Privacy Policy

1. Introduction

Welcome to Polapic. We built this platform to help hosts and event teams collect guest photos, moderate uploads, and run live slideshows without sacrificing privacy.

This Privacy Policy explains how we collect, use, and protect your information when you use Polapic. We take your privacy seriously and are committed to transparency.

2. What Data We Collect (and Don't Collect)

2.1 Event and Upload Data (Server Storage)

When you use Polapic, you may provide or generate data such as:

• Event details (event name, date, host settings)
• Uploaded photos and associated metadata
• Moderation status (approved, pending, rejected)
• Event configuration (display and moderation preferences)
• Notes and labels added by hosts or team members

Important: This data is stored securely on Polapic's servers and associated with your account.

• Personal accounts: Access to event hosting and media management features
• Business accounts: Additional collaboration and organization controls
• Account required: You must create an account (email/password or Google Sign-In) to manage events
• Cross-device access: Access your events from any device when logged in
• Data encryption: All data is encrypted in transit (HTTPS) and at rest
• Regular backups: Data is backed up regularly to help prevent loss

Your uploaded media and event data are never shared with third parties for advertising or marketing purposes.

2.2 Account Information

When you create an account, we collect:

• Email address: For account login, password resets, and important service notifications
• Password (hashed): If using email/password authentication (we never store plain-text passwords)
• Account preferences: Theme settings and account preferences

2.3 Google Sign-In Data (Optional)

If you choose to sign in with Google, we receive the following information from Google:

• Email address: Your Google account email
• Google user ID: A unique identifier for authentication
• Profile information: Name and profile picture (if you choose to share)

Google Sign-In is optional. You can use email/password authentication instead. By using Google Sign-In, you agree to Google's Terms of Service and Privacy Policy.

2.4 Analytics Data (PostHog)

We use PostHog to understand how people use the Polapic marketing site and app. Data collected includes:

• Page views: Which pages you visit
• Interactions: Clicks and product actions, such as opening a page or creating an event
• Device information: Browser type, operating system, screen size
• General location: Country or region derived from the IP address, not a precise location
• Signed-in hosts: Account id, role, account type, and plan. We do not send your email address or password to PostHog.

Important: We do not send uploaded photos, event media, or guest upload and share-wall links to PostHog.

• Guests who are not signed in are measured without a personal profile
• No uploaded media is shared with analytics providers
• We do not record session replays
• Used to improve product quality and feature usability
• You can block analytics cookies in your browser settings

2.5 Payment Information (Paid Plans)

If you subscribe to a paid Polapic plan, we use Stripe to process payments. We never see or store your full credit card information. Stripe handles payment data according to their Privacy Policy.

We only receive:

• Confirmation that payment was successful
• Your email address (for receipts and subscription management)
• Transaction ID (for support purposes)
• Subscription status (active, canceled, past due)

3. How We Use Your Information

We use the data we collect to:

• ✅ Provide and improve Polapic functionality
• ✅ Store and sync event settings and media across devices
• ✅ Authenticate your account and maintain login sessions
• ✅ Process subscription payments and send receipts
• ✅ Detect abuse, spam, and policy violations
• ✅ Fix bugs and technical issues
• ✅ Understand which features are most valuable (aggregate analytics only)
• ✅ Send important service updates and notifications
• ✅ Provide customer support

We will NEVER:

• ❌ Sell your data to third parties
• ❌ Show targeted ads based on your uploaded media or event content
• ❌ Share your private event media without your permission
• ❌ Use your data for marketing without explicit consent
• ❌ Send uploaded media to analytics services

4. Data Storage & Security

4.1 Server-Based Storage

Your event content is stored securely on Polapic's servers. This provides:

• Cross-device access: Access your events from any device when logged in
• Data persistence: Your data is not tied to a single browser or device
• Regular backups: We back up data regularly to help prevent loss
• Account-based storage: Events and uploads are associated with your account

4.2 Security Measures

We implement industry-standard security practices to protect your data:

• Encryption in transit: All data transmitted using HTTPS/TLS encryption
• Encryption at rest: Database encryption for stored data
• Hashed passwords: Passwords are hashed (never stored in plain text)
• Secure authentication: Session tokens with expiration
• Regular security updates: Infrastructure and dependencies kept current
• Access controls: Strict internal access policies and logging

4.3 Account Deletion

You can delete your account and associated data at any time:

• Event content associated with your account is permanently deleted (subject to legal retention requirements)
• Account information is removed within 30 days
• Payment records may be retained for up to 7 years for tax/legal compliance
• Deletion is irreversible and may affect shared event access

5. Cookies & Tracking

Polapic uses the following cookie categories:

• Essential cookies: Authentication and session management
• Preference cookies: Theme and interface preferences
• Analytics cookies: PostHog cookies for usage measurement

We do NOT use:

• ❌ Advertising cookies
• ❌ Cross-site tracking for marketing purposes
• ❌ Behavioral profiling for ads

You can control cookies through your browser settings. Disabling essential cookies may prevent certain parts of the service from working correctly.

6. Third-Party Services

We integrate with the following third-party services. Each service has its own privacy policy and terms:

We are not responsible for the privacy practices of third-party services. Please review their policies independently.

7. Your Rights (GDPR & CCPA)

You have the following rights regarding your data:

To exercise these rights, contact us at: support@polapic.com

8. Data Retention

We retain different types of data for varying periods:

• Event content: Retained while account/event is active; deleted when removed by host or after account deletion
• Account information: Retained while account is active; deleted within 30 days of verified deletion request
• Payment records: Kept up to 7 years for legal/tax compliance
• Analytics data: Kept according to our PostHog project retention settings and used for product measurement
• Server logs: Retained for security and debugging purposes

9. Children's Privacy

Polapic is not intended for children under 13 as account holders. If you believe we have collected personal data from a child inappropriately, please contact us and we will investigate promptly.

10. International Users

Polapic is hosted in the United States. If you access the service from outside the US, your data may be transferred to and processed in the US. We apply appropriate safeguards for international data handling.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes may be communicated by:

• Email notification (if you've provided an email)
• Prominent notice on our website
• Updated "Last updated" date on this page

Continued use of Polapic after updates constitutes acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data:

13. Legal Compliance

This Privacy Policy is designed to support compliance with applicable privacy laws, including:

• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• California Privacy Rights Act (CPRA)
• Other applicable US state privacy laws

Last updated: October 16, 2026 | Version 2.0