Privacy Policy

In short

• Festlig is a shared camera for events. We collect what it needs to work: your name, your sign-in, the events you're in, and the photos and videos you take for them.
• Your photos are shared only with the event they belong to, and with people the host shares the album with.
• We don't sell your data, show ads in the app or use analytics SDKs, and we don't use your photos to train AI. To learn which of our own ads work, the app tells our ad-measurement service, Bridge, about your install, and purchases are reported to Meta (see Ad measurement below). When the app crashes, it sends us a crash report so we can fix the problem.
• Albums are deleted 12 months after a Free event ends and 24 months after a paid one. You can delete your photos and your account at any time.

Who we are

Festlig is run by Aalto Studio FZE, One Central, Dubai, United Arab Emirates (“Festlig”, “we”, “us”), which is responsible for your personal data (the data controller). Contact us at hello@festlig.app.

What we collect and why

• Your name, as you enter it. It's shown to the people in your events, on your photos and in the people list.
• Your sign-in. Guests join with just a name, on a guest account tied to their phone. Hosts sign in with Apple, Google or email; we then keep the email address the provider gives us (with Sign in with Apple this can be a private relay address). With Apple or Google we also get your name, and with Google your profile photo, which the app shows on your account.
• Events you create or join: name, date, cover (one of ours, or a photo you choose), camera look, invitation poster and settings, and who is in them.
• Photos and videos you take in the app or add from your library, with when they were taken, your name, and any note or stickers you add. Before upload, the app removes location and other hidden metadata. We keep the photo with the event's camera look and the untouched original, so you can save either.
• Location, only if you add a location sticker: your phone looks up the place name (with Apple Maps on iPhone, with Google's location service on Android), and only the text on the sticker is saved. We never track where you are.
• Camera and microphone, only while the camera is open; the microphone only while you film a video.
• Purchases: the App Store or Google Play transaction for a plan or extra shots (product, date, event), so we can unlock it, and Apple's notice if it's refunded. Apple or Google handles payment; we never see your payment details.
• Reports and blocks: when you report a photo, we keep the photo's details, the reason and your account. When you block someone, their account is saved to yours so the app can hide their photos.
• Web album visitors need no account. If the album has a password, a cookie remembers you entered it, for 30 days. Another cookie remembers your language if you pick one. We use no tracking cookies.
• Technical logs of what the service did (for example which account uploaded a photo, and errors), including IP addresses in our hosting provider's request logs, which our providers also use to stop abuse of sign-in. We keep them 30 days, to keep Festlig secure and fix problems. The Firebase libraries in the app also send Google basic technical details about how they're working, such as their version, which aren't linked to you.
• Crash reports. If the app crashes, it sends a report to Firebase Crashlytics: where in the app's code it crashed and the app's state at that moment (for example free memory and storage), the app version, your phone's model and system version, and a random ID that Crashlytics creates for this installation, so we can tell how many people a crash affects. Reports don't include your name, email, account, photos or videos. Deleting the app deletes the ID.
• Ad measurement. We advertise Festlig on Facebook and Instagram, and our ad-measurement service, Bridge, tells us which ads bring people who go on to buy. When you first open the app, it sends Bridge your phone's model, system version, screen size, time zone, language and region, on iPhone an ID that Apple gives Festlig for your phone (not the advertising ID), and your account's ID; Bridge also sees your IP address. If you came from one of our ads, Bridge uses these to find the ad you tapped (on Android, the Play Store passes it on). On iPhone, the app also gives Bridge a code from Apple, which Bridge uses to ask Apple whether one of our Apple Ads, and which search keyword, led to the install; it isn't the advertising ID and needs no tracking permission. When you buy a plan or extra shots, Bridge reports the purchase to Meta (product, price, the ad it came from if any, a hashed form of your account's ID, and your IP address and device details), so Meta can tell which ads lead to purchases. On iPhone, when you sign in with an email address, the app sends it to Bridge too: Bridge turns it into an unreadable code (a hash) on arrival and never stores the address itself; the code helps match an install to an ad and may be shared with Meta in that form. Festlig doesn't use Apple's or Google's advertising ID.

Legal bases (EEA, UK and Switzerland)

• Contract: to provide Festlig to you — your account, events, photos, sharing and purchases.
• Legitimate interests: keeping Festlig safe (handling reports, preventing abuse and fraud), securing it, and fixing problems, including crashes; and measuring which of our ads bring people to Festlig.
• Consent: camera, microphone, photo library and location access, which you give on your phone (iOS or Android) and can withdraw in its settings at any time.
• Legal obligations: for example keeping records of purchases where the law requires it.

Who can see your photos and videos

• The event's host sees everything taken for the event.
• Other guests see everyone's photos once they reveal, if the host lets everyone see all photos. You always see your own.
• Anyone with the web album link, if the host turns it on (and knows the password, if the host sets one). Visitors can download the photos.
• Invitations: anyone with an event's invitation link or QR code can see its name, the host's name, the cover, the date and how many people and photos it has.
• Festlig staff see a photo when someone reports it, to decide what to do. Access is limited to the few people who review reports, and what they do is logged.

Reports and moderation

You can report any photo or video in an event, and block the person who took it. We review reports, usually within 24 hours, and may keep the photo, remove it, remove the person from the event, or suspend their account. The person reported isn't told who reported them. The host also sees that a photo was reported and can remove it.

Service providers and transfers

Festlig runs on Google Cloud and Firebase (sign-in, database, file storage, server functions and crash reports) in the United States. Purchases go through RevenueCat (United States), which receives the store's transaction and your account's ID so the purchase reaches your event. Ad measurement runs on Bridge, our service for it, and the purchases it reports go to Meta (Meta Platforms Ireland Limited for people in the EEA, otherwise Meta Platforms, Inc., United States), which uses them to measure our ads under its Business Tools Terms. Sign in with Apple and App Store payments are provided by Apple, and Google sign-in and Google Play payments by Google. They process data for us under their data processing terms and only to provide their services. Data sent to the United States is protected by the EU–US Data Privacy Framework (Google is certified) and the European Commission's Standard Contractual Clauses.

How long we keep your data

• Events, photos and videos: until the host deletes the event, or automatically 12 months after a Free event ends and 24 months after a paid one. The app shows the date on ended events. A photo you delete is removed right away.
• Your account and name: until you delete your account.
• Purchase records: as long as accounting and tax laws require.
• Reports: as long as needed to keep Festlig safe and to handle disputes about them.
• Logs: 30 days.
• Crash reports: 90 days.
• Ad measurement: Bridge deletes ad clicks after 90 days and IP addresses after 30 days.
• Backups: deleted data disappears from our backups within 8 weeks.

Security

Data is encrypted in transit and at rest. Access rules make sure only the people an event allows can read its photos. Web album passwords are stored only as secure hashes. Staff access is limited and logged.

Your rights

• Delete any photo or video you took, at any time, from its menu.
• Save your photos in full quality at any time with Save on the event.
• Delete your account in Settings › Delete account. This deletes your account, your name and the events you host (for everyone, with their photos). Photos you took at other people's events stay in those albums, so delete them first if you want them gone. Step by step, and what to do if you can't open the app: Delete your account.
• Ask us for a copy of your data, or to correct, delete or restrict it, or object to how we use it, at hello@festlig.app. We reply within one month.
• If you're in the EEA, the UK or Switzerland, you can also complain to your data protection authority. If you're in California, you have similar rights under the CCPA; we don't sell personal information.

Children

Festlig isn't meant for children under 13, or under 16 where the law requires consent from a parent. We don't knowingly collect their data. If you think a child has given us data, write to us and we'll delete it.

Changes

If we change this policy, we'll update this page and the date above. For significant changes we'll also tell you in the app.

Contact

Questions about your privacy: hello@festlig.app.