Back to home

Privacy Policy

Last updated: 8 April 2026

1. Who We Are

GuestDrop ("we", "us", "our") is an event photo-sharing platform operated by AuraFarm. We help event creators collect guest photos via QR codes with zero friction. No app downloads or signups required for guests.

2. Information We Collect

Event Creators (Authenticated Users)

  • Google account information (name, email, profile picture) via Google OAuth
  • Event details you create (event name, date, type)

Guests (Unauthenticated Uploaders)

  • Photos and videos uploaded via the QR code link, stored directly in the creator's Google Drive, not on our servers
  • Basic device metadata (browser type, upload timestamp) for troubleshooting
  • No personal information, login, or account is required

3. How We Use Your Information

  • To authenticate you and manage your events
  • To store uploaded photos in your connected Google Drive account
  • To display the event gallery to you and your guests
  • To send transactional emails (event confirmations)

4. Photo Storage

All guest-uploaded photos and videos are stored directly in the event creator's Google Drive account. GuestDrop does not store media files on its own servers. When a creator does not connect Google Drive, media is stored in secure cloud storage (Cloudflare R2) and remains accessible for the event duration.

5. Payments

GuestDrop is free to use. Creating an event, generating a QR code, and collecting guest uploads never requires a payment method.

A creator may optionally make a single payment, for a single event, to extend how long that event's hosted gallery stays open past the free window. PayPal processes that payment and receives the transaction information PayPal itself requires to complete it, under PayPal's own privacy policy. GuestDrop receives back only a payment confirmation plus the PayPal order and capture identifiers and the amount, which we store against the event. GuestDrop does not request or store card details.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We share data only with:

  • Google: for OAuth authentication and Drive storage (per your consent)
  • Vercel: our hosting provider (infrastructure only)
  • PayPal: processes optional retention-extension payments

7. Cookies

We use essential cookies for authentication sessions. We do not use third-party tracking cookies or advertising cookies.

8. Data Retention

Event data is retained for 7 days from event creation. After expiry, event metadata is removed from our database. Photos in your Google Drive remain in your Drive. We do not delete them.

9. Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA), you have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request deletion of your data
  • Withdraw consent for data processing

To exercise these rights, contact us at support@guestdrop.app.

10. Security

All data is transmitted over HTTPS. Authentication tokens are stored securely. We follow industry-standard security practices to protect your information.

11. Contact

For privacy-related questions, contact us at support@guestdrop.app.