28 Shots ("we", "us") makes the 28 Shots app and this website. This policy explains what data we collect, why, and what your choices are. We're a small team based in the UK, and this policy is written to actually reflect what the app does — not boilerplate.
28 Shots doesn't have a sign-up flow. Guests join an event by typing a display name — nothing else is collected from them, and a guest is never asked for an email address or phone number. Hosts and guests are both identified internally by an anonymous device ID generated on first use, via Firebase Anonymous Authentication. A host is asked for one email address when they create an event; what it's used for is set out below.
We do not sell your data to anyone, and we don't use your photos for advertising, marketing, or model training.
Photos are kept for 60 days after the event, and then deleted. The host is shown the exact date whenever they open their album, and we email them a warning a week before and again the day before — photos are never removed without those warnings having been sent. A host can also delete an event at any time, at which point everything tied to it — photos, guest records, bounties, print orders — is permanently deleted from our systems straight away. There's no separate "trash" or recovery period once photos are deleted.
If a host shares their album by link, anyone holding that link can view the photos until the host turns sharing off or the photos are deleted.
A host can also give guests their photos back after the event. Depending on what the host chooses, each guest can see either the photos they took themselves or every photo from the event, on the phone they took them with. Guests can save copies, and copies they've saved stay with them even if the host later stops sharing.
Because 28 Shots is used at real events, photos will often include people who aren't the guest who took them — including, at family events, children. Hosts are responsible for how they use and share the finished gallery once it's downloaded from the app. If you appear in a photo taken at an event and want it removed, contact the event's host directly, or reach us using the details below and we'll help where we can.
If you're in the UK or EU, you have rights under UK/EU GDPR to access, correct, or request deletion of personal data we hold about you. Since most of what we hold is tied to an anonymous device ID rather than an identity we can look up by name or email, the fastest way to exercise these rights is usually through the host of the specific event, or by contacting us with enough detail (event name, approximate date, device) for us to locate the right records.
Questions about this policy or a request regarding your data: hello@28shots.app.
If this policy changes in a material way, we'll update the date at the top of this page.