Are wedding photo sharing apps private?

Anyone with the way in. The QR code on the table, the six-character event code typed at Eventphoto.io and the plain link all open the same page, and that page is the gallery: the photos everyone has uploaded so far, newest first, plus the upload button. No app, no account, no email address; the only thing a guest types is a name, so the photos carry one. If the event has a PIN, the page asks for it the first time a phone opens it and remembers it on that phone for a week.

The host holds a second, private link, sent in the confirmation email. It opens the same gallery but signs that browser in as the host, which adds the controls: delete any photo, download everything. Nothing about the host link is printed on a sign or shown to a guest. A guest who turns out to be the host on another phone taps “Are you the host?” and types a one-time code emailed to the host address.

What this means in plain terms: the gallery is as private as the code and the PIN. Whoever you hand them to, on a table card or in a group chat, can see every photo in it, and so can anyone they forward them to. It is the right level for a wedding, where the people in the room are the people who should see the room, and it is why there is a PIN for the cases where the card might walk out of the venue.

It is locked by default. When you create an event the PIN is switched on, you choose it, and it has to be 4 to 6 digits; a guest-created quick event gets a random one. You can switch it off at creation if the venue is private enough that the code alone is fine. The PIN appears in your confirmation email, and it has to go on the sign next to the QR code, or be said from the microphone, because a guest who scans and meets a PIN prompt otherwise has to come and ask.

A guest types the PIN once per phone, and the phone opens the gallery without asking again for a week. Changing or removing the PIN later is done from the dashboard, which means signing in with a one-time code sent to the host address; the host link on its own does not change it. A found link without the PIN opens nothing, which is the whole purpose: a card left in a taxi is a square of ink, not an album.

No. Every event page tells search engines not to index it and not to follow its links, and the site’s robots file disallows the whole event area on top of that, so neither Google nor Bing nor an answer engine lists a gallery, a photo or an event name. There is no public directory of events anywhere on Eventphoto.io; the address of a gallery contains its six-character code and nothing else, and nothing links to it except the things you print and send.

If a guest pastes the link into a chat, the preview the messaging app shows is a card with the event’s name and one line of text, never a photo from the gallery. The photos themselves are served from storage through short-lived signed addresses, not from a public folder, so a picture cannot be reached by guessing a file name.

The host can remove any photo or video, at any time: the trash icon on its tile, the same in the full-size view, or Select to pick several and delete them together. A deleted file is removed from the gallery and from storage, and the next Download all packs a fresh archive without it. A guest can delete their own uploads, from the phone they uploaded from, and nobody else’s.

There is no approval queue: photos appear as they are uploaded. For a wedding that is what you want, because guests upload for the pleasure of seeing their pictures land next to everyone else’s, and a queue would kill that in the first hour. For an event where every image has to be checked before anyone sees it, this is not the right tool, and we would rather say so here than on the night.