Keeping your photos safe

Photos from a wedding, a party or a school day are personal. This page explains, without the jargon, what GuestCam does to keep them away from people who should not see them. It sits alongside the privacy page, which says what is stored and for how long.

The short version

• Only the people the hosts choose can see the photos — on the screen at the event, and in the album afterwards.
• The full-size photos are never on a public address. They can only be downloaded through a link that stops working after ten minutes.
• A photo that is hidden or removed is really gone from view — off the screen, out of the album and out of the download-everything file.
• Every upload is checked to make sure it is really a photo or a video before anything else happens to it.
• Schools get extra locks: every guest signs in with Google, someone approves each photo, and a TV only shows photos once a teacher has paired it.

Who can see the photos

• On the night: the photos appear on the event's screen and in the guests' gallery. If the hosts want to check photos first, nothing appears anywhere until someone approves it.
• Afterwards: in the album, only for people the hosts give the album link to. The hosts can add a passcode, so the link alone is not enough.
• The hosts and their helpers see everything, including photos waiting for approval, from the event's own console. Helpers only see the events they have been added to.
• A guest can always see and delete their own photos.

How the photos themselves are protected

• Full-size originals are private. The screen and the album show smaller copies. The original file is only handed out through a download link made at the moment someone allowed asks for it. The link stops working after ten minutes, so a saved or passed-on link is soon useless, and it cannot be found by guessing.
• Hidden really means hidden. When a host hides a photo, its copies are moved to a private store that only the hosts can reach. It disappears from the screen and the album, and the album's download-everything file is thrown away and rebuilt without it.
• Nobody can list what is stored. Each photo is filed under a long random name, and the storage refuses any request to list what is there.
• Everything travels encrypted. Every page, upload and download goes over a secure connection (the padlock in your browser).

How uploads are checked

• Only real photos and videos are accepted. Each file is checked by what is actually inside it — not by its name — so something pretending to be a photo is turned away.
• Sizes are enforced. A file has to be the size the phone said it was, a single guest and a single event each have a storage limit, and very large or very long videos are refused. That stops anyone filling the system up.
• Nothing uploaded can ever run as a web page or a program. Photo storage is kept separate from the website and tells every browser to treat its files as pictures only.

Keeping out people who should not be there

• The server cannot be reached directly from the internet. Everything comes in through Cloudflare, which blocks known attacks before they arrive.
• Forms are protected from robots with Cloudflare's human check — usually invisible — plus limits on how often anything can be tried.
• Each part of the system only has the access it needs. For example, the website's access to photo storage lets it file and fetch photos, but not change who is allowed to see them.
• Host accounts are by invitation only, and repeated wrong sign-in attempts are slowed down and logged.
• The code is reviewed for weaknesses, with a full review most recently in October 2026, and fixes go out as soon as they are ready.

Extra protection for schools

A school can turn on stronger rules for every one of its events. Once on, they apply to every event that school runs, and only GuestCam can turn them off.

• Everyone signs in with Google. Guests cannot join with just a first name. Each person is a real, signed-in account, and the school can see who sent what.
• The album is only for people who were there. To open the album or the guests' gallery, you have to sign in with the Google account you used at the event. Someone the link was forwarded to, who did not take part, is turned away.
• Every photo is approved by a person before it appears anywhere. For school events this cannot be switched off.
• TVs have to be paired. Typing the event's code into a TV is not enough. The TV shows a six-digit number, and a teacher types that number into the console to let it show photos. The school can see every paired TV and unpair one at any time; a pairing ends by itself the day after the event.
• Someone can be removed in one step. Blocking a guest hides all their photos and stops that phone joining the event again.
• Every decision is recorded. Each approval, hide, delete, setting change and TV pairing is logged with who did it and when — so a school can always show that a person checked the photos.
• A photo can be taken down straight away if a family asks — hidden or deleted from the console, and gone from the screen, the album and the downloads.

What GuestCam never does

• No facial recognition unless the host switches it on, and never on school events. When a host turns on finding people by face, the faces are grouped on GuestCam's own server, nothing is sent anywhere and no names are attached. See Privacy.
• Photos are never sold, shared with advertisers, or used to train anything.
• No advertising or tracking on the site.

No system is perfect

Nothing on the internet can promise to be unbreakable, and this page does not pretend otherwise. What it can promise is that protecting your photos is treated as the most important part of the job, that weaknesses are looked for and fixed, and that if photos were ever exposed to someone who should not have seen them, the affected hosts would be told directly and promptly.

Found a problem?

If you think you have found a security weakness, or you are worried about a photo, email [email protected]. Reports are read by a person and answered quickly.