Privacy Policy

When you host an event on Film My Events, we collect your account email, the names you give the event (host and, where relevant, partner names), and the event date. When a guest joins, they sign in with their email (we send a one-time code), so they can get back to their own photos on any device. We also collect the display name they choose (used to caption their photos in your gallery) and the photos themselves.

If you add a cover image to brand your event, that image is stored publicly (it's shown to guests before they hold any credential); guest photos are never public and stay behind short-lived, signed links.

Everything above is stored in our database and file storage, both hosted on Supabase. Access to guest photos and account data is enforced server-side: there are no public database policies, and photos are served through short-lived signed URLs rather than permanent public links.

Events expire and are deleted automatically when their plan's gallery period ends: 30 days after the event on the free plan, up to a year on paid plans (events created before plans existed: 60 days after creation). The event record, its guests, and every photo are removed together, including the underlying files in storage. Small diagnostic logs (camera permission errors, upload failures, never photo contents, names or emails) are kept for 30 days and then removed on the same schedule.

You don't have to wait for that window: a host can delete their event at any time from their dashboard, and a signed-in user can delete their account from their Profile page, either of which removes the associated data immediately rather than at expiry.

Upgrades are paid through Stripe. Your card or bank details go to Stripe directly and never reach us; we keep a record of each payment (the plan, the amount, any promo code, and Stripe's reference) for our accounts, even after the event itself is deleted.

Film My Events is built primarily for hosts and guests in Malaysia, and this policy is written with the Personal Data Protection Act 2010 (PDPA) in mind. You can ask to access, correct, or delete the personal data we hold about you. In practice that means: a host can edit or delete their event and its data at any time, and anyone can ask us to delete an account or a guest's photos by contacting us below.

Questions about this policy, or a request to access, correct or delete your data, can be sent to notification@staygrnd.xyz.