Privacy Policy

This policy explains what information we collect when you use Dayfolds, why we collect it, and what choices you have. We have tried to write it in plain language rather than dense legal text. If anything is unclear, email us at hello@dayfolds.com and we will explain it properly.

1. Who this policy applies to

Dayfolds has two kinds of users. Hosts create an account, set up an event, and pay to unlock it. Guests scan a QR code and share photos, videos, voice messages, or written notes with a host's event, without ever creating an account. Both groups are covered by this policy, but the data we hold about each is different, which is why we have split things out below.

We are responsible (the "controller") for host account data and for running the service. The host decides to collect memories from their guests for their event, and we store and show those memories on the host's behalf.

2. What we collect from hosts

When you sign up as a host we collect your email address and, if you choose to sign in with a provider like Google, whatever basic profile information that provider shares with us (typically your name and email). When you create an event, we store the event name, date, location, header photo, and the settings you choose, like whether uploads need your approval. When you pay to unlock an event, payment is handled entirely by Stripe, our payment processor. We never see or store your card details ourselves, we only receive confirmation that a payment succeeded and a reference we use to keep your account and Stripe's records linked.

3. What we collect from guests

Guests do not create an account and we do not ask for an email address or phone number. If a guest chooses to add a name or caption, we store exactly what they typed, nothing more. We also store the file itself (photo, video, or audio) and basic technical details needed to serve it, such as file type, size, and upload time. To count roughly how many guests took part, each phone gets a random, anonymous code stored in its browser; it is not linked to a name or any other information.

We keep photos and videos exactly as they were uploaded, including any metadata stored in the file.

4. Why we process this data

We use host account data to let you sign in, manage your events, and process payment, because we need it to provide the service you signed up for. We use guest uploads for the single purpose the product exists for: showing them in the host's event gallery and, if the host uses it, the live slideshow, and letting the host download them. We do this because the host and their guests have a legitimate interest in collecting and keeping memories of their event. We also use limited technical data to keep uploads working reliably and to keep out bots and abuse, which is in everyone's legitimate interest. Payment records are kept because tax law requires it.

Event galleries are not public. They are only reachable through the event's own link or QR code, are not listed anywhere, and are hidden from search engines. Keep in mind that anyone who has the link can open the event and, if the host allows it, view the gallery.

5. Who else sees this data

We rely on a small number of external providers to run Dayfolds, and data passes through them as part of normal operation. Each processes data on our behalf under their own security and privacy commitments, and we do not sell or rent your data to anyone for advertising or any other purpose.

Google Firebase handles sign-in, app data, hosting, and our servers. It also uses Google reCAPTCHA to check that requests come from real people rather than bots, which involves Google looking at basic technical information about your device and browser. Stripe processes payments. Cloudflare stores and delivers the photos, videos, and audio files guests share. Our website loads fonts from Google Fonts and a few small scripts from unpkg and cdnjs (Cloudflare), which means those services see your IP address when you visit. To show prices in your own currency, our server looks up which country you are visiting from based on your IP address; we do not store it.

6. How long we keep event media

For unlocked events, photos, videos, voice messages, and written wishes are kept until 3 months after the event date. That date is fixed as soon as the first guest shares something, and the exact deletion date is shown in your dashboard, with a reminder in the last 30 days. After that we permanently delete the media files and their records. We recommend downloading everything before then, since we are not able to recover media once it has been deleted.

When you delete an event, its media and records are deleted right away. Events on the free trial are kept until you delete them or your account. Host account information (like your email and past event names) is kept for as long as your account exists, so you can see your event history, unless you ask us to delete it sooner. Payment records are kept for as long as Dutch tax law requires (currently 7 years).

7. Cookies and similar technology

We only use what is needed to make Dayfolds work and keep it safe. Your browser stores your sign-in so you stay logged in as a host, a few preferences such as dark mode, and, for guests, the anonymous guest code described in section 3. Google reCAPTCHA may set its own cookies to tell people and bots apart. We do not use advertising cookies, cross-site trackers, or analytics. If we ever add analytics, we will update this policy first.

8. International data transfers

Our infrastructure providers operate data centers in multiple regions. Where your data is transferred outside the European Economic Area, we rely on the safeguards those providers offer, such as standard contractual clauses, to keep it protected to a comparable standard.

9. Your rights

You can ask us for a copy of the personal data we hold about you, and ask us to correct it, delete it, limit how we use it, or send it to you in a portable format. You can also object to how we use it. Email hello@dayfolds.com and we will reply within one month. Guests who want something they shared removed can ask the host, who can delete it from their dashboard at any time, or email us with the event link and a description of what to remove.

If you are unhappy with how we handle your data, you have the right to complain to a data protection authority. In the Netherlands, that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would appreciate the chance to sort it out with you first.

10. Changes to this policy

We may update this policy from time to time as the product changes. If we make a change we consider significant, we will update the date at the top of this page and, where reasonably possible, let existing hosts know.

11. Contact

Dayfolds is a product of VISK, KVK 86233890. For any question about this policy or your data, email hello@dayfolds.com.