privacy policy.

Last updated 20 September 2026

1. Who we are

oop! (“we”, “us”) runs oop.camera, a disposable event camera: a host creates an event, guests scan a QR code and take a limited number of photos in their phone’s browser, and the photos are revealed later.

We’re the “controller” of the personal data described here, meaning we decide how it’s used to run the service. This policy follows UK data protection law (the UK GDPR and the Data Protection Act 2018). It explains what we collect, why, who sees it, and your choices. To get in touch, email hello@oop.camera.

2. What we collect

If you’re a guest

• The name you type in when you join. It appears beside your photos in the album.
• The photos you take with the oop! camera, and basic details about each one: which event it belongs to, roughly when it was taken (from your phone’s clock), and which camera was used (front or back).
• A small token saved in your phone’s browser so it remembers you’re part of the event, and your shots that are waiting to upload if you have poor signal.

If you’re a host

• Your email address, if you sign in with an email code. We store a scrambled (hashed) version of each one-time code, and only for 10 minutes.
• If you sign in with TikTok: your TikTok ID, display name and profile picture link. We don’t get your password, and we don’t post anything to TikTok.
• Your events: title, times, number of shots per person, settings, and your plan.
• Payment records: what you bought, the amount and the date. Card details are handled by our payment provider, never by us.

If you turn on reveal notifications

• A notification subscription: if you tap “notify me when they drop”, your browser gives us an address for your device from its push service (Apple, Google or Mozilla) plus encryption keys, and we link it to the event. We use it for one thing: telling you when that event’s photos are ready. The notification never contains photos or any sign-in secret.
• You can turn it off for an event at any time, or delete it by turning off notifications in your device settings. If a device stops responding we remove it automatically.

If your host sends party pings

• Your answers. A host can send short messages and one-tap questions during the event. If you answer, we store which choice you picked. Your host can see who answered what (and who hasn’t), and every question tells you so before you answer. Other guests only see totals, never who picked what.
• Pings are deleted with the event, and you can switch party pings off separately from the “photos developed” notification.

Everyone

• Technical data: your IP address, browser and device type, and the pages or actions requested. We use this to keep the service running, stop abuse (for example, rate-limiting) and investigate problems.

What we don’t collect

• Your camera roll, contacts or precise location. oop! can only take new photos; it can’t upload old ones.
• The live camera view. It stays on your phone. Only the photos you actually take are uploaded.
• Location data from your photos. We strip it (and all other photo metadata) when we process each photo.

3. Why we use it, and our legal basis

• To provide the service (run events, let guests take photos, store them, reveal them, take payments). Legal basis: it’s necessary to perform our contract with the host, and for guests, our legitimate interest in providing the service the host set up.
• To keep things safe and working (security, preventing abuse, fixing bugs, rate limits). Legal basis: legitimate interests.
• To handle reports of unlawful or harmful content, and to follow the law. Legal basis: legal obligation and legitimate interests.
• To keep financial records. Legal basis: legal obligation.
• To contact you about your account or event, for example a sign-in code or a payment receipt. We don’t send marketing emails without asking you first.

We don’t make automated decisions about you that have legal or similarly significant effects, and we don’t use photos to train AI models.

4. Who can see your photos

• Before the reveal: nobody. Not the other guests, and not the host.
• After the reveal: the host and the guests who joined that event, and only them. The album isn’t public and isn’t indexed by search engines. Photo links are signed and expire.
• The host can hide or delete any photo, and can download them. Guests can download photos from the album, so please remember that once someone has downloaded a photo, we can’t control what they do with it.
• Us: we don’t browse your photos. We may access them only where needed to keep the service secure, to fix a problem you’ve asked us to look at, to deal with a report of unlawful or harmful content, or where the law requires.

5. Who we share data with

We use a small number of service providers (“processors”) who handle data only on our instructions:

• Cloudflare: hosting, our database, photo storage and processing, and delivery of sign-in emails and notifications. Your photos and account data are stored in Cloudflare’s EU regions.
• Stripe (or our payment provider at the time): takes and processes payments for paid events.
• TikTok: only if you choose “Continue with TikTok”. TikTok’s own privacy policy applies to what it does.

We don’t sell your personal data or share it for advertising. We may disclose data if the law requires it (for example, a valid request from the police or a court), or to protect people’s safety or our legal rights.

6. Where your data goes

Photos and account data are stored in the EU. Our providers may process some data (for example, security logs, or payment processing) in other countries, including the United States. Where that happens, it’s covered by appropriate safeguards such as adequacy decisions or the standard contractual clauses and UK addendum.

7. How long we keep it

• Photos and guest names: 12 months after the reveal, then automatically deleted. If the host bought “keep it for good”, we keep them for as long as we run the service (and give notice before ever closing it, so people can download them).
• If a host deletes an event: its photos, guests and links are removed straight away. Copies in system backups can take up to 30 days to expire.
• Host account details: for as long as you have an account. Ask us to delete it any time.
• Sign-in codes: 10 minutes.
• Notification subscriptions: until you turn them off, the device stops responding, or the event is deleted.
• Payment records: 6 years, because UK tax law requires it.
• Technical logs: a short time, usually weeks, unless we need to keep them to investigate abuse.

8. Cookies and similar technologies

We only use what’s strictly necessary, so there’s no cookie banner.

• Hosts: a secure sign-in cookie that keeps you logged in, and a short-lived cookie while you sign in with TikTok.
• Guests: no cookies. We save a token and your not-yet-uploaded shots in your browser’s storage, and keep a copy of the app on your phone so the camera can open with a weak signal. You can clear this in your browser settings, but any shots that haven’t uploaded yet would be lost.
• We don’t use advertising, tracking or analytics cookies.

9. Your rights

Under UK data protection law you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that’s wrong;
• delete your data (in some cases we’ll need to keep certain records, such as payments);
• restrict or stop how we use it, or object to a use based on our legitimate interests;
• give you your data in a portable format; and
• withdraw any consent you’ve given.

Email hello@oop.camera. We’ll normally reply within a month. If you’re a guest and want a photo of you removed, tell us the event and roughly when it was taken (or ask the host, who can hide or delete it themselves). If you’re unhappy with how we’ve handled something, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, though we’d appreciate the chance to put it right first.

10. Hosts and guests’ data

Hosts choose who to invite and what to do with the photos from their event. If you’re a host, you’re responsible for letting your guests know that they’ll be taking and sharing photos through oop!, and for using the album lawfully. See our terms for what that means in practice. If a host is running an event as a business, they may be a controller of their guests’ data in their own right.

11. Children

oop! isn’t aimed at children. Hosts must be 18 or over. If you’re under 18 and a guest, please make sure a parent or guardian is happy for you to take part. If children will be at your event, you’re responsible as host for checking with their parents or guardians. If you think we hold a child’s data without proper permission, contact us and we’ll remove it.

12. Security

We protect your data with encryption in transit, short-lived signed links for photos, restricted access to our systems, and by stripping photo metadata. No online service is perfectly secure, but if a breach affecting you ever happens, we’ll tell you and the regulator as the law requires.

13. Changes to this policy

If we make an important change, we’ll tell hosts by email or in the app before it takes effect. The date at the top shows when this policy was last updated.

14. Contact

Questions or requests about your data: hello@oop.camera.