Privacy + retention: how Momera protects guest memories

Every event has personal moments — honest reactions, awkward dancing, inside jokes. Event photos aren''t just data, they''re memories with emotional weight and sometimes sensitivity. Momera was built with privacy as a design principle, not an afterthought.

Default access model: participants-only

Momera event photos are only accessible to:

1. The host (you, who created the event)
2. Guests who scanned the QR (event participants)

Not public. Not search-engine indexed. Not shared by default to social media.

A guest who never scanned the QR can''t access the album. Even if they get the link, access is denied. This is technical enforcement — not just copywriting.

Row Level Security in the database

At the database layer (Postgres via Supabase), we use Row Level Security (RLS). This means: every photo query is filtered at the database level, not at the app level.

The consequence: even if there''s a bug in the app code, photos still can''t leak to another account. An attacker who steals guest A''s credentials still can''t see event B''s photos — RLS rejects the read at the database before any data leaves.

Photo retention

Free tier: photos are stored for 7 days after the event ends. Paid tiers (Mini, Standard, Plus, Max): photos are stored for 30 days after the event ends. Studio + Enterprise (B2B): 30 days standard, extendable on request.

After the retention window, photos auto-delete from Cloudflare R2 (storage) via a daily cron job. Not just flagged in the database — the physical files are removed.

Why retention is limited: it honors data minimization (UU PDP Indonesia). Event photos have a natural lifespan — guests usually download what they want within 1-2 weeks. After that, there''s no reason for us to keep them.

Host controls

Hosts have full control over their events:

• Hide a photo — if a photo is inappropriate (an awkward moment, a guest asking for takedown), the host can hide individual photos without permanently deleting them
• End the event — stop capture at any time before the retention window ends
• Download everything — ZIP export of every photo at full resolution for personal archives

Guest controls

Guests have several rights:

• Download their own photos — HD version, no watermark, clean
• Report someone else''s photo — if another guest posted something inappropriate, guests can flag it → it enters the moderator queue
• Right to be forgotten — email hello@momera.id, we delete the account + associated photos

Data we store (minimum)

• Guest name (for photo attribution — required)
• Avatar (optional — skip and it''s auto-generated from initials)
• Photos the guest took at that event
• IP hash (SHA-256, for anti-abuse rate limiting, retained 90 days)

What we don''t store:

• Passwords (bcrypt hashed, we can''t read them)
• Credit card data (Midtrans handles payment, we never see card details)
• Guest behavioral analytics outside the event (we don''t track browsing patterns)
• AI training on guest photos (your photos are not training data)

Compliance

• HTTPS on every request (enforced by the Vercel platform)
• Encryption at rest for the database (Supabase) + storage (Cloudflare R2)
• UU PDP Indonesia (2022) — privacy policy at momera.id/privacy; rights of access, correction, deletion, and portability are executed via hello@momera.id
• Vendor DPAs — every third-party vendor (Supabase, Cloudflare, Midtrans, Resend) holds a Data Processing Agreement + SOC 2 Type II

More detail

Full terms and privacy policy at momera.id/privacy and momera.id/terms. If you have a specific concern, email hello@momera.id directly.

Your guests'' memories stay theirs. Momera is just a temporary place to celebrate them together.