Who can see the photos?

Everyone you give the QR code, the event code or the link to sees the same shared gallery, and nobody else: the gallery is never listed anywhere, search engines are told not to index it, and there is no public feed.

That shared view is the point during the party: guests at one table see what the other tables are uploading. It also means the gallery is exactly as private as the code. A code printed on every table card is known to every guest, and a guest who forwards the link to someone outside the party lets that person in too; keep the PIN on if that matters to you: only the people in the room are told it.

Managing the event, deleting photos and downloading everything is the host's alone: your browser is recognized as the host's when you create the event in it, or you follow the private host link in the confirmation email, which nobody else receives. The dashboard behind it opens with a one-time code sent to the same address.

A link pasted into a chat previews the event's name and a generic card, never a photo, a guest's name or the PIN. Photos are served through signed links that expire within a day, and every file is deleted when the event ends: 14 days after creation on the free plan, 12 months after the upgrade on the paid plan.