Privacy policy
Last updated: 28 September 2026
HiveAlbum is a private photo and video sharing service for events. This policy explains what personal information we collect, why, how long we keep it and the rights you have. It applies to hosts (people who create an event) and guests (people who share photos to an event).
Who we are
HiveAlbum (hivealbum.com) is operated by Matthew Cooke, a sole trader based in the United Kingdom, who is the data controller for account, payment and service data. Contact: hello@hivealbum.com.
For the photos, videos and comments shared into an event, the host decides who is invited and what is kept, and we store and display that content on the host’s behalf.
What we collect
| Information | Why | Lawful basis |
|---|---|---|
| Host account: name, email address, password (stored only as a secure one-way hash) | To run your account and events and send service emails (verification, password resets, album reminders) | Contract |
| Guest name and a random cookie that remembers you on that event | So hosts and guests can see who shared what, and so you can manage your own uploads | Legitimate interests |
| Photos, videos, album names, comments and reactions | The service itself: storing, converting and showing them to the people the host allows | Contract (hosts) / legitimate interests (guests) |
| Chat and contact messages: your name, email address and what you write to us, and a random cookie that keeps your chat open on that device | To answer your questions, including by email if you’ve left the page | Legitimate interests |
| Photo print orders: the photos you choose, and the delivery name, address and phone number you give at checkout | To print and post your order | Contract |
| Payment records: plan, amount, date and Stripe reference | To provide what you paid for and keep accounting records | Contract / legal obligation |
| Technical data: IP address and browser type, held briefly | Security, preventing abuse (for example, rate-limiting sign-ins) and fixing problems | Legitimate interests |
Location data: photos and videos often contain GPS location and camera details. We remove this information from every copy shown to guests. The untouched original, including its metadata, is kept for the host to download.
We never sell your data, use your photos for advertising, or use them to train AI models.
Who we share it with
We use a small number of trusted providers, only as needed to run HiveAlbum:
- Stripe: processes card payments. Your card details go directly to Stripe and never reach our servers.
- Resend: sends our service emails (your email address and the email content).
- Prodigi: prints and posts photo prints you order. They receive the delivery name, address, email and phone number you give at checkout, and the photos you chose to print — nothing else, and only for that order.
- Hetzner: stores our encrypted off-site backups in the EU (Germany or Finland). The backups are encrypted before they leave our servers, so Hetzner can’t read them.
Photos, videos and account data are stored on our own servers in the United Kingdom, with encrypted backups as above. We may disclose information if required by law.
Cookies
We only use cookies that are strictly necessary to make HiveAlbum work:
- Signed in — keeps hosts signed in to their account.
- Guest — remembers a guest on an event, so they can manage their own uploads.
- RSVP — remembers a reply sent from that phone, so the guest can change it later (and, if the hosts chose, see the full address once they’ve replied).
- Event website — remembers that a visitor has entered a password-protected event website’s password.
- Chat — keeps your conversation with us on the homepage, so you can carry on where you left off on that device.
We also save small preferences in your browser (such as your gallery view, and whether you’ve been asked about notifications). We don’t use advertising or analytics cookies, and nothing on HiveAlbum tracks you across other websites, so we don’t ask for cookie consent.
How long we keep it
- Event photos, videos and comments: for the period included in the event’s plan (14 days on the free trial, 6 months on Starter, 12 months on Essentials, 3 years on Premium). The album then closes, and everything is permanently deleted 30 days later. We email the host before both happen.
- Deleting a comment, a guest’s own upload or a whole event removes it straight away. When a host on a paid plan deletes a photo, video or voice message, it first waits in the host’s Recently deleted (14 days on Starter, 30 days on Essentials, 90 days on Premium) so it can be restored if it was a mistake. Guests can’t see it there, the host can delete it for good at any time, and it’s permanently deleted when that time runs out.
- Backups: we keep encrypted backups so we can recover from an accident, for up to 12 months. They’re only ever used to restore the service; anything that has been deleted drops out of them as older backups expire.
- Accounts: until you delete yours. You can do this yourself at any time under Account → Delete my account (on the website or in the app) — it also deletes every event you own. How to delete your account.
- Payment records: for 6 years, as UK tax law requires.
Photos of other people and children
Events often include photos of people who didn’t upload them, including children. Hosts are responsible for only inviting people they trust and for removing anything someone asks them to. Anyone can ask the host, or us at hello@hivealbum.com, to remove a photo of themselves or their child. HiveAlbum accounts are for people aged 18 or over.
Your rights
Under UK data protection law you can ask to access, correct, delete or receive a copy of your personal information, and to restrict or object to how we use it. Guests can delete their own uploads at any time from the event page. For anything else, email hello@hivealbum.com and we’ll respond within one month.
If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office (ICO).
Security
All connections use HTTPS. Passwords are hashed with scrypt, media can only be opened by people with access to the event, and access to our servers is restricted. No system is perfectly secure, so please keep your own copies of photos that matter to you. Every paid plan includes a one-click download of the whole album.
Changes
If we make important changes to this policy, we’ll email hosts and update the date at the top.