What HM Camera is
HM Camera is an event photo app used by event operators to capture, brand, and deliver media to their guests. This policy covers the HM Camera app and the go.hmcamera.com guest services.
What we collect, and why
Operator email address: received during account sign-in and used to identify and support the operator's HM Camera account.
Apple user ID: Sign in with Apple provides a stable identifier so the same Apple ID returns to the same HM Camera account. We do not use it for advertising or tracking.
Guest name: shown on your private gallery, queue, and confirmation pages to label your photos, and visible to the event's operator and crew inside the app so they can run the event, find your registration, and include you in that event's guest list and reports.
Guest email address: used to send you your photos and your place in line. Your address is stored with your registration both on the operator's device and in HM Camera's event database, so that whichever device the operator is holding when your photo is ready can actually deliver it to you. It is passed to an email delivery service (HM Camera's own, or the operator's provider) to make that delivery. It is also visible to the event's operator and crew inside the app, so they can find or correct your registration, and it is included if they export that event's guest list. Deleting a guest erases the stored address along with their photos. Addresses that permanently fail or opt out are kept on a do-not-send list so we never email them again. We never sell it or use it ourselves for marketing or advertising.
Photos: the media captured of you at the event, stored so your private gallery link works.
Automated photo screening: every photo uploaded to HM Camera is checked once, right after upload, by an automated image model running on Cloudflare Workers AI for content our content policy prohibits, before it can be emailed. The check writes only a status on the photo record. A photo the check flags is not delivered. If the check itself cannot run, the photo waits and the event operator can release it. Nothing from the check is used for advertising or shared with anyone else.
Purchase history: when an operator buys an email top-up pack, we store Apple's transaction identifier, original transaction identifier, product, purchase date, and status with the operator's account. We use this only to grant the emails once, recover an unfinished purchase, and handle refunds.
QR scan counts: when event QR codes are scanned we record the time, approximate country, and browser type to show operators how their signage performs. No precise location, no identity.
Support chat messages: if you ask a question in the support chat, either the widget on this site or the Help screen inside the HM Camera app, your message and the conversation so far are sent to our Cloudflare Worker to generate a reply. When our AI assistant is enabled, that text is sent to Anthropic, which processes it only to generate the reply on our behalf and does not use it to train its models. Nothing else is sent: not your name, your email address, your account, or your photos. If the assistant is not enabled, your question is matched against a fixed list of FAQ answers and is not sent anywhere external. Chat messages are used only to answer your question and are never used for advertising.
What we don't do
No advertising. No cross-app tracking. No selling or renting data. Gallery pages are unlisted, excluded from search engines, and reachable only by their unique code.
Where data lives
Account records, galleries, guest registration details, purchase records, and media are hosted on Cloudflare infrastructure. Transactional email is delivered through Resend or the event operator's configured email provider. Photo screening runs on Cloudflare Workers AI, and support chat replies are generated by Anthropic when the assistant is enabled. These providers process data only to operate HM Camera's storage, delivery, screening, support, and account features.
Retention and deletion
Guest registration details and media are kept while the event operator needs the event and its private galleries. Event operators can delete a guest, which removes that guest's event record and stored media. Guests may request deletion from their event operator or contact us directly.
Operators can request account deletion inside the app at the menu (☰) › Account & Privacy › Danger Zone › Delete Account. This starts permanent deletion of the cloud account and its account-linked events, guests, stored media, and sign-in identity. A failed deletion leaves the operator signed in so it can be retried instead of reporting success prematurely.
Purchase and refund records are financial history: we retain them, disconnected from your other account details, to meet tax and financial recordkeeping obligations that survive account deletion.
Email addresses that bounced, complained, or opted out remain on a do-not-send list so HM Camera continues honoring that choice and protects the shared sending service. QR scan records contain no scanner identity. Rate-limit records that protect sign-in, event joins, gallery recovery, and support chat from abuse hold a network address or email address for up to 48 hours and are then discarded. We may retain records when required for security, fraud prevention, dispute handling, or legal compliance.
Contact
support@hmcamera.com