Privacy Policy · Flashiko

Last updated: October 21, 2026

This policy describes how data is handled in the “Flashiko” mobile app for iOS and Android (identifier com.opharana.flashiko) and on the pages of this website where you can join an event, take photos and view them (together, “Flashiko”). The data controller is OPHARANA LLC, with its registered address at 99 Wall Street, Suite 1432, 10005, New York (United States) and contact email hello@opharana.com.

1. Summary

• No sign-up. When you open the app or an event page, an anonymous account is created, which is just a random identifier.
• Whoever organizes an event gives us their name and email; guests, only the name they want to appear with.
• An event’s photos are seen only by its guests, and only from the reveal time. Nothing is public or indexed by search engines.
• Photos can show other people. Whoever takes a photo is responsible for doing so with their permission; the organizer can delete any photo and anyone can report it.
• Photos delete themselves: 30 days after the reveal in free events and after one year in events with a pass.
• We don’t sell your data or pass it to third parties for purposes other than those described here.
• In free events, the app shows Google AdMob ads to the organizer and at the reveal, with your consent in the EEA, the United Kingdom and Switzerland. Never while photos are being taken.
• Payments for event passes are processed by Apple or Google; we never see your payment details.
• You can delete your data whenever you want from the app, in The camera → “Delete my data” (section 8).

2. Data we process

2.1. Anonymous account

When you open the app for the first time, or an event page in your browser, an anonymous account is created with our database provider, Supabase: a random identifier and the session data that lets us recognize you when you come back. In the browser, the session is stored in that page’s local storage. To protect the service, Supabase records the IP address and technical data of connections (date, time and device type).

This account is tied to the app installation or to the browser: if you delete it or change phones, you lose access to it and we can’t recover it. You can rejoin an event with its code, but as a new guest.

2.2. Events

For each event we store its name, type (wedding, birthday, communion, etc.), date, reveal time, how many photos each guest gets, the code to join, the plan (free or with a pass) and who organizes it. For the organizer we also store their display name and email address, which we use for service notices about their events. If they tick the news box (it is never pre-ticked), we also use it to send them news about Flashiko and other OPHARANA LLC apps; they can unsubscribe at any time.

2.3. Guests

For each guest we store the name they type when joining, when they joined, whether they did so from the app or from the web, how many photos they have taken and, if the organizer removed them from the event, that decision. The name appears next to their photos at the reveal and in the guest list that the organizer sees.

2.4. Photos

We store each photo in three sizes: the original, a 1,600-pixel copy and a thumbnail, in private Supabase storage in the European Union (Ireland), together with who took it and when. Photos taken with the app’s camera are uploaded as they are; those chosen from the gallery or uploaded from the web are re-encoded to strip their metadata, including GPS location.

Who sees what: nobody sees the photos before the reveal time, not even the organizer or the person who took them. From the reveal, all of the event’s guests can see them, through signed links that expire after one hour. Anyone who has the event’s code or link can join it as a guest, so the organizer should share it only with their guests.

Photos of other people: an event’s photos often show other people. Whoever takes a photo is responsible for doing so with the permission of the person in it and, if it is a minor, of their parent or guardian. The organizer can delete any photo from their event and remove any guest. Any guest can report a photo: if it is because of a minor, it is hidden immediately; other reports are reviewed within 24 hours and, with three reports, the photo is hidden. If you appear in a photo and want us to remove it, write to us (section 9).

Photos are not used for anything else: we don’t analyze them, we don’t recognize faces, and we don’t use them for advertising or to train artificial intelligence systems.

2.5. Reveal notifications

If you give permission, the app schedules a local notification on your phone for the reveal time. It is scheduled on the device itself: we don’t use any push notification service and we don’t store your device’s tokens.

2.6. Advertising (Google AdMob)

In free events, the app shows ads through Google AdMob: a full-screen ad to the organizer after finishing creating the event, and ads inside the reveal’s contact sheet. Never while photos are being taken and never in events with a pass. Google may process the device’s advertising identifier (IDFA on iOS, AAID on Android), device data, approximate location derived from the IP address, interactions with the ads and diagnostic data from its SDK, according to Google’s Privacy Policy and its information on data use on partner sites and apps. We don’t send your photos, your name or the names of your events to advertising.

With the app in Spanish, ads from TuIAgencia, the owner’s services agency, are also shown; they use neither the advertising identifier nor any personal data. The pages of this website show no advertising.

2.7. Event passes

Event passes (Event and Large) are one-time purchases inside the app. They are processed entirely by Apple (App Store) or Google (Google Play), under their own policies. We don’t receive or store your card, bank account or billing details. To verify the purchase we use RevenueCat, which receives your anonymous identifier and the store’s receipt and tells us that the purchase is valid; we store the transaction identifier, the product, the event it applies to and the date.

2.8. When you write to us

If you write to hello@opharana.com we process your email address and whatever you tell us, solely to handle your enquiry, your report or the exercise of your rights.

3. Purposes and legal bases (GDPR)

4. Advertising and your consent

• EEA, United Kingdom and Switzerland: before loading any Google ad, the app shows Google’s consent form (UMP). If you decline personalized advertising, non-personalized ads are shown.
• iOS: in addition, the system shows Apple’s tracking prompt (App Tracking Transparency). If you don’t allow it, the IDFA is not used.
• Changing your mind: in the app, The camera → “Ad privacy”; on iOS, Settings → Privacy & Security → Tracking; on Android, Settings → Google → Ads.
• No ads: events with a pass show advertising to nobody.

5. Recipients of the data

In addition, an event’s photos and the guests’ names are seen by the other guests of that event from the reveal (section 2.4).

6. International transfers

The database and the photos are on Supabase servers in the European Union (Ireland). The controller is established in the United States, and some providers (Apple, Google, RevenueCat, Expo and Vercel) may process data outside the European Economic Area, mainly in the United States, under the European Commission’s Standard Contractual Clauses and/or adequacy decisions (such as the EU-US Data Privacy Framework).

7. Retention

• Free events: the event, its guests and its photos are deleted 30 days after the reveal.
• Events with a pass: they are deleted one year after the reveal (or after the purchase, if later).
• Deleted photos, by the person who took them or by the organizer: they stop being visible immediately and their files are removed in the next daily cleanup.
• The organizer’s email: while they have events or until they delete their data; the authorization for news, until they unsubscribe.
• Purchase data: as long as the event exists and, afterwards, whatever tax and consumer regulations require.

8. How to delete your data

From the app: go to The camera (the three dots in the viewfinder) and tap “Delete my data”; we will ask you to confirm. Once you confirm, immediately and permanently:

• all the photos you have taken are deleted, in every event;
• you leave all the events you were in;
• the events you created are deleted, with all their photos, for all their guests;
• your email is deleted, if you gave one when creating an event;
• your user is deleted.

If you joined only from the web, or you have lost access to your account, write to hello@opharana.com with the event code and the name you joined with, and we will do it for you. To delete the purchase receipt that RevenueCat holds, write to us as well.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent by writing to hello@opharana.com. We will reply within one month. If you appear in an event photo and want us to remove it, tell us the event code and describe the photo: we will take it down. You also have the right to lodge a complaint with the supervisory authority; in Spain, the Agencia Española de Protección de Datos (Spanish Data Protection Agency, aepd.es).

10. Minors

Flashiko is not aimed at children under 14 and we do not knowingly collect data from minors; we do not verify age. At family events (communions, christenings, birthdays) it is common for minors to appear in the photos: whoever takes them must have the permission of their parents or guardians, and the photos are seen only by the event’s guests. Any reported photo of a minor is hidden immediately. If you are a parent or guardian and want us to remove a photo, write to us at hello@opharana.com.

11. Security

Communications are encrypted (TLS). The database cannot be read directly: the app and the web can only use functions that check your session on every call. The photos are in private storage; they can only be viewed with signed links that expire after one hour and that the server gives only to the event’s guests from the reveal.

12. Changes to this policy

If we change it, we will publish the new version at this same URL (https://flashiko.com/en/privacidad) and update the date. Substantial changes will be flagged in the app.

13. Language

This policy is published in several languages. In case of discrepancy, the Spanish version prevails.

14. Contact

OPHARANA LLC
99 Wall Street, Suite 1432, 10005, New York, United States
hello@opharana.com