Privacy Policy

TableCam (“we”, “us”) is operated by Brady Bauck, an individual resident in Minnesota, USA. This policy explains what we collect when you use tablecam.baubra.com, why, and what control you have over it. It sits alongside our Terms of Service.

• Your email address, used to sign you in and to contact you about your events.
• Your name and profile picture, only if you choose to sign in with Google.
• Event settings you create: event name, dates, guest and photo limits, colours, header image and the instructions shown to guests.
• Your Google connection, which hosting an event requires: the Google account’s email address and identifier, and an encrypted token that lets us add photographs to your library. Signing in and connecting are the same step, and photographs go straight to your library, so there is no way to host without one.

Guests never create an account and are never asked for an email address, phone number or password. When someone scans an event code we create an anonymous session so their device can be recognised across page loads, and we store:

• a display name, only if they choose to type one — it may be left blank;
• a record of each photograph they send — not the image itself, which goes straight to the host’s Google Photos and is never stored here;
• basic photo details: when the shutter was pressed, image dimensions and file size, and how many photographs they have taken against their limit.

Photographs are taken through the browser camera and re-encoded before upload. That process removes EXIF metadata, so GPS coordinates, device identifiers and camera settings are not collected or stored.

Photographs are held in the guest’s own browser storage on their own device until they choose to send them, and afterwards while they are waiting for a connection, so a poor signal does not lose anything. A guest can delete any photograph they have not sent. Once one has been sent and confirmed, the browser clears its copy shortly afterwards. None of this reaches us unless it is sent.

Signing in to TableCam is connecting a Google account: there is one consent screen and it does both. We do not operate a separate password login, so a host cannot use TableCam without granting these permissions. We request only these:

We cannot browse, search, download or delete the photographs already in your Google Photos library. The permissions above do not allow it.

TableCam’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for advertising, do not sell it, do not transfer it to third parties except as needed to provide the service or where required by law, and do not use it to train machine learning or artificial intelligence models. Human access is limited to what is necessary for security, to fix a fault, or where you have asked us for support.

• Your Google refresh token is encrypted with AES-256-GCM before it is written to the database. The key is held outside the database, in the server’s configuration, so a copy of the database file alone does not grant access to anyone’s Google account. It is not held on separate hardware: an attacker with the whole machine has both.
• Because photographs are never stored here, there is no store of them to breach. Each one is fetched from the host’s Google Photos for the individual request that displays it, and every one of those requests is authorised first. We never hand a viewer a Google link. Anyone holding the separate slideshow link for an event can view that event’s photographs without signing in, which is what lets a projector display them; treat that link as private and turn the slideshow off to revoke it.
• Every request for a photograph is checked against the event it belongs to, so a guest can only ever reach their own photographs and — once the host releases the album — that event’s photographs.
• All traffic is served over HTTPS.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your data we will notify you promptly.

We use a small number of providers to run the service:

• Our own hardware — the database, and header images hosts upload, are held on equipment we operate ourselves in the United States, not on a third-party cloud host. Guests’ photographs are not among them.
• Google — sign-in, and storing every photograph in the host’s own library. Because we keep no copy, this is not an optional integration: it is where the photographs live.
• Cloudflare — network and delivery.

We do not sell personal information, and we run no advertising networks, tracking pixels or third-party analytics on this site.

• Photographs are never stored by TableCam. Each one is forwarded to the host’s Google Photos library as it is taken; the bytes pass through our server’s memory on the way and are not written to disk. The host’s library holds the only copy, and the album shows each photograph from there. A photograph that cannot reach Google Photos is not stored either — it stays on the guest’s own phone, and their browser sends it again when it can.
• Diagnostic records are written when a photograph fails to upload: the time, the event code, an internal guest reference, the error, and the browser’s user-agent string. They exist so a failure that loses somebody’s photograph can be found and fixed, they are not used to identify anyone, and they are deleted when they are no longer needed for that purpose.
• Deleting an event removes its records and its header image immediately, and from our backups on the next backup run. There are no photograph files to remove, because none were kept. The photographs themselves remain in the host’s Google Photos until the host removes them there.
• Your Google token is deleted as soon as you disconnect the account, and we ask Google to revoke it at the same time.
• Host accounts are kept until you delete them, which you can do yourself from the dashboard at any time. Deleting an account removes its events, guest records and uploaded header images, and revokes our access to your Google account. Photographs already in your Google Photos are yours and stay there.
• Guest records — the name a guest typed, if any, and how many photographs they took — are deleted with the event they belong to.
• Diagnostic and operational logs are kept for up to 90 days and then deleted.
• Backups are taken every two hours and kept for about four days. Deleting an event or an account removes the data from the live service immediately; copies inside existing backups age out within that window rather than being erased from each backup individually. We do not restore a backup to recover something you asked us to delete.

Photographs already copied into a host’s Google Photos library, downloaded, or shared elsewhere are outside our control. Deleting them from TableCam does not remove those copies — they must be removed where they now live.

Why we are allowed to hold this. For hosts, because we need it to provide the service you asked for — a contract. For guests, because a host has invited you to an event and running that event is our legitimate interest and theirs; you are told before your first photograph and can stop at any time. We do not rely on consent for anything except your Google connection, which you can withdraw whenever you like.

Depending on where you live you may have rights to access, correct, export or delete the personal information we hold, to object to or restrict how we use it, and to withdraw consent. We honour these requests regardless of where you live, and we do not charge for them or treat you differently for making one.

Write to us and we will respond within 30 days. If we need to be sure who you are, we will ask for something that ties you to the event in question — the join code and roughly when you were there is usually enough — and we will not ask for more identification than the request needs. You may ask an authorised agent to act for you. If you are unhappy with our answer you can complain to your data protection authority; in the UK that is the ICO, and in the EU it is the authority where you live.

• Hosts can delete events and photographs from the dashboard, and disconnect Google at any time. You can also revoke our access from your Google account security settings.
• Guests who want a photograph of them removed should ask the event host, who can remove it directly. If you cannot reach them, contact us at [email protected] and we will help.

For anything else, write to [email protected]. We will respond within a reasonable period, and within any timeframe the law requires.

We use cookies only to keep you signed in. There is no advertising, no analytics and no third-party tracker on this site, so there is no cookie banner to dismiss.

• tc_host — identifies a signed-in host. Set when you sign in, lasts 60 days, and is invalidated when you sign out.
• tc_guest_… — identifies a guest to one event, so their own photographs come back to them and their allowance is theirs. One per event, lasting 7 days.
• tc_oauth — a one-time value that ties a Google sign-in to the browser that started it. Deleted as soon as the sign-in finishes.

All three are strictly necessary to operate the service, are marked HttpOnly so scripts cannot read them, and are sent only over HTTPS. Clearing your browser’s site data removes them and signs you out.

Hosts must be 18. Guests must be at least 13, and the camera page says so before the first photograph. We do not knowingly collect anything from a child under 13, and because guests never create accounts we have no reliable way to detect one — which is exactly why the responsibility sits with the host who invited them.

Children may of course appear in photographs taken at an event without using the service themselves. The host is responsible for obtaining whatever consent is required from a parent or guardian before photographing a child, and for not inviting children under 13 to shoot. A host can remove any individual photograph from their dashboard.

If you believe we hold information about a child that should be removed, contact us at[email protected] and we will delete it.

TableCam is operated from, and its data is held in, the United States. If you use it from elsewhere your information is transferred there, to a country whose data protection laws differ from your own and which has not been found adequate by the UK or the EU.

For transfers out of the UK or the EEA we rely on the UK International Data Transfer Addendum and the European Commission’s Standard Contractual Clauses, which we will provide on request. Google Photos is the one place your photographs travel beyond us, and that transfer happens because you connected your own Google account and under Google’s terms with you, not ours.

In the twelve months before the date at the top of this page we collected these categories of personal information: identifiers (a host’s name, email address and Google account id; a guest’s chosen display name); internet activity (a diagnostic record when a photograph fails to upload, including the browser’s user-agent string); and visual information (the photographs themselves). We collect them to run events, and we keep them for the periods in section 7.

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CPRA. We have never done so, including in the previous twelve months, and we do not sell or share the personal information of anyone under 16.

Photographs can reveal characteristics that California treats as sensitive. We do not use or disclose them to infer anything about anyone, and we use them only to run the event they were taken at, which is a permitted purpose under the CPRA.

You may request to know, delete or correct your personal information, and you may authorise an agent to do it for you. Write to us using the address in section 13. We do not discriminate against anyone for exercising these rights.

We may update this policy. The date at the top of this page always reflects the current version, and for material changes we will make reasonable efforts to notify hosts directly.

Questions about privacy, or a request about your data, can be sent to [email protected].