Privacy Policy
What we collect when you host or join an event, who stores it, and the limits of what we take responsibility for.
Last updated
This policy explains how iAppsolution Technology ("we", "us"), of Ahmedabad, Gujarat, India, handles data in PicUnionApp at https://picunionapp.com. It should be read together with our Terms & Conditions, which limit our liability — including for data loss and unauthorised access.
1. The short version
- We sign you in with Google and receive only your name, email address and profile photo — never your Google password.
- We store the photos and videos uploaded to your events, and who uploaded each one.
- Photos and videos are stored and delivered by Cloudflare, not on infrastructure we own.
- We take payment through Stripe and never see your full card number.
- We do not sell your data, and we do not use your event photos to advertise the Service.
- You can delete a photo, an event or your whole account, and we delete the underlying records and files.
- We take no responsibility for the security of any data you put into the Service. See section 8 — use it on that basis or do not use it.
2. What we collect
If you host an event
| Data | Why | Source |
|---|---|---|
| Name, email address, profile photo URL | To identify your account and show who owns an event | Your Google account |
| Google / Firebase account identifier | To match you to the same account on each sign-in | |
| Event name, event date, event passcode | To run the event and control access | You |
| Plan, billing status, payment records (amount, currency, status, processor reference) | To give you the features you paid for and keep an account of it | You and Stripe |
If you join an event as a guest
| Data | Why | Source |
|---|---|---|
| Name, email address, profile photo URL | So your uploads are attributed to you and come back to you | Your Google account |
| Google / Firebase account identifier | So the same account is the same guest each time you return | |
| The event you joined and when | To give you access to that gallery only | You |
Content you upload
- The photo or video file itself, its size, and the time it was uploaded.
- Who uploaded it, whether they were a host or a guest, and any folder it was filed into.
- Its visibility setting — visible to everyone in the event, or only to you and the host.
- Photographs can themselves contain personal data, including images of people who never used the Service. Section 5 covers this.
Technical data
- A session cookie that keeps you signed in. It is HttpOnly, SameSite=Lax and, in production, Secure — it cannot be read by scripts in your browser.
- Values stored in your browser's local storage for convenience: your display name and profile photo, and the event passcode you last entered. These stay on your device.
- Standard server logs recorded by our hosting provider, including IP address, browser user agent and the pages requested.
- If website analytics are enabled, Google Analytics 4 sets its own cookies to measure aggregate site usage. This runs on the marketing pages; it is not used to track what is inside a private gallery.
3. How we use it
- To create and run your account and your event galleries.
- To show each photo to the people entitled to see it and to build full-resolution downloads.
- To take payment, apply your plan's storage quota, and keep billing records.
- To keep the Service running and to investigate abuse or misuse.
- To reply to you when you contact us.
- To meet legal, tax and accounting obligations.
We do not sell personal data, we do not share it with advertisers, and we do not use your event photos to promote the Service.
4. Where your data is stored, and by whom
We rely entirely on third-party infrastructure. Your data sits on systems owned and operated by the companies below, not by us.
| Provider | What it holds or handles |
|---|---|
| Cloudflare | All uploaded photos and videos — stored and delivered from its network |
| Google / Firebase Authentication | Verifying your Google sign-in and returning your name, email and photo |
| Stripe | Card payments and subscription billing |
| Razorpay | Older one-time payments only; no longer used for new purchases |
| Our hosting provider | The application server and the database |
| Google Analytics 4 | Aggregate website analytics, if enabled |
These providers operate globally, so your data may be stored and processed outside India. Their security, availability and data handling are governed by their own terms and are their responsibility. We do not control them and we accept no responsibility or liability for them — including for any outage, loss or security incident on their systems. See section 11 of the Terms & Conditions.
We may also disclose data where the law requires it, to enforce our Terms, or to a buyer if the Service is ever sold or transferred.
5. Photographs of people who never signed up
An event gallery will contain images of people who never used the Service and never read this policy. We do not run facial recognition, we do not use these images to build profiles, and we do not use them for advertising or to train any model.
The host of an event decides who can join it and can delete any photo in it. If you appear in a photo in someone's gallery and want it removed, ask the host first — they can do it immediately. If that is not possible, write to us at info@iappsolution.com with enough detail to locate the image and we will act on it. Responsibility for uploading a photograph of someone rests with the person who uploaded it, not with us.
6. Who can see your photos
- Galleries are not public and are excluded from search engines. They are reachable only through the event link or QR code, and where the host has set one, the event passcode.
- Photos marked visible to everyone can be seen and downloaded by anyone signed in to that event.
- Photos you mark private are visible only to you and the event host.
- Anyone who has the link or QR code can join the event. A link is easy to forward, screenshot or photograph. Treat it as the key to the gallery — once it is out, we cannot control who uses it, and we are not responsible for who does.
- Our staff do not browse galleries. We access stored content only where it is necessary to fix a fault you have reported, or where the law requires it.
7. How long we keep it
- Photos and videos are kept until you or the event host delete them, or the event or account is deleted.
- Event and guest records are deleted when the event is deleted.
- Your account and everything under it are deleted when you delete your account or ask us to.
- Backups. Deleted content can persist in routine backups for a maximum of 3 days before those backups roll over.
- Billing records are kept for as long as tax and accounting law requires, even after an account is deleted. These are transaction records, not your photos.
8. Security — and the limits of our responsibility
We take ordinary measures to keep the Service running securely:
- All traffic is served over HTTPS.
- Sign-in is delegated to Google; we never handle your Google password.
- Sessions use signed, HttpOnly cookies that browser scripts cannot read.
- Access to production systems is limited to people who need it.
No online service can be made completely secure, and we do not promise that yours will be. Your content is held on third-party infrastructure (section 4) that we neither own nor control.
To the maximum extent permitted by applicable law, we accept no responsibility or liability for the loss of, damage to, or unauthorised access to any data or content you put into the Service — including any data breach, leak, interception or security incident, whether it occurs on our systems or on those of any provider we use. You upload at your own risk, and you are solely responsible for keeping your own copies of anything that matters to you.
If you are not willing to accept that, please do not upload anything to the Service.
9. Your choices
You can:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct anything inaccurate.
- Delete individual photos, an event, or your whole account at any time from within the app.
- Ask us to delete your account and its content — note that we cannot run the Service without the data in section 2, so this means closing your account.
Write to info@iappsolution.com and we will deal with your request within a reasonable time. We may need to confirm your identity first.
10. Children
The Service is not directed at children, and you must be 18 or over to hold an account. Children do appear in event photographs; where a child's image is uploaded, the person uploading it is responsible for having the consent of a parent or guardian. If you believe a child's data has been given to us in a way that requires our action, contact us and we will remove it.
11. Changes to this policy
We may update this page at any time and will change the date at the top when we do. Continuing to use the Service means you accept the updated policy.
12. Contact
PicUnionApp is operated by iAppsolution Technology, Ahmedabad, Gujarat, India. For anything to do with data or this policy, write to info@iappsolution.com.