weddingMost wedding photo sharing apps are private from strangers but not from forwarding: the album sits at an unlisted address anyone with the link or QR code can open. Below is private wedding photo sharing laid out plainly: who can see what, whether Google can list the album, what a phone photo gives away about where it was taken, other people's children, GDPR, and what delete removes. Checked against Google, Apple and each app's own pages on 27 September 2026, plus a 10-question audit you can run on any app, this one included.
Run the 10-question audit
Most wedding photo sharing apps are private in one specific way: the album lives at an unlisted address that only people holding the link or the QR code can open, and nothing is posted to a public feed. That is enough to keep strangers and search engines out when the app blocks them. It is not end-to-end encryption, and it does not stop a guest from forwarding the link.
So the real questions are practical ones. How does a guest get in, can Google list the page, can you hide the album from guests, does a photo carry its GPS location, who owns the files, and what does delete remove. The sections below answer each one with the source, and the audit near the end turns them into ten questions you can put to any app.
Four groups can end up near a wedding album. This map shows what each one can do on a Pix Wedding album, straight from how the product works. Most QR albums follow the same shape; the switches are what differ from app to app.
Every photo sharing option at a wedding uses one of three access models. Knowing which one you are using answers most privacy questions before you read a single policy.
Who sees it: Only people you invite by email or phone, each signed in to an account.
Example: A Google Photos album shared with named Google Account contacts.
The catch: Closest to locked. Also the model most guests abandon, because older relatives and guests without that account cannot join in 20 seconds at a reception table.
Who sees it: Anyone who holds the link or scans the code. No account, no password.
Example: Most wedding QR albums, a Google Photos link share, the new iCloud invite links.
The catch: Private from strangers, not from forwarding. If a guest drops the link in a public post, whoever reads the post can open the album.
Who sees it: Anyone on the platform, and often anyone on the web.
Example: An Instagram wedding hashtag or a public Facebook post.
The catch: Not private at all. Tagged faces, children and the venue are all out there, and a hashtag cannot be taken back once guests use it.
A QR code is only as private as the address it opens. On Pix Wedding there are three ways to hand out the same album, and they are not equally quiet. Guessing a random code is not the realistic risk; forwarding it is.
pix.wedding/u/emma-danielBuilt from your names, so anyone who knows them can try it. If two events share the same names, the link lists the matching albums (up to 10) instead of opening one. It is the link on the card you can download while creating the event.
pix.wedding/upload/event-3f9a1c7eEight random hexadecimal characters, 16 to the power of 8, which is over 4.29 billion possible codes. Nobody finds it by trying names or dates. Copy it from the dashboard.
Same random address, printedThe QR on your dashboard and on the QR poster templates points to the random address, so guests never type it. The realistic leak is a guest posting a photo of the sign where the code is readable.
Strangers finding the album by searching your names
Someone browsing a public list of albums (there is none)
Guessing: a random 8-character code has over 4.29 billion combinations
Accidental discovery through a social feed
A guest forwarding the link to a group chat you are not in
A screenshot of the QR sign posted to a public story
The app company itself, which can open files to make thumbnails
Anyone who gets a direct file address copied out of the album
HTTPS scrambles uploads on the way, so people on the venue Wi-Fi cannot read them.
Files are scrambled on the provider's disks. The provider still holds the keys.
Only the people sharing hold the keys. Almost no photo app offers it, because it has to open a photo to make a thumbnail.
At rest: Cloudflare says all objects stored in R2 are encrypted at rest. Pix Wedding stores guest photos on R2.
Only what each company states on its own help or FAQ pages, word for word where possible. Where a page is silent, the table says so. For features and prices rather than privacy, see our comparison of the best wedding photo sharing apps.
QR or link access to a random album address, search engines blocked, an upload-only switch and a hidden-until-reveal film roll. Not end-to-end encrypted, like every service in this table.
| Service | Who can open it | Search engines | Keep guests out of the album | What the company says |
|---|---|---|---|---|
Pix WeddingMost privacy switches | Anyone with the QR code or link to a random 8-character album address. No guest account. | Album and upload pages blocked in robots.txt and marked noindex | Guests can view off makes it upload only. Film roll hides every photo until the reveal date. | You keep ownership; license only to run the service; personal information not sold |
| Google Photos (link share) | Anyone with the link can view the photos and add to the album | Not stated in the sharing help page | You can share with named Google Account contacts instead of a link | New shares leave out photo locations by default; location data never shared with advertisers |
| iCloud Shared Albums (iOS 27) | People you invite, plus anyone you send an invite link to; they can contribute on the web without an Apple Account | Not stated in the upgrade page | You can allow participants to manage the album and invite others with a link | Full resolution sharing; old albums kept 6 months after an upgrade, then permanently deleted |
| GuestPix | Only people you share your QR code or private link with | Not indexed by search engines, per its FAQ | Restrict uploads, hide photos from other guests or close the gallery | Gallery completely private and not publicly discoverable |
| Kululu | Only you and those you share them with | Not stated | Moderation and photo deletion mentioned; hiding the album from guests not stated | We do not use, own, or interact with your photos in any way |
Swipe to compare
Checked 27 September 2026 on each company's own pages: Google Photos Help (sharing and location), Apple Support (Upgrade your shared albums), the GuestPix FAQ and the Kululu homepage FAQ. Pix Wedding facts come from our own product and published terms.
Sources: Google Photos sharing help, Google Photos location help, Apple Shared Albums upgrade, GuestPix FAQ, Kululu. Features and prices side by side: best wedding photo sharing app.
Plenty of apps say the album is not indexed. There are three different ways a site can keep a page out of search, and they are not equally strong.
A file on the site that asks crawlers to stay out of certain paths. Google says plainly that a page disallowed in robots.txt can still be indexed if linked to from other sites. The address can show up in results with no description.
A tag on the page itself that tells search engines to keep it out of results. Google points site owners to noindex or password protection, not robots.txt, for hiding a page. The crawler has to be able to load the page to see the tag.
A gate a crawler cannot pass at all. The strongest option, and the one guests trip over most at a reception, which is why most QR wedding albums skip it.
“A page that's disallowed in robots.txt can still be indexed if linked to from other sites.”
Google Search Central, Introduction to robots.txt
What this means for a wedding: the danger is a public link. Pix Wedding blocks album and upload pages for every crawler in robots.txt and also marks them noindex, so nothing on those pages is read or shown. But a crawler that is told not to load a page cannot see its noindex tag either, so if someone posts the album address on a public site, the bare address could still turn up in results without any photos or text. The fix is the same on every app: keep the link to the guest list.
Phone cameras often write the GPS position into the photo file. For a hotel ballroom that hardly matters. For a wedding in your own garden, the full-size files can point to your home. None of the wedding app pages we checked talk about this.
IMG_4821.JPGIllustrative example of the hidden data in a phone photo. Coordinates masked, not taken from a real guest file.
In the share sheet, tap Options and turn off Location. Apple's personal safety guide says the sheet then shows Location Not Included above the Options button. The switch applies to what you send in that share.
Source: Apple personal safety guideGoogle says new albums, links and conversations you share do not include location details by default, and you can switch Share photo locations on per album. Its own warning: people may still guess the place from landmarks in the photo.
Source: Google Photos HelpPix stores each guest's original file untouched so quality is not lost. If a guest's camera saved a location in a JPEG, the full-size download still has it. iPhone HEIC photos are converted to JPEG for browsers and lose their metadata in that step, and the gallery thumbnails carry no metadata.
Source: Pix Wedding privacy policyMax Dalton shows how to take the location off one photo on an iPhone or iPad in 75 seconds. Useful for the handful of shots from a home or private venue you want to send on without the address.
Video: Max Dalton on YouTube (1:15, uploaded 15 July 2025).
A wedding album is full of people who never signed up for anything: flower girls, your cousin's toddler, the friend who hates being photographed. A private album shared with the guest list is the easy case. The hard part is what leaves it.
Ask the parents firstPrivate album only, or fine to post? Put it on the wedding website and the welcome sign so parents are not guessing.
If a friend's child is in a lot of shots, ask the parent before any of them leave the private album. Many parents keep their kids off public feeds on purpose.
A link shared with the people who were there is a very different thing from a post any stranger can open.
When you pick favourites for a public post or a printed book, drop the ones with other people's children unless you have asked.
Usually inside the household exemption for the couple.
Outside it, per the EU Court of Justice in Lindqvist.
Never covered by the exemption.
GDPR Article 2(2)(c) says the regulation does not apply to processing by a natural person in the course of a purely personal or household activity. Recital 18 adds that this means activity with no connection to a professional or commercial activity, and that it can include social networking and online activity in that context. A couple collecting guests' photos into an album for the people who were there generally sits inside that.
Publishing is different. In the Lindqvist case (C-101/01, 2003) the EU Court of Justice held that the exemption does not cover publication on the internet so that the data are made accessible to an indefinite number of people. The app company is never covered by the household exemption either, which is why its privacy policy and processors matter. General information only, not legal advice for your wedding.
For the words to use with guests, our guide on how to ask wedding guests not to post on social media has sign wording and scripts. This page stays on what the app does with the photos.
You do not need to read every word. Search the terms and the privacy policy for these six things. If a promise is only on the homepage and not in the documents, treat it as marketing.
What our own documents say: the Pix Wedding terms state that users retain full ownership of the content they upload and grant a license solely for the purpose of providing the service. The privacy policy says we do not sell your personal information and names the providers involved, with Cloudflare storing the photos and videos. It also lists the advertising and analytics tools on our marketing site, so you can see the whole picture.
Removing an app from your phone does nothing to the copies on the company's servers. Ask two questions: how long are files kept if you do nothing, and what exactly goes when you press delete. Apple is a useful example of a clear answer: after you upgrade an old shared album, a copy stays in Shared Albums settings for six months and is then permanently deleted.
3 months of uploads
Storage counted from the day the event is created
6 months of uploads
Storage counted from the day the event is created
1 year of uploads
Storage counted from the day the event is created
The couple can delete single photos or many at once from the dashboard. The original and its thumbnail are removed from storage.
The private photographer upload link (Standard and Pro) can be switched off, so the old link stops working.
Before the storage window ends, Pix emails the owner so there is time to download the ZIP of everything.
Originals, thumbnails, audio guestbook messages, the cover and the logo are deleted from storage, along with the photo records.
Apple example: Upgrade your shared albums. Pix Wedding windows and deletion steps: privacy policy, section on retention.
Put these to the app's help pages, terms and support chat before the invitations go out. A good app answers all ten in writing.
Account, link, QR or password. This single answer tells you which of the three access models you are buying.
A long random code is fine. A link built from your names or date is easy to guess.
Look for a noindex tag or a login wall, not just a promise.
An upload-only mode matters if you expect a few photos you would rather see first.
If a link leaks to a public post, you want one switch, not a support ticket.
Ask whether originals keep their metadata and whether any location is shown to other guests.
You should keep ownership; the license should stop at running the service.
Find the sentence in the privacy policy. If it is not written down, it is not promised.
A stated window with a reminder email beats indefinite storage you forget about.
Hiding an album and wiping the files from storage are two different things.
Straight from how the product works today, weak spots included. First, what a guest's phone shows in the three states that matter for privacy. Example names, real screens redrawn.
The QR code points to pix.wedding/upload/ followed by a random 8-character code, over 4.29 billion possibilities. No guest account, no password.
The card you can download while creating the event carries a short link built from your names. Two couples with the same names share it and it lists both albums, so it is easier to guess. For a quiet album, print the QR from the dashboard or a QR poster template, which use the random address.
Album and upload pages are blocked for Googlebot, Googlebot-Image, Bingbot and every other crawler in robots.txt, and the pages carry a noindex tag. The short link page is noindex too.
Guests can view is on by default. Switch it off and guests can only upload; a guest who opens the album sees an empty page that says No memories yet. Film roll mode (paid plans) hides every photo from guests until your reveal date.
Guests can download is a separate switch. Off means no guest downloads, while you still get the full ZIP on a paid plan.
The site runs on HTTPS and files sit on Cloudflare R2, which encrypts all objects at rest. There is no end-to-end encryption: the service opens files to build thumbnails and slideshows.
Each photo file sits at a long address with a 16-character random part. Anyone handed that exact file address can open that one file, the same as a shared link.
Off unless the couple turns it on (Pro). A guest's selfie is processed in memory and not stored, face data stays in a collection for that one event, and it is deleted when the feature is turned off or the event is deleted.
The terms say you keep full ownership and grant a license only to provide the service. The privacy policy says personal information is not sold.
Only the event creator can delete it. That takes the album offline for guests and removes face data, but it does not wipe the files on its own. Delete the photos first, or email [email protected] for full deletion.
Want to see the guest side before you decide? The Pix Wedding photo sharing page walks through the QR album from scan to download.
Whatever app you pick, these steps cover the realistic leaks. The phone shows the Pix Wedding switches set for the tightest version: upload only, no guest downloads, hidden until the reveal.
Use the QR from the dashboard or a QR poster template; both point to the random 8-character address. The card offered while you create the event carries the short name link instead.
Leave Guests can view on for a shared album, or switch it off so guests only upload and you see everything first.
On a paid plan, film roll hides the whole album until a date you choose, so nothing circulates on the night.
One line on the sign: photos stay in the album, please ask before posting. It is the forwarding, not the hacking, that leaks albums.
If the wedding is at your home, ask guests to share with Location turned off, or plan to strip location before any photo leaves the album.
Keep your own copy on a drive you control, well before the storage window closes.
Delete stray or unflattering shots from the dashboard; that removes them from storage, not just from view.
Watch a guest scan the QR code and add photos from the browser in under 30 seconds. No app and no account, and the album stays off search engines. You choose whether guests can browse it or only upload.
PRIVATE ALBUM
Example album
Just us
Guest list only
One QR code to a random album address, blocked from search engines. Keep it shared, make it upload only, or hide it until a reveal date. Start with 20 uploads free, no card required.
From Grandma
Scan to join the album
No app, no account
UPLOADING
THE ALBUM
Private album
647 photos · 95 guests
SCAN TO TRY
pix.wedding/
your-wedding
An address that is not published anywhere, so only people who are given it can open the page.
An album that asks every viewer to sign in with an invited account before it opens.
The connection is scrambled (HTTPS), so people on the same Wi-Fi cannot read the photos on the way.
The stored files are scrambled on the provider's disks. The provider still holds the keys.
Only the people sharing hold the keys; the company cannot open the files. Rare in photo sharing apps.
A request to crawlers not to fetch certain pages. It does not stop an address from being listed if linked elsewhere.
A tag that tells search engines to keep a page out of search results.
Hidden data inside a photo file: camera, time, and often the GPS location it was taken at.
The GDPR rule that purely personal or household activity is outside the regulation.
How long a service keeps your files before deleting them.
This page covers what the app does with your photos. Guest etiquette, app features and prices, and the QR sign itself each have their own guide.
For most weddings, yes, if you check five things:
The word gets used for an unlisted link, an account-only album, encrypted storage and a promise not to sell data, often all at once. Those are four separate protections. A wedding album can have the first and the last without the others, and that is fine as long as you know it.
The biggest real-world leak is still a guest reposting the link or a screenshot. A clear line on the QR sign and an upload-only album do more for privacy than any setting a guest never sees.
Everything you need to make your wedding day stress-free and unforgettable.
Design custom print-ready stickers.
Create unique wedding hashtags.
5 methods ranked by participation rate and ease.
Compare every sharing platform by ease and participation.
The single method with the highest participation rate.
Step-by-step setup for every platform.
Better, cheaper options than disposable cameras.
5 cheaper alternatives to a $1,000+ photo booth rental.
One payment per wedding, no subscription. The privacy switches (guest view, guest download) are on every plan, including the free tier with 20 uploads. What changes is film roll, the photographer link, face search and how long the files are kept.
For collecting every original
For the photographer link and slideshow
One-time payment, no subscription
For big guest lists
One payment. Yours to keep. No subscription. No renewals. No surprise charges.
Secure checkout. Polar, Apple Pay, Google Pay.
Money-back guarantee: if your guests never upload a single photo, you get 100% back. See how it works
Short answers with the source behind each one.
Most are private in one specific sense: the album sits at an unlisted address that only people with the link or QR code can open, and it is not posted to a public feed. That keeps strangers out, but it is not end-to-end encryption, and anyone a guest forwards the link to can open it too. Check how guests get in, whether search engines are blocked, and what the terms say about your photos.
A good one is safe for a wedding if it passes a few checks: guests get in with a long random link or QR code rather than a guessable name link, album pages are kept out of search engines with noindex or a login, you can make the album upload only or hide it until a reveal, the terms leave ownership with you, and there is a stated storage window with a real delete. The biggest real risk on any app is a guest reposting the link, so pair the settings with a clear line on the sign.
On most QR albums, yes, unless you change it. On Pix Wedding, Guests can view is on by default, so every guest with the link can browse the album. Switch it off and guests can only upload, and a guest who opens the album sees it empty. Film roll mode on paid plans hides every photo from guests until your reveal date, while the couple always sees everything.
Only if the app lets it. Google says a page blocked in robots.txt can still be indexed if other sites link to it, and it recommends noindex or password protection for keeping a page out of results. Pix Wedding blocks album and upload pages in robots.txt and marks them noindex. Whatever app you use, never post the album link publicly.
A QR code is only as private as the address inside it. A QR that points to a long random address cannot be found by guessing; a QR that points to a link built from your names can. The realistic leak is a guest posting a photo of the sign with the code readable. On Pix Wedding, the dashboard QR and the QR poster templates use the random 8-character address, while the card offered during event creation uses the short name link.
They can. Phone cameras often save GPS location inside the photo file. On iPhone you can tap Options in the share sheet and turn off Location before sending. Google Photos leaves location out of new shares by default. Pix Wedding keeps originals as uploaded, so a JPEG with location keeps it in the full-size download; converted iPhone HEIC photos and all thumbnails do not carry metadata.
No. A private or unlisted link controls who can find the album. Encryption controls who can read the data. Pix Wedding uses HTTPS in transit, and its storage provider Cloudflare R2 encrypts all objects at rest, but like most photo sharing apps it is not end-to-end encrypted, because the service has to open files to make thumbnails and slideshows.
For the couple, usually not. GDPR Article 2(2)(c) excludes processing by a person in the course of a purely personal or household activity, and Recital 18 includes online activity in that context. The EU Court of Justice held in the Lindqvist case that publishing personal data on the internet to an indefinite number of people falls outside that exemption, so a private album for your guest list and a public post are treated very differently. The app company itself is still covered. This is general information, not legal advice.
Pix Wedding albums open only with the couple's QR code or link to a random 8-character address, need no guest account, and are blocked from search engines with robots.txt and noindex. The couple can make the album upload only, hide it until a reveal date with film roll mode, turn off guest downloads, and delete photos from storage. You keep ownership of your photos and the privacy policy says personal information is not sold. Storage lasts 6, 12 or 24 months from event creation depending on the plan, with a warning email before deletion.
Deleting an app from your phone does nothing to the files on the company's servers. On Pix Wedding, deleting a photo removes the original and thumbnail from storage; deleting the event takes the album offline but does not wipe the files by itself, so delete the photos first or email [email protected]. At the end of the storage window Pix warns you by email 14 days ahead, then deletes originals, thumbnails, audio and cover images.
