Privacy.
Your event stays your event.
Effective August 31, 2026. Version 2026-08-31.1.
This Notice explains how Zachary Smet, operating under the public business name Threvu in Wisconsin, handles personal information. It covers the public website, organizer accounts, private event links, guest participation, live displays, albums, venue pilots, support, billing, and privacy requests.
1. The short version
- Guests do not need an account and can join without giving an email.
- Each guest receives an event-scoped browser session and may choose a nickname.
- We do not sell personal information, share it for cross-context behavioral advertising, or use private event photos for marketing or model training without a separate opt-in.
- Organizers and people with the private event link can see event content; approved content may appear on the venue display.
- Payment-card details are handled by Stripe, not stored by Threvu.
- Anyone shown in a photo may ask for review or removal.
2. Information we collect
| Category | Examples and source |
|---|---|
| Organizer account | Email, password authentication data managed by Supabase, optional display name, account identifiers, and policy-acceptance records supplied by the organizer. |
| Event and venue | Event name and date, selected tier, moderation settings, venue name, event status, capacity, event link, QR code, and venue subscription usage supplied by the organizer or generated by the service. |
| Guest participation | An event-scoped random browser token stored in a cookie, a one-way hash of that token in the database, optional nickname, join and last-seen times, upload count, optional event-album email, and the policy versions, consent summary, and server timestamp recorded when a guest affirmatively participates. |
| User content | Uploaded photos, comments, likes, moderation status, technical image properties, and the policy versions and consent summary accepted for each upload. |
| Payments and contracts | Tier, amount, currency, payment and subscription status, limited Stripe identifiers, billing-period dates, cancellation state, refund or dispute state, and the exact commercial terms accepted. Stripe—not Threvu—receives the full card number and security code. |
| Requests and leads | Contact details and information submitted through pilot, support, refund, copyright, and privacy forms, plus a reference and status used to handle the request. |
| Security and operations | Infrastructure request IDs, error and delivery records, timestamps, and an IP address used transiently to create a one-way rate-limit identifier. Hosting and security providers may process IP address, browser, device, and network data in their logs. |
| Attribution and analytics | Public page views and limited campaign fields such as source, medium, campaign, use-case category, tier, and funnel stage. Private event paths, names, slugs, emails, comments, photos, participant IDs, and Stripe IDs are excluded from analytics. |
3. How we use information
- create accounts, events, guest sessions, QR access, feeds, displays, albums, and downloads;
- enforce the three-photo and participant limits;
- process, reconcile, refund, and defend payments and subscription entitlements;
- record consent and provide subscription cancellation and billing management;
- send requested album, event, security, billing, retention, and support communications;
- moderate content, investigate reports, prevent fraud and abuse, rate-limit requests, and protect the service;
- respond to pilot, support, privacy, rights, and legal requests;
- measure public-site performance and privacy-safe funnel activity; and
- comply with law, resolve disputes, and enforce agreements.
Depending on the relationship and applicable law, these uses rely on performing a contract, consent, legitimate interests in operating and protecting the service, and legal obligations. Consent may be withdrawn prospectively where consent is the basis, but withdrawal does not undo processing already lawfully completed.
4. Photos, metadata, and display
The selected upload may temporarily contain device metadata while it is transferred for validation. The service rotates and converts accepted images to controlled WebP copies; this removes unnecessary EXIF and GPS metadata from the copies used by Threvu. The temporary incoming object is removed after processing, and failed upload remnants are removed on a best-effort basis. We do not use face recognition, biometric templates, or automated identity matching.
Event photos and comments are visible to the organizer and people with event access. Approved photos may appear on a television or projector where people in the venue can see them. Threvu cannot control photographs, screenshots, downloads, or onward sharing performed by an organizer or guest after lawful access.
5. Cookies and similar technology
Threvu uses strictly necessary cookies for organizer authentication and an event-scoped guest-session cookie so a guest can keep their nickname, three-photo count, likes, comments, and album-email choice. The public site may use Vercel Web Analytics when enabled, but analytics are filtered to public paths and receive no private event content or identifiers from Threvu. We do not use advertising cookies or cross-site behavioral profiles.
Browser “Do Not Track” signals are not standardized. Because Threvu does not sell or share information for targeted advertising, a Do Not Track or Global Privacy Control signal does not change that practice. If those signals become legally applicable to another use, we will honor them as required.
6. When information is disclosed
- Event participants and organizers: event content, nicknames, reactions, comments, and related timestamps as part of the private event experience.
- Vercel: application hosting, delivery, security, logs, and privacy-filtered public-site analytics.
- Supabase: authentication, database, private image storage, signed image delivery, and related infrastructure.
- Stripe: checkout, payment processing, subscriptions, invoices, refunds, disputes, fraud prevention, and the customer billing portal.
- Resend: requested transactional and operational email when email delivery is enabled.
- Professional advisers and authorities: where reasonably necessary for legal advice, audits, insurance, safety, rights protection, valid process, or legal obligations.
- Business transfer: under confidentiality and continuity safeguards if Threvu is reorganized, financed, sold, or transferred.
Providers may use subcontractors and process information in the United States or other countries under their own security and legal commitments. We do not authorize service providers to use private event content for their own advertising.
7. No sale, targeted advertising, or private-photo marketing
Threvu does not sell personal information for money or other valuable consideration and does not share personal information for cross-context behavioral advertising. We do not disclose private event photos, comments, or attendee emails to data brokers, advertisers, public portfolios, social networks, or AI model trainers. A future marketing use would require a separate, specific, voluntary opt-in from the appropriate rights holder; accepting these Terms is not that opt-in.
8. Email
A guest may opt in to receive the finished album for one specific event. That address is not silently added to a marketing list. Pilot contact consent covers only evaluating and coordinating the requested pilot. Organizer, album, billing, security, retention, and support messages are transactional. Marketing email is disabled unless a separate opt-in flow is introduced.
9. Retention and deletion
- Event content: when an organizer ends an event, the active retention target is 90 days. The event is then scheduled for archival, followed by a seven-day restricted restoration window and deletion from active storage. One restoration may be available during that window and gives the organizer seven days to export.
- Deleted event data: photos and derivatives, guest sessions, comments, likes, guest email data, and related event records are removed from active systems. A minimized event tombstone, security evidence, legal holds, and payment or audit records may remain.
- Backups: encrypted historical backups may retain deleted data until the provider’s normal backup cycle expires. Backups are access-restricted and not restored to resume ordinary use of deleted content.
- Account and request data: kept while the account or request is active and then only as long as reasonably necessary for support, fraud prevention, legal claims, and applicable recordkeeping.
- Billing and legal acceptance: kept as required for tax, accounting, dispute, fraud, and contract evidence. Automatic-renewal consent is kept for at least three years, or one year after the agreement ends, whichever is longer.
- Rate limits and operational logs: kept for short operational or provider-defined periods unless needed for an active security investigation.
A deletion request may be limited where retention is needed to complete a transaction, protect security, comply with law, maintain a legal claim, or document consent. We will explain an applicable exception. Organizers should download desired photos before the displayed retention date.
10. Your choices and rights
Subject to identity, event connection, and applicable exceptions, you may request access, correction, deletion, a portable copy, restriction, withdrawal of consent, or review of a specific photo. You may also object to or opt out of processing where applicable, and appeal a denied request. We voluntarily offer this intake to all users even where a particular state-law threshold does not apply.
Use the privacy request form. Include the organizer email, event link, or photo reference needed to locate the record, but do not send a password or card number. We may ask for proportionate verification and will not use verification information for another purpose. We aim to respond within 45 days; where permitted, a complex request may require one extension with notice. Authorized agents must show authority, and we may verify directly with the person concerned. We do not discriminate for exercising a privacy right.
11. United States state disclosures
In the preceding 12 months, Threvu may have collected the categories described in Section 2 from users, organizers, devices, service providers, and event interactions; used them for Section 3 purposes; and disclosed them to the recipients in Section 6. We have not sold those categories or shared them for cross-context behavioral advertising. We do not use or disclose sensitive personal information to infer characteristics or for purposes requiring a right to limit under California law.
Residents of California and other states with applicable privacy laws may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale, targeted advertising, or certain profiling, limit certain sensitive-data uses, and appeal. Threvu does not conduct the sale, targeted advertising, or consequential automated profiling those opt-outs address. Submit any request or appeal through the privacy form.
12. Children
Threvu is not offered to children under 13. A person under 13 may not independently access or use the service. An adult may choose to show a child an adult-controlled event display without giving the child a guest session or collecting information from the child. Active participation is server-blocked until the guest affirms they are 18 or are 13–17 with parent or guardian permission. Organizers must not invite or direct children under 13 to access or participate. A parent or guardian who believes a child under 13 supplied information should submit an urgent deletion request. Photos that incidentally depict children may be uploaded only by an eligible user with all permission required by law and the circumstances.
13. Security
Threvu uses private object storage, temporary signed image links, restricted service-role operations, row-level database security, hashed guest and rate-limit identifiers, origin checks, rate limits, content conversion, webhook signatures, least-privilege access, and monitored operational errors. No system is risk-free. If we learn of a breach requiring notice, we will investigate, contain, and notify affected people and authorities as required by law.
14. International processing
Threvu is operated in the United States and its providers may process information in the United States and other countries. Those countries may have different privacy laws. Where applicable law requires a transfer mechanism or additional protection, we will rely on the provider’s contractual safeguards or another lawful mechanism.
15. Organizer obligations and third-party requests
Organizers determine who receives the event link and how the display is used. They must provide event-specific notice and handle their own independent use of downloaded photos lawfully. Threvu may notify an organizer of a removal request when needed to locate or evaluate content, but we will not disclose more requester information than necessary. An organizer cannot use Threvu to defeat a person’s applicable privacy, publicity, or copyright rights.
16. Changes to this Notice
We may update this Notice prospectively as the product, providers, or law changes. The version and effective date appear above. Material changes will be announced through the public site, organizer dashboard, or organizer email when reasonably available. We will seek new consent before a materially different use where law or our prior promise requires it.
17. Contact
Threvu is the public business name used by Zachary Smet in Wisconsin. Submit rights, privacy, photo-removal, or appeal requests through the secure privacy request form. For security or general support, use the contact form. Both provide a retainable reference. If a regulator requires a different contact channel, we will provide it after verifying the request.