Skip to content
GALEIRA

Trust.

Hosts hand us photos of the most personal moments in their lives. That demands a clear answer to: what happens to those photos, who can see them, and what happens if you disappear? This page is that answer.

Where data lives

  • Photos / videos / audio: Cloudflare R2, encrypted at rest, EU residency available on request.
  • Account & event metadata: Self-hosted PostgreSQL in Germany (EU).
  • If you enable cloud mirror: approved uploads can be copied to the cloud destinations available for your event. Your plan and saved purchase terms determine the allowance. Review copied, pending and failed items in your backup status; a connection alone is not a completed copy.
  • App server: Hetzner CAX11 in Germany.
  • Analytics (consent-gated): PostHog in EU (eu-central-1).
  • Error monitoring (consent-gated): Sentry in US under SCCs + DPA. Strict PII scrubbing.

Full named-processor list with region + transfer mechanism lives in the privacy policy.

Security posture

  • TLS everywhere, HSTS preloaded, strict transport upgrade.
  • Sessions: Lucia v3 sessions, HttpOnly + SameSite=Lax cookies, automatic refresh.
  • CSP: Content-Security-Policy enforcing, with a curated allowlist scoped to first-party plus a small set of audited third parties (PostHog, Sentry, Stripe, Pusher, R2, Cloudflare Insights). Observed in report-only mode prior to enforcement.
  • Secrets: never in code or git history; live in the server's .env.local + GitHub Actions secrets.
  • Backups: Self-hosted PostgreSQL backups follow Galeira's current retention policy. Git pushes preserve the code; Cloudflare R2 stores uploaded media with encryption at rest.
  • Rate limiting: Upstash Redis sliding-window on magic links, NPS, beta redemption, abuse reports.
  • Automated moderation: Eligible events with automated moderation enabled can scan photos using AWS Rekognition. Videos and other unsupported media are not automatically scanned; hosts can review contributions manually.
  • Vulnerability disclosure: RFC 9116 security.txt, full VDP with safe-harbour at /security.

What we won't do with your data

  • Sell it.
  • Use your photos, voices, or face vectors to train AI — ours or anyone else's.
  • Share it with advertisers or data brokers.
  • Run cross-event face matching (your guests at one event are not matched against guests at any other event, ever).
  • Lock you in. Cloud mirror means your photos are already in a cloud you own; downloading the full archive as a ZIP is one click from your dashboard.

Compliance

Region-specific addenda at /legal/regions covering:

EU GDPR · UK GDPR · CCPA / CPRA · Virginia VCDPA · Colorado CPA · Connecticut CTDPA · Utah UCPA · Texas TDPSA · Brazil LGPD · Canada PIPEDA + Quebec Law 25 · Australia Privacy Act 1988 · India DPDP 2023 · Japan APPI + South Korea PIPA.

Data-subject requests (access, deletion, correction, portability, opt-out): email privacy@galeira.com — answered within 30 days, free of charge.

What happens if Galeira shuts down

Every company eventually ends. Here's the shutdown commitment we state in our Terms:

  • 90 days notice by email to every host before any service shutdown.
  • Forever-tier events: a final mirror to the connected cloud before we shut down hosted storage.
  • Wedding-tier events: a bulk-download link for the full archive window remaining.
  • Free-tier events: a 60-day download window.
  • Connected cloud copies stay yours because they live in the host-owned cloud account, outside Galeira.

Reporting issues