Privacy.

Your event stays your event.

Effective October 6, 2026. Version 2026-10-06.1.

This Notice explains how Zachary Smet, operating under the public business name Threvu in Wisconsin, handles personal information. It covers the public website, organizer accounts, private event links, guest participation, live displays, albums, venue pilots, support, billing, and privacy requests.

1. The short version

• Guests do not need an account and can join without giving an email.
• Each actively participating guest receives an event-scoped browser session and chooses one display name, which is locked for that event after joining.
• Optional ad measurement shares limited website and conversion activity with Meta and TikTok only after separate provider opt-ins. We do not send private event content, names or emails to advertising providers.
• Organizers and people with the private event link can see event content; approved content may appear on the venue display.
• Payment-card details are handled by Stripe, not stored by Threvu.
• New photos, visible image text, and comments may be screened by automated safety providers before publication; anyone shown in a photo may ask for human review or removal.

2. Information we collect

3. How we use information

• create accounts, events, guest sessions, QR access, feeds, displays, albums, and downloads;
• enforce the event’s recorded photo, contributor and free-offer eligibility limits;
• process, reconcile, refund, and defend payments and subscription entitlements;
• record consent and provide subscription cancellation and billing management;
• send requested album, event, security, billing, retention, and support communications;
• moderate content, investigate reports, prevent fraud and abuse, rate-limit requests, and protect the service;
• respond to pilot, support, privacy, rights, and legal requests;
• measure public-site performance and privacy-safe funnel activity; and
• comply with law, resolve disputes, and enforce agreements.

Depending on the relationship and applicable law, these uses rely on performing a contract, consent, legitimate interests in operating and protecting the service, and legal obligations. Consent may be withdrawn prospectively where consent is the basis, but withdrawal does not undo processing already lawfully completed.

4. Photos, metadata, and display

A selected photo enters a private quarantine area while it is validated and screened. The service rotates and converts permitted images to controlled WebP copies; this removes unnecessary EXIF and GPS metadata from published copies. The original quarantine object is not available to guests or the live display. It is deleted after successful publication, after a rejection-retention window, or after a limited human-review window as described below. We do not use face recognition, biometric templates, or automated identity matching.

Event photos and comments become visible to the organizer and people with event access only after the applicable automated or human decision permits publication. A separate organizer control governs the public venue display, and comments are off on that display by default. Approved photos may appear on a television or projector where people in the venue can see them. Threvu cannot control photographs, screenshots, downloads, or onward sharing performed by an organizer or guest after lawful access.

5. Automated moderation and human review

Threvu uses AWS Rekognition to identify safety-related image labels and extract visible text, and uses OpenAI's Moderation API to assess comments and extracted image text. Threvu applies a documented, versioned policy to provider labels and scores. Provider outputs are signals, not factual determinations, and automation can produce false positives and false negatives. It does not identify people or infer their real-world identity.

New content remains hidden when a provider is unavailable, a result is malformed or stale, a safety threshold requires review, or automatic publication is disabled. An authorized organizer may review ordinary quarantined content, but cannot approve content that the system marks as a restricted critical-safety category or content from a blocked participant through the ordinary control. Reviewers see only the information needed for the event and moderation task. A user may request human reconsideration or removal through the contact or privacy-request form.

AWS and OpenAI process submitted photo bytes or text as service providers for this purpose. Threvu sends no event name, participant email, Stripe identifier, or advertising profile with the moderation request. Before any private event content is sent to AWS, Threvu requires an effective AWS AI-services opt-out policy so the content is not used or stored for service improvement. OpenAI does not use API inputs to train its models by default, but its default abuse-monitoring logs may retain customer content for up to 30 days, or longer when legally required, unless approved reduced-retention controls apply. We keep minimized provider, policy, score, reason, timing, and reviewer records for security, audit, appeals, and policy quality; we do not authorize these providers to use private event content for advertising or to train general-purpose models.

6. Cookies and similar technology

A necessary event-setup cookie remembers the details you enter before signup for up to seven days. After signup or sign-in, the setup is tied to your account so you can continue after email confirmation. Temporary setup records expire after seven days. Threvu uses strictly necessary cookies for organizer authentication and an event-scoped guest-session cookie so a guest can keep their nickname, three-photo count, likes, comments, and album-email choice. A first-party campaign cookie keeps approved campaign labels for up to 30 days so we can understand which campaigns lead to purchases. It contains no name, email, event link or guest identifier. We also keep privacy-filtered funnel counts in our own database. Vercel Web Analytics, when enabled, receives only filtered public paths and coarse properties.

When ad measurement is enabled, you can allow or decline it in “Ad privacy choices” on the public site. After you allow it, Meta may receive public page visits, registration, checkout and verified purchase activity, purchase amount and currency, approved campaign labels, your browser user agent and an existing Meta browser or ad click identifier. Browser Pixel requests also expose your IP address to Meta as part of the connection. We do not add your IP address to server conversion payloads. The consent choice expires after 30 days. Global Privacy Control and Do Not Track disable Meta tracking. You can withdraw consent through the same control; withdrawal stops future sends and discards pending conversions. It cannot recall information already delivered to advertising providers.

7. When information is disclosed

• Event participants and organizers: event content, nicknames, reactions, comments, and related timestamps as part of the private event experience.
• Vercel: application hosting, delivery, security, logs, and privacy-filtered public-site analytics.
• Supabase: authentication, database, private image storage, signed image delivery, and related infrastructure.
• Stripe: checkout, payment processing, subscriptions, invoices, refunds, disputes, fraud prevention, and the customer billing portal.
• Meta: optional advertising measurement described in Section 6, only after your opt-in. Meta processes this activity under its own privacy policy and may use it for advertising attribution, delivery and measurement.
• TikTok: optional advertising measurement described in Section 8, only after a separate TikTok opt-in. TikTok may use consented conversion and browser connection data for advertising attribution, delivery and measurement.
• Resend: requested transactional and operational email when email delivery is enabled.
• AWS: private photo screening and visible-text extraction through Rekognition.
• OpenAI: safety classification of comments and visible text extracted from photos.
• Professional advisers and authorities: where reasonably necessary for legal advice, audits, insurance, safety, rights protection, valid process, or legal obligations.
• Business transfer: under confidentiality and continuity safeguards if Threvu is reorganized, financed, sold, or transferred.

Providers may use subcontractors and process information in the United States or other countries under their own security and legal commitments. We do not authorize service providers to use private event content for their own advertising.

8. Advertising choices and private event content

We do not sell personal information for money. Optional Meta and TikTok measurement can constitute sharing for advertising under some privacy laws; it is disabled until you separately allow it. Existing Meta consent does not grant permission to TikTok. TikTok server measurement shares only a consented ad click identifier, a random-looking conversion identifier, a fixed public funnel URL, an event time, and paid amount and currency. Its browser Pixel runs in an isolated empty document on selected public pages and shares browser network and device information. Your browser may include existing TikTok cookies in those connections; first-party TikTok cookies are disabled in the isolated document. Global Privacy Control and Do Not Track disable TikTok measurement. We do not send names, emails, phone numbers, guest sessions, payment identifiers, private paths or sensitive URL parameters to TikTok. Declining does not affect your ability to use Threvu. We do not disclose private event photos, comments, attendee emails, event names, couple names, private links or participant identifiers to advertising providers. Private event content is not used in advertising. A future marketing use of that content would require separate, specific, voluntary permission from the appropriate rights holder; account signup or ad-measurement consent is not that permission.

9. Email

A guest may opt in to receive the finished album for one specific event. That address is not silently added to a marketing list. Pilot contact consent covers only evaluating and coordinating the requested pilot. Organizer, album, billing, security, retention, and support messages are transactional. Marketing email is disabled unless a separate opt-in flow is introduced.

10. Retention and deletion

New Free events: collection and guest access last 30 days from opening, then the organizer has seven additional days to download accepted photos. Active-content cleanup becomes due afterward. An optional paid upgrade preserves collection dates and provides 90 days of gallery access after collection closes, followed by seven days for organizer download. Processing delays, payment reconciliation and safety or legal holds can delay cleanup. These prospective windows do not shorten existing paid or venue commitments.

Free-offer eligibility: we keep a restricted digest of a normalized organizer email and activation time to enforce the one-event and rolling 30-day limits, including after account deletion. This is pseudonymous information, not anonymous data. The eligibility record is eligible for daily cleanup after 30 days from its last activation (or creation if never activated), once no Free event is collecting or scheduled. It is not sent to advertising tools. Separate limited event, security and consent records follow the rules below.

• Other paid, promotion and venue event content: when an organizer ends an event, or when its scheduled or 12-hour live deadline ends it automatically, the active retention target is 90 days. The event is then scheduled for archival, followed by a seven-day restricted restoration window and deletion from active storage. One restoration may be available during that window and gives the organizer seven days to export.
• Moderation quarantine: a rejected photo is ordinarily removed from quarantine within 24 hours; a photo awaiting human review is ordinarily retained for no more than seven days unless an active report, appeal, legal hold, or critical-safety duty requires a different period. Permitted originals leave quarantine after safe derivatives are created.
• Moderation records: minimized content hashes, provider/model and policy versions, labels, scores, decisions, reviewer actions, timestamps, and incident evidence may be retained after media deletion for security, audit, abuse prevention, appeals, and legal obligations. Ordinary comments are not copied into audit records.
• Deleted event data: photos and derivatives, guest sessions, comments, likes, guest email data, and related event records are removed from active systems. A minimized event tombstone, security evidence, legal holds, and payment or audit records may remain.
• Backups: encrypted historical backups may retain deleted data until the provider’s normal backup cycle expires. Backups are access-restricted and not restored to resume ordinary use of deleted content.
• Account and request data: kept while the account or request is active and then only as long as reasonably necessary for support, fraud prevention, legal claims, and applicable recordkeeping.
• Billing and legal acceptance: kept as required for tax, accounting, dispute, fraud, and contract evidence. Automatic-renewal consent is kept for at least three years, or one year after the agreement ends, whichever is longer.
• Rate limits and operational logs: kept for short operational or provider-defined periods unless needed for an active security investigation.
• Advertising matching: consent and ad click matching expire after 30 days. Pending conversions are retried for less than 48 hours; matching fields are cleared after successful delivery, exhaustion or expiry. Revocation clears the consent’s matching fields. Campaign labels on purchases may remain with billing records.

A deletion request may be limited where retention is needed to complete a transaction, protect security, comply with law, maintain a legal claim, or document consent. We will explain an applicable exception. Organizers should download desired photos before the displayed retention date.

11. Your choices and rights

Subject to identity, event connection, and applicable exceptions, you may request access, correction, deletion, a portable copy, restriction, withdrawal of consent, or review of a specific photo. You may also object to or opt out of processing where applicable, and appeal a denied request. We voluntarily offer this intake to all users even where a particular state-law threshold does not apply.

Use the privacy request form. Include the organizer email, event link, or photo reference needed to locate the record, but do not send a password or card number. We may ask for proportionate verification and will not use verification information for another purpose. We aim to respond within 45 days; where permitted, a complex request may require one extension with notice. Authorized agents must show authority, and we may verify directly with the person concerned. We do not discriminate for exercising a privacy right.

12. United States state disclosures

The categories collected, purposes and recipients are described in Sections 2, 3 and 7. Optional sharing with Meta and TikTok is described in Sections 6 and 8. We do not use private event content for advertising or infer sensitive personal characteristics from it.

Residents of California and other states with applicable privacy laws may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale, targeted advertising, or certain profiling, limit certain sensitive-data uses, and appeal. Use “Ad privacy choices” to decline or withdraw Meta or TikTok measurement, or submit a request or appeal through the privacy form. We honor Global Privacy Control for this optional sharing.

13. Children

Threvu is not offered to children under 13. A person under 13 may not independently access or use the service. An adult may choose to show a child an adult-controlled event display without giving the child a guest session or collecting information from the child. Active participation is server-blocked until the guest affirms they are 18 or are 13–17 with parent or guardian permission. Organizers must not invite or direct children under 13 to access or participate. A parent or guardian who believes a child under 13 supplied information should submit an urgent deletion request. Photos that incidentally depict children may be uploaded only by an eligible user with all permission required by law and the circumstances.

14. Security

Threvu uses private object storage, temporary signed image links, restricted service-role operations, row-level database security, hashed guest and rate-limit identifiers, origin checks, rate limits, content conversion, webhook signatures, least-privilege access, and monitored operational errors. No system is risk-free. If we learn of a breach requiring notice, we will investigate, contain, and notify affected people and authorities as required by law.

15. International processing

Threvu is operated in the United States and its providers may process information in the United States and other countries. Those countries may have different privacy laws. Where applicable law requires a transfer mechanism or additional protection, we will rely on the provider’s contractual safeguards or another lawful mechanism.

16. Organizer obligations and third-party requests

Organizers determine who receives the event link and how the display is used. They must provide event-specific notice and handle their own independent use of downloaded photos lawfully. Threvu may notify an organizer of a removal request when needed to locate or evaluate content, but we will not disclose more requester information than necessary. An organizer cannot use Threvu to defeat a person’s applicable privacy, publicity, or copyright rights.

17. Changes to this Notice

We may update this Notice prospectively as the product, providers, or law changes. The version and effective date appear above. Material changes will be announced through the public site, organizer dashboard, or organizer email when reasonably available. We will seek new consent before a materially different use where law or our prior promise requires it.

18. Contact

Threvu is the public business name used by Zachary Smet in Wisconsin. Submit rights, privacy, photo-removal, or appeal requests through the secure privacy request form. For security or general support, use the contact form. Both provide a retainable reference. If a regulator requires a different contact channel, we will provide it after verifying the request.