Privacy, plainly

The host (the adult who created the event) decides which photos are approved, whether a gallery or slideshow is shown, and when files are deleted. Removal requests go to that host. Mehfil does not publish a company contact address yet; requests are handled by the host through the tools below.

Hosts: email address and password (for sign-in), event name, display name, event date, ceremony names, settings, and a record that the host confirmed being 18 or older.

Guests: the photos they choose to share, an optional name, the ceremony they pick, the time of upload and which version of the upload notice they accepted. Guests do not create accounts. We do not ask for phone numbers, contacts or location.

Aggregate counts: per event per day we count link opens, upload sessions, successful and failed uploads. These counters contain no personal details.

We do not store IP addresses in our database. Our hosting providers may keep short-lived technical logs.

Before upload, the guest's browser re-encodes each photo as a JPEG, applying its rotation. This removes camera details and GPS location. The server then checks the file really is a JPG/PNG/WebP image (not a document or program renamed as an image), rejects anything over 15 MB, and strips any metadata blocks that remain. Because of re-encoding, exported files are high-quality copies, not the exact original files.

We do not use face recognition, do not train AI on photos and do not sell data.

• Upload link (QR): lets someone add photos. It cannot list or open any photos, approve anything, export, or change settings.
• The guest's own device: can view and delete the photos it uploaded, through a private key saved in that browser. Clearing browser data loses that access; there is no account recovery.
• Host: sees every photo for their own events only.
• Gallery and slideshow links: show only host-approved photos, and only while the host has switched them on and before the event expires. They are separate from the upload link.

Photos are stored in private storage and are never at public web addresses. Each time a page shows a photo the server checks permission and issues a link that expires within 15 minutes. Replacing or turning off a link blocks new access immediately, but links already issued keep working until they expire. Anyone allowed to view a photo can still save it or take a screenshot — please share links thoughtfully.

Photos are not end-to-end encrypted. Project maintainers with infrastructure access could technically reach stored files; access is restricted to operating the service, and image contents and links are not written to application logs.

• Uploads close 30 days after the event by default (host can choose earlier).
• Photos and all event data expire 90 days after the event by default (host can choose earlier).
• From the expiry moment, all guest, gallery, slideshow and device access is refused by the server.
• A scheduled cleanup runs once a day and permanently deletes expired events' files and records, so removal completes within about a day of expiry. If a deletion fails it is retried on the next run.
• Our infrastructure provider may retain encrypted database backups for a limited period after deletion; we cannot erase those instantly.

Guests can delete their own uploads any time from My uploads on the same device. Hosts can delete any photo, or the whole event, which removes stored files and records.

Anyone pictured — including people who didn't upload the photo, and parents or guardians of children — can ask the host to remove a photo from the gallery page or via the removal request form. Requests are visible only to the event's host. We do not send automatic replies, and we can't guarantee how quickly a host acts.

Guests see a short notice before uploading and confirm they want to share. That confirmation is not consent from everyone who appears in a photo. Hosts are asked to approve only photos they have reason to believe people are comfortable sharing, and to take special care with children.

We use no advertising or analytics trackers. The browser stores your sign-in session (hosts), your language choice and, for guests, the device key for your own uploads. Fonts are served from our own site. Pages send no referrer to other sites, so private links are not leaked when you follow an outbound link.