Legal
Privacy Policy
Last updated: July 22, 2026
1. Who we are
Disposa ("we", "us") is the data controller for personal data processed through the Disposa iOS app, the Disposa App Clip, and disposa.app. The controller is House of Share ApS, CVR 43640666, Platanvej 6, 12. 1, 1810 Frederiksberg C, Denmark. For anything privacy-related, contact support@disposa.app.
The short version: we store the photos taken at your events so they can be shared with the event's participants — and we collect only what we need to run the service. We don't sell your data, and we don't show ads.
2. What we collect
- Account data. An anonymous account identifier is created automatically. If you sign in with Apple, we also receive the name and email address you choose to share (Apple's "Hide My Email" relay works fine).
- Profile data. The display name you enter when joining or hosting an event.
- Event data. Event titles, dates, settings (shot counts, guest limits, visibility), cover images, and who participates in which event.
- Photos. The photos you take in the app, plus derived data (a blurred placeholder, capture time, which event and participant they belong to).
- Purchase data. When you buy something, Apple processes the payment — we never see your card details. We receive transaction identifiers, the product bought, price and currency.
- Device and usage data. Device model, OS and app version, language, country (from your App Store storefront and IP), push notification tokens, and how you arrived (organic or via an invite link).
- Analytics and crash data. Usage events (like screens viewed and features used) and crash reports, tied to your account identifier.
3. How we use it
- To run the Service: host events, deliver invitations, enforce shot and guest limits, show albums to the right people at the right time.
- To send notifications you'd expect: a guest joined your event, the event is starting, the album is ready — and Live Activities during the event.
- To email hosts their album download link when an event ends, and a reminder before an album is archived.
- To process purchases and prevent fraud and abuse.
- To understand usage and fix crashes and bugs.
4. Legal bases (GDPR)
We process your data to perform our contract with you (running the Service), based on our legitimate interests (security, preventing abuse, improving the Service), to comply with legal obligations, and — for push notifications — based on your consent, which you can withdraw in your device settings at any time.
5. Who we share it with
Photos are shared with the participants of the event they were taken at, according to the event's visibility settings. Beyond that, we share data only with the processors that power the Service:
- Google Firebase — database, authentication, cloud functions, analytics and crash reporting. Our database runs in Google's EU region.
- Cloudflare — photo storage and delivery (CDN), and hosting of disposa.app.
- Apple — sign-in, payments, and push notifications.
- RevenueCat — purchase management.
- Resend — transactional email (album delivery).
These providers process data on our behalf under data processing agreements. Some may process data outside the EU/EEA; where they do, transfers are safeguarded by the EU Standard Contractual Clauses or an adequacy decision. We may also disclose data where the law requires it. We never sell personal data.
6. Storage and retention
- Photos are kept while their event's album is live. About 30 days after an event ends, the album is archived into a compressed archive and the original photos are deleted; the archive is kept so the album can still be downloaded.
- If a host deletes an event — or a guest is removed from one — the associated photos are deleted from storage.
- If you delete your account, the events you hosted (including all their photos) are deleted, and your profile is reduced to a minimal tombstone record needed to keep other people's albums consistent.
- Anonymous accounts that stay inactive for an extended period may be cleaned up.
7. Your rights
Under the GDPR you can access, correct, delete, and receive a copy of your personal data, object to or restrict certain processing, and withdraw consent. You can delete your account directly in the app (Profile → Delete account, available for Apple-linked accounts) — or contact support@disposa.app and we'll help. You also have the right to complain to a supervisory authority; in Denmark that is Datatilsynet (datatilsynet.dk).
8. Children
Disposa is not directed at children under 13. If you are below the age at which you can consent to data processing in your country, please only use Disposa with a parent's or guardian's involvement.
9. Security
Data is encrypted in transit, access to production systems is restricted, and photo access is governed by per-event rules. No system is perfectly secure, but we design conservatively: private albums are private by default.
10. Changes
We'll update this policy as the Service evolves and change the date at the top. If a change is material, we'll make reasonable efforts to notify you in the app.