Private in the specific ways that matter.
What we built, what we store, who can see it, and what you control — in plain language.
Trust is part of the product.
A reveal is a moment of trust: a room's whole memory, opened at once, to exactly the right people. The architecture below exists so that moment stays exactly that — yours.
Sealed event spaces
Every event lives behind private links that only the host hands out. Guest and reveal pages are excluded from search engines and from our own sitemap, and unknown links return nothing at all. There is no public feed, no directory, and no way to browse from one event to another.
Reveal links are private tokens
A reveal link is an unguessable token, not a name. It is unlisted, marked not-for-indexing, and sealed until the reveal hour — before that hour, the film itself is withheld, not merely hidden. Share it only with the people the film is for.
Location data is stripped on arrival
Photographs carry invisible metadata — including, often, the exact place they were taken. Souvenyr strips that metadata from guest photographs at upload, before they are stored. Your guests shouldn't have to know what their cameras embed; we assume they don't.
Host controls
The host decides who receives the reveal link, approves the film's treatment before anything renders, and can ask for any moment to come down. Deletion of a whole event is confirm-gated, logged, and completed by a person — not a button that pretends.
Guest withdrawal
Guests can ask for their own contributions to be removed, at any time, without justifying it. Removals are handled by the studio, confirmed, and logged. We would rather lose a moment than keep one that someone regrets giving.
What we store, and for how long
We store what your event gathered — the media, the voices, the film — and the minimum account details needed to run it. The archive's span follows your plan: one year on Capture, two on Film, ten on Legacy. Your masters are downloadable throughout; the archive is not a hostage.
Who can access media internally
Guest media lives in a private bucket and is served through expiring signed links, minted per request for people entitled to see it. Our operations dashboards show counts, queues, and logs — not your photographs. Access for support happens only when you ask for help that requires it, and it is logged.
The training promise
Your memories are not training data — for us or for any partner we work with. Every processing partner is bound by an agreement that prohibits using your content to train models. The full statement lives in our privacy policy, in the same plain language.