notification emails. Resolved request text is cleared after 90 days, or when eligible site-data deletion is completed. Financial records and approval evidence are retained for payment reconciliation and legal obligations. Do not include passwords or full card details in your request.