Privacy policy

Ocasia is run by Kanea Studio Ltd, a company registered in England and Wales (number 15458475). We are the controller of the personal data described here.

For anything about your data, email team@ocasia.app.

If you organise an event

• Your email address, which you sign in with using a one-time code.
• The display name you choose. Guests see it as the event's host.
• The events you create: name, dates, place, cover image and settings.
• What you do as organiser: developing an album, removing shots, handling reports and removing guests.

If you join an event as a guest

• The name you type to join. The organiser sees it next to your shots.
• An anonymous account identifier created on your phone. You do not give us an email address.

Everyone

• The photos and videos you take in the app, including a video's sound, and when each was taken.
• Reports you make about a shot, and the reason you picked.
• If you buy something in the app: a record of what was bought. Apple takes the payment; we never see your card details.
• Crash reports and diagnostics: device model, system and app version, and what went wrong. A small sample of app sessions is recorded as a screen replay to help us fix problems. The camera and your shots are masked out of it.
• In the App Clip: when it is opened, when you join an event and when you take a shot, linked to your anonymous identifier.
• Your IP address, as part of every request your phone makes, which we use to stop abuse.

We do not collect your location, your contacts or advertising identifiers. We do not show ads, we do not track you across other apps or websites, and we do not sell your data.

This website sets no cookies and runs no analytics. The invite page looks up an event from the code in the link to show its name and times.

• Camera, to take photos and videos and to scan invite codes.
• Microphone, so your videos have sound.
• Adding to your photos, to save a copy of each shot to your library. The app never reads your library for this.
• Choosing a photo, only when an organiser picks a cover image.

You can turn any of these off in your phone's Settings.

• To run the service you asked for: signing you in, running events, uploading shots and building the album. This is necessary to perform our contract with you.
• To keep events safe: handling reports, hiding a shot automatically once three guests report it until the organiser reviews it, and letting organisers remove guests. This is in our legitimate interest, and yours, in a service free of abuse.
• To keep the app working: crash reports, screen replays and App Clip usage events. This is in our legitimate interest in finding and fixing problems.
• To protect the service: rate limits and abuse checks based on IP address. This is in our legitimate interest in keeping the service secure.
• To meet legal obligations, such as keeping records of purchases.

No decision with legal or similarly significant effect is ever made about you automatically.

• The organiser sees every shot taken at their event, the name each guest joined with, and reports about shots.
• Guests at the event see the album once the organiser develops it, and can save shots from it to their own phones. Copies saved to a phone are outside our control.
• Anyone with the invite link or code can see the event's name and times.

We use these providers to run Ocasia. Each handles data only on our instructions, under a contract that requires them to protect it.

• Supabase: accounts, sign-in and event data.
• Cloudflare: our servers and the storage for photos and videos.
• Sentry (EU region): crash reports and screen replays.
• PostHog: App Clip usage events.
• Expo: delivering app updates.
• Vercel: hosting this website.
• An email delivery provider: sending sign-in codes.
• Apple: the App Store, App Clips and in-app payments.

Some of these providers process data outside the UK, including in the United States. Where they do, the transfer is covered by UK adequacy regulations or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Events and albums: 12 months after the event ends. The event, its shots and its guests' names are then deleted.
• Shots an organiser removes: deleted for good 30 days after removal.
• Deleted accounts: your account, your events and every shot taken at them leave our database straight away. The photo and video files are cleared from storage within 60 days.
• On your phone: the app keeps its own copy of your full-size shots for 7 days after an event ends. Copies saved to your photo library stay until you delete them.
• Crash reports and screen replays: up to 90 days.
• App Clip usage events: up to 12 months.
• Emails you send us: as long as we need to deal with them.

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to you in a portable format. You can also object to any use based on our legitimate interests. We will reply within one month.

Organisers can delete their account in the app, from Profile. This deletes their events and every shot taken at them.

Guests can ask the organiser to remove a shot, or use Ask to hide on one of their own. For anything else, or if the organiser does not act, email team@ocasia.app with the event and the name you joined with. We may need to confirm it is you before acting, because a guest has no account to sign in to.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. If you live in the EU, you can also complain to your local data protection authority.

Ocasia is not for children under 13, and organisers must be 18 or over. If we learn that a child under 13 has used Ocasia, we delete their data.

Data is encrypted between your phone and our servers. Shots are kept in private storage and are only reachable through links that expire. Access to production systems is limited to the people who run Ocasia.

When we change this policy we update the date at the top. If a change affects how we use your data in a significant way, we will tell you in the app first.