Privacy Policy — Reveal
Last updated: August 7, 2026
Reveal is the shared camera for your events. This policy explains what data we collect, why, how long we keep it and what your rights are. It supplements our Terms of Use and Sale (Terms of Use and Sale).
1. Data controller
The Reveal service is published by Robin Taillepied, sole proprietor, SIRET 909 772 196 00012, based in Meaux (France). Contact: [email protected]
2. The data we collect
If you are a host (you create an album):
- Your sign-in identifier through Apple or Google (email address, or the alias provided by Apple’s Hide My Email). We never receive your password.
- The albums you create: event name, dates, settings.
- Your purchases made through the App Store or Google Play. Payment is processed by Apple or Google: we neither see nor store any payment card or banking data.
If you are a guest (you join an album):
- The first name (or nickname) you enter when joining the album. You are not asked for an account, email address or phone number.
- A random technical identifier is created to secure your access to the album, without any contact information.
For everyone:
- Photos taken in the app, with their timestamp and their author’s first name, linked to the event album.
- Technical data necessary for the operation and security of the service: IP address, date and time, route called, response code, device type, operating system and app or browser version.
- Mobile app diagnostic data: random installation and session identifiers, device model, language, screens viewed, performance measurements, errors and associated technical information. Sensitive route parameters are filtered.
When you visit reveal.camera:
- Pages viewed, interactions with the interface, a random browser identifier and its technical characteristics, to measure audience and improve the website. No personally identified profile or session recording is created.
When you contact support:
- Your email address, the content of your message and any attachments you choose to send.
We do not request access to your phone’s precise location. Your IP address, which is necessary for network communications, may nevertheless indicate an approximate geographic area. Photos taken in Reveal are not saved to your phone’s camera roll and do not contain geolocation data.
3. Why we use it
| Data | Purpose | Legal basis |
|---|---|---|
| Account, access and session identifiers | Create and manage your account or guest access, and secure albums | Performance of a contract |
| Guest first name | Identify the author of each photo in the album | Performance of a contract |
| Photos and album data | Create, configure and display the shared album at the chosen time | Performance of a contract |
| Purchases | Unlock purchased capacity, billing | Performance of a contract, legal obligation |
| Website browsing | Measure audience and improve pages | Legitimate interest |
| Technical and diagnostic data | Operate and secure the service, prevent abuse and fix failures | Legitimate interest |
| Support messages | Respond to your request and follow up on it | Performance of a contract, legitimate interest, legal obligation depending on the request |
We do not use your data for any advertising. We do not sell or rent your data to anyone. There is no advertising tracking in the app.
4. Photos and image rights
Photos remain the property of those who take them. They are only visible to album participants (or to the host alone, depending on the selected setting) — never public, and never used by Reveal for any purpose other than providing the service.
Because your guests photograph people, we provide for the following:
- The host ensures that participants at their event are informed about the use of Reveal.
- The host may view and delete any photo in their album at any time.
- Anyone appearing in a photo may request its deletion: directly from the host, or by writing to us at [email protected].
- Any content that breaches our terms of use may be reported to us at [email protected]; it is reviewed and removed where appropriate.
5. Who has access to your data
Your data is accessible only to the publisher and to the categories of recipients strictly necessary for the service:
| Recipient category | Relevant data and purpose | Sector and location |
|---|---|---|
| Application infrastructure and network protection | IP address, HTTP metadata and content sent to the API, to host, route and secure the service | Cloud hosting and network services — European Economic Area and global protection network |
| Managed database and authentication | Identifiers, sessions, profiles, album data, photo metadata and purchase entitlements, to manage access and business data | Cloud database and identity services — data hosted in Ireland; possible support access from outside the European Economic Area |
| Image storage and delivery | Photos, covers, object keys and delivery metadata, to retain and display authorized images | Object storage and delivery network — storage in Western Europe; delivery through a global network |
| Distribution, authentication and payment management | Account identifier, sign-in token, product, transaction and purchase identifiers, for the selected Apple or Google flow and the allocation of purchased entitlements | Mobile platforms, identity and in-app purchase management — European Economic Area and United States depending on the platform and its processors |
| Website audience measurement | Pages, interactions, random identifier, IP address and browser characteristics, to understand website use without a personally identified profile | Product analytics — European hosting region; possible support access from the United States |
| Diagnostics and observability | Random installation and session identifiers, device, version, screens, performance, errors and server traces, to detect and fix failures | Mobile software diagnostics and server monitoring — European Economic Area and United States depending on the signal |
| Email and user support | Email address, message and any attachments, to respond to and follow up on your request | Email services — global infrastructure, including in the European Economic Area and the United States |
Where any of these categories involves access or a transfer outside the European Economic Area, we rely, depending on the recipient and country, on an adequacy decision — including the EU–US Data Privacy Framework for certified organizations — or on the European Commission’s standard contractual clauses. You may request information about the safeguards applicable to your situation.
6. How long we keep it
Your photos and albums are retained for as long as your account is active, so that your memories remain accessible.
- Inactive account: after 3 consecutive years without signing in, we notify you before permanently deleting the account and associated data.
- Voluntary deletion: you may delete a photo or an album from the app settings. To delete your account, use the app settings or our account deletion page. Deleting the account results in the deletion of the associated data.
- Guest first names: retained with the album to which they belong and deleted with it.
- Technical logs, audience and diagnostics: retained for the operational period needed to detect incidents, compare performance and improve the service, then deleted or anonymized according to the configuration of the relevant service. Certain mobile performance metrics are retained for a technical period of at least 60 days.
- Support messages: retained for the time needed to handle your request, then for the period necessary to manage any dispute or comply with our legal obligations.
7. Your rights
Under the GDPR and the French Data Protection Act, you have the rights of access, rectification, erasure, objection, restriction and portability of your data.
To exercise these rights: [email protected]. We respond within one month. You may also lodge a complaint with the CNIL (www.cnil.fr).
As guests do not have an account, most of their requests (deleting a photo, removing a first name) can be handled immediately by the album host; we remain available for any direct request.
8. Minors
The service is intended for individuals aged 15 or over, the age from which a minor may independently consent to the processing of their data in France. Below this age, use requires the consent of a holder of parental responsibility.
9. Security
Data is encrypted in transit (TLS) and stored on secure infrastructure. Access to albums is limited to participants with the invitation code or QR code; galleries are never public.
10. Changes
This policy may evolve with the service. In the event of a material change, we will inform you in the app. The current version is always available at reveal.camera/confidentialite.
11. Contact
For any questions about your data: [email protected]
