Privacy Policy

Last updated: 23 July 2026

1. Who this covers

This policy explains how Spotlyt ("we", "us") handles personal information when you use spotlyt.app — browsing a gallery, using face search, or contacting us. We operate under the New Zealand Privacy Act 2020.

2. What we collect (and what we don't)

• Gallery browsing:your favourites, view settings, and scroll position are stored in your own browser (localStorage) and never leave your device. We can't see them.
• Access codes:kept in your browser for the session so you don't have to retype them. Our servers verify codes against a hash — the site itself never stores the plaintext.
• Face search selfies: processed transiently — see section 3. Never written to disk, never stored.
• Server logs: our hosting and API keep standard, short-lived technical logs (IP address, timestamp, request path) for security and abuse prevention.
• Contact:if you email us, we'll have your email and whatever you send. We use it to reply, not to build a marketing list.
• What we don't do: no advertising trackers, no analytics cookies, no selling or renting data. Ever.

3. Face search & biometric data

Face search is the most sensitive thing we do, so here is exactly how it works:

• When you upload a selfie, it is sent over an encrypted connection to our matching service, converted in memory into a numerical face signature (an "embedding"), compared against the gallery index, and then discarded. Your selfie is never stored, and neither is the embedding derived from it.
• To make matching possible, we pre-compute face embeddings for the event's photos, on behalf of the event organiser. These embeddings are numerical vectors — not images — and are used only to answer "which photos is this person in?" within that event.
• Event face indexes are deleted when the gallery is taken down, or earlier at the organiser's request.
• The matching service runs in a sandboxed environment with no access to the original images, which stay on the photographer's CDN.

4. Photos in galleries

Gallery photos are taken by the event's photographer and published at the event organiser's direction. Spotlyt serves them from the photographer's existing CDN — we host a small metadata manifest, not the images. If you appear in a photo and want it removed, email privacy@spotlyt.appwith a link to the photo and we'll remove it from the gallery promptly.

5. Where your data goes

• Hosting: the website is served by Vercel; requests pass through their infrastructure like any modern website.
• Face matching: runs on infrastructure we control, not a third-party face-recognition API.
• Nobody else.We don't share personal information with third parties except where required by law.

6. Retention

• Selfies and their embeddings: not retained at all.
• Event face indexes: for the life of the gallery, then deleted.
• Technical logs: short-term, rotated automatically.
• Email correspondence: as long as needed to help you.

7. Your rights

Under the Privacy Act 2020 (and similar laws elsewhere), you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Given how little we keep, these are usually very short conversations — but we take them seriously. Email privacy@spotlyt.app. If you're not happy with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

8. Children

Galleries often cover school events, so we hold everything to the same standard regardless of age: no stored selfies, no profiles, no tracking. Photo-removal requests from students, parents, or schools are actioned with priority.

9. Changes to this policy

If we change how we handle personal information, we'll update this page and the date at the top. We will never quietly downgrade the "selfies are never stored" promise — if that ever changed, we'd ask for consent first, loudly.

10. Contact

Privacy questions or requests: privacy@spotlyt.app.