Privacy policy
Last updated 13 October 2026
The short version. Your photos are for the people in your story, and nobody else. We don't sell anything about you, we don't show ads, we don't use your photos to train AI, and there are no trackers on our pages. Everything is stored in the European Union. You can delete your account, and everything you added, from Home.
Who looks after your data
Afterwards is run by Stqn Technology SRL, a Belgian company (enterprise number BE 1035.377.208). We're the data controller for everything described here. For any question about your data, write to [email protected].
What we keep, why, and for how long
| What | Why | Legal basis | Kept until |
|---|---|---|---|
| Your name and email address | Your account, signing in, and the emails a story sends (a reveal, an invite) | Our agreement with you | You delete your account |
| Sign-in codes | Signing in without a password. We keep a scrambled copy, never the code itself. | Our agreement with you | 10 minutes, or the next code |
| Photos and videos, with when and where they were taken | Showing them to the people in the story, in order, grouped into moments | Our agreement with you | You remove them, the story is deleted, or you delete your account |
| Notes, stickers and voice notes | The same: they belong to the story | Our agreement with you | The same |
| Requests to remove a photo, and photos you hid | So the photographer can decide, and hidden photos stay hidden for you | Our agreement with you | The photo or your account goes |
| Reports you make, and people you block | Looking at what was reported and telling both people what we decided; leaving out what blocked people add, for you | A legal obligation for reports (the EU Digital Services Act); our agreement with you for blocks | Reports: 2 years after the decision. Blocks: you unblock, or either account is deleted |
| Signed-in devices: IP address and browser or app version | Keeping you signed in, and spotting someone else using your account | Our legitimate interest in keeping accounts safe | You sign out on that device, or delete your account |
| Notification token (the iPhone, iPad and Android app) | Telling you when photos are revealed or someone joins | Your consent, given on your phone or tablet when the app asks | You sign out, turn notifications off or delete the app |
| Product events: your account number, what happened (for example "story created") and your country | Understanding which parts of Afterwards are used and which break. Never your name, email, IP address or photos. | Our legitimate interest in improving Afterwards. You can object (see your rights). | Up to 2 years |
| Error reports | Fixing what breaks | Our legitimate interest in a working service | Up to 90 days |
| Emails you send us | Answering you, and handling reports about content | Our legitimate interest, or a legal obligation for reports | As long as needed to answer, then up to 2 years |
Where a photo was taken
Phones write the place a photo was taken into the file. We read it once, to group photos into moments, and keep it with the photo on our side. Then we remove it from the file itself, so the original that other people in the story can download doesn't say where you were. The smaller copies we make for the screen never carry it.
Backups and downloads
We back up the database every night and keep each backup for 30 days, so something you delete can stay in a backup for up to 30 days before it's gone for good. A download of a whole story (a zip) is kept for 7 days, then deleted.
Cookies
We use two cookies, both needed for Afterwards to work, so we don't ask for consent: one keeps you signed in, the other remembers your time zone so times show as yours. No advertising or analytics cookies, no third-party scripts, and our fonts are served by us, not by Google.
Who sees what
- People in the story. They see your name. They see your photos, notes and voice notes as the story allows: in a short story, after the reveal (or straight away if the organiser made it live); in an ever after, as soon as you add them. They can download originals, and what they download is theirs to keep: we can't take it back.
- Anyone with the invite link. A story's link shows its name, its dates, how many people are in it and their first initials, so friends know what they're joining. Never a photo. Share it only with people you'd invite.
- The services that run Afterwards for us. They act on our instructions, under data processing agreements, and can't use your data for anything else:
- Hetzner Online (Germany): our servers and database.
- Cloudflare (photos stored in the EU, in R2): storage of photos and videos, and the network that carries our pages.
- Resend: sending our emails (sign-in codes, invites, reveals), from its European region.
- PostHog (EU cloud, Germany): product events and error reports, as described above.
- Apple: delivering notifications to your iPhone or iPad.
- Google (Firebase Cloud Messaging): delivering notifications to your Android phone or tablet.
- Authorities, only when the law requires it, for example a court order, or a report of child sexual abuse material (see the terms).
Cloudflare, Resend, Apple and Google are American companies. Your photos and our database stay in the EU, but some data (an email on its way, your IP address as a page loads, a notification) can pass through their systems elsewhere. Those transfers are covered by the EU-U.S. Data Privacy Framework and by the European Commission's standard contractual clauses.
We never sell your data, never show ads, and never use your photos, voice or words to train AI models, or let anyone else do so.
Your rights
Under the GDPR you can, at any time:
- see what we keep about you and get a copy of it;
- take your photos with you: download any story, originals included;
- correct what's wrong;
- delete your account and everything you added: on Home, under Sign out, choose Delete my account;
- object to product events, or ask us to restrict how we use your data;
- withdraw consent to notifications, in your phone's or tablet's settings.
For anything you can't do in the app, write to [email protected]. We answer within a month. If you think we got it wrong, you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be, rue de la Presse 35, 1000 Brussels) or to the authority where you live, such as the CNIL in France.
Photos of other people
A photo of you added by someone else is their upload, but it's still about you. If you're in a story, you can ask the photographer to remove it, or hide it for yourself, from the photo. If you're not in the story, or the photographer won't remove it, write to us and we'll look at it under the terms: everyone pictured has to agree, and children need their parents' agreement.
Age
You need to be 15 or older to have an account. If we learn that someone younger signed up, we delete the account. A parent can write to us to make that happen.
Keeping it safe
Everything travels encrypted. Photos are stored encrypted, and handed out only through links that work for a few minutes, after we've checked who's asking. Before a reveal, even our own pages show a photo only to the person who took it. Our servers only accept web traffic that comes through Cloudflare, and access to them is limited to us.
Changes to this policy
If we change something that matters, we'll tell you by email before it applies. The date at the top says when this page last changed.