Privacy Policy

Last updated: 14 August 2026

Tasveerlo ("Tasveerlo", "we", "us") lets guests at a wedding or event upload photos by scanning a QR code, and lets the host collect, moderate, and share those photos in one place. This policy explains what we collect, why, and what rights you have. We are guided by India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Who we are

Tasveerlo is currently operated by Sameer Athar, Founder, based in Uttar Pradesh, India, as the data fiduciary for information processed through tasveerlo.com and the Tasveerlo host app. Sameer Athar, Founder, is the person able to answer questions on our behalf about the processing of your personal data. You can reach us at hello@tasveerlo.com for anything in this policy, including DPDP rights requests.

2. Tasveerlo is in early access

Tasveerlo is currently in a validation phase: every event runs on the same feature set, there is no paid plan or payment collection yet, and we're a solo-run product rather than a large company with a dedicated legal or support team. This policy is real and binding, but some sections (retention windows in particular) describe our current practice rather than a fixed, permanent commitment — we'll update this page as pricing plans and their associated retention tiers launch.

3. What we collect

From hosts (people with a Tasveerlo account)

• Name and email address, via Firebase Authentication (Google sign-in or email/password).
• Your city, state and country, entered once during a required step just after sign-up. We use this to understand which parts of India Tasveerlo is being used in. We do not collect GPS or precise location data, and we do not track your location while you use the app.
• A profile photo, if you choose to set one. This is optional and can be changed at any time from the Account screen.
• Event details you enter: event name, event type, ceremony names, expected guest count, and the upload window you pick.
• Any photos you upload to your own event yourself — for example to seed the slideshow before guests arrive, or to set an event's cover photo. These are added as already-approved and are not sent through the automated moderation described in Section 4.

From guests (no account or login required)

• The photos you choose to upload, and an optional name if you enter one.
• A random, per-browser identifier ("uploader token") we set the first time you open an upload page, so we can count you as one unique guest and prevent abuse — this is not tied to your name or phone number unless you provide one.
• Your IP address and browser/device user-agent string, logged against each upload for spam and abuse prevention.
• If you allow notifications on the upload page, a browser push subscription (used only to tell you "your photo is coming up" during the live slideshow — see Section 6).

Automatically, from anyone using the site or app

Standard technical data such as browser type, device type, and page requests, collected as part of normal web hosting logs.

When you report a photo

If you report a photo to us as inappropriate, we record what you reported and why, along with your IP address and browser details to prevent abuse of the reporting system. Reports submitted from within the host app also record which account submitted them. Reports are deleted along with the rest of a host's data if that host deletes their account.

When you join the early-access list

If you enter your email address in the “get notified when we launch” form on our home page, we store that address along with your IP address and browser details — the address so we can email you when Tasveerlo launches, the IP and browser details to stop the form being abused. We are not sending any email to this list yet, and we will never sell or share it. To have your address removed at any time, email us at hello@tasveerlo.com.

4. How we moderate photos

Every guest-uploaded photo is checked before it can appear on the moderation queue or slideshow:

• Resize — the photo is compressed for storage and delivery.
• Duplicate check — a perceptual hash (pHash) is computed to catch near-duplicate uploads. This runs inside our own server-side Cloud Functions; the image is not sent to any third-party service for this step.
• Blur check — a sharpness score is computed the same way, inside our own Cloud Functions.
• AI content screening — photos that survive the checks above are sent to the Google Cloud Vision API's Safe Search feature, which flags adult, violent, or otherwise unsafe content for the host or moderator to review. This call happens only from our server-side Cloud Functions — the Vision API is never called from the guest's browser or the host's app, and Vision credentials are never shipped in any app or web page.

A photo flagged by Vision is always held for manual review, even if the host has turned on Auto-Approve for that ceremony — it is never shown automatically.

5. We do not currently do face recognition

Unlike some other photo-sharing platforms, Tasveerlo does not run face recognition, generate face embeddings, or offer a "find my photos via selfie" feature at this time. We do not collect or process biometric data. If we introduce this as an optional feature in the future, we will update this policy first and ask for your explicit, opt-in consent before processing any biometric data.

6. Push notifications

On the guest upload page, you can optionally allow browser notifications so we can let you know when a photo of yours is about to appear on the live slideshow. This is opt-in — if you don't allow notifications, nothing is sent. You can revoke this at any time from your browser's site settings, which immediately stops any further notifications to that browser.

7. Who can see what

• The host sees every photo uploaded to their event, pending or approved, and can approve, reject, or delete any of them.
• A moderator the host delegates (via a private moderator link) can approve or reject pending photos, but cannot reverse a photo the host has already approved.
• Guests and anyone with the slideshow or shared-album link see only approved photos — never the pending or rejected queue.
• We (Tasveerlo) do not access your event's photos except as needed to operate the service (e.g. debugging a reported issue), and we never sell photos or personal data to anyone.

8. Where your data lives

Tasveerlo is built on Google's Firebase and Google Cloud Platform. The following Google services process data on our behalf as sub-processors:

• Firebase Authentication — host sign-in only.
• Firestore — event, ceremony, and photo records.
• Firebase Storage — the photo files themselves.
• Firebase Cloud Functions — server-side processing (resize, moderation, notifications).
• Firebase Hosting — the guest upload, slideshow, moderator, and album web pages.
• Google Cloud Vision API — content moderation only, as described in Section 4.

We do not use any advertising or analytics networks that track you across other websites.

9. Cookies and local storage

The Tasveerlo host app is a mobile app and does not use cookies. On the guest web pages (upload, slideshow, moderator, album), we use browser local storage — not tracking cookies — to remember your per-browser uploader token so repeat visits to the same event aren't counted as a new guest. Firebase Authentication may set a strictly-necessary session cookie for hosts signing in. We do not use third-party advertising cookies or cross-site tracking scripts.

10. Retention and deletion

During this early-access phase, we keep your event photos for as long as your host account stays active — there is no fixed expiry date on an event's photos yet. Two things are deleted automatically on a schedule:

• Bulk-download archives. When you use bulk download, we build a ZIP of that ceremony's approved photos and store it so your download link works. These archives are deleted automatically 3 days after they are created; the photos themselves are unaffected.
• Unreviewed flagged photos. A photo held back by our automated content screen that is never manually reviewed is automatically rejected once its ceremony's upload window closes, which deletes the file. It is never shown by default.

Beyond that, deletion happens when you ask for it, and always removes the underlying file rather than just the database record:

• Rejecting or deleting a photo deletes the underlying file from Storage, not just its record.
• Deleting your host account deletes all of your events — every ceremony, photo, Storage file, bulk-download archive, content report and short link associated with them.
• The host app does not currently let you delete a single event on its own. If you want one event and its photos removed while keeping your account, email us at hello@tasveerlo.com and we will delete it for you.

Deletions are permanent and cannot be undone. Full step-by-step instructions for deleting your account, including how to request deletion by email if you no longer have the app installed, are on our Delete Your Account page.

Once paid plans launch, each plan will carry a specific storage retention window (communicated at that time), and this section will be updated accordingly.

11. Your rights under the DPDP Act

As a data principal, you can at any time:

• Ask what personal data we hold about you.
• Ask us to correct inaccurate personal data.
• Ask us to erase your personal data (subject to any legal retention obligation, e.g. tax records).
• Withdraw any consent you've given (such as push notifications).
• Raise a grievance about how your data has been handled.

Send requests to hello@tasveerlo.com. As a solo-run product we aim to respond within 30 days.

12. Security

All traffic to Tasveerlo's web pages and app is encrypted in transit (TLS). Access to event data is scoped per host and per private token link — a moderator or slideshow link only unlocks its own event's data. Google Vision credentials and other service secrets are stored only in Cloud Functions and are never included in the Flutter app or any public web page. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. Photos of children

Weddings and family events commonly include photos of minors. Tasveerlo itself is not directed at children and guest uploaders are expected to be adults. The host is responsible for obtaining any consent needed to photograph and share images of minors at their event, consistent with how they'd normally handle event photography.

14. Changes to this policy

We may update this policy as Tasveerlo develops, particularly around paid plans and retention. We'll update the "last updated" date above when we do, and for material changes we'll aim to notify hosts by email.

15. Contact

Questions or DPDP rights requests: hello@tasveerlo.com. This policy is governed by the laws of India.