Privacy policy

Last updated: 21 October 2026

36Stories turns your phone into a roll of film for events. This policy explains what the 36Stories app and the website 36stories.camera collect, why, who can see your photos, how long we keep things and what you can do about it.

36Stories is run by Tanuki Solutions Sdn Bhd (company number 202101016081), a company in Malaysia. We are responsible for your personal data under Malaysia's Personal Data Protection Act 2010 and, where they apply to you, other privacy laws.

In short: there are no ads in 36Stories and no analytics, advertising or tracking tools in the app. We don't sell your personal data. Your own camera works without signing in; to host or join an event you sign in, so a host can block someone who misuses the code. Photos stay hidden from everyone, the host included, until the event's photos develop.

What we collect

When you join an event as a guest

Your 36Stories account (see "When you sign in" below): you sign in before you join, so your roll stays yours on every phone you use and the host can block misuse.
An identifier the app creates on each phone you join from, so each phone keeps its own sign-in to the roll. It isn't your phone's advertising ID.
The name the host sees: your account's name, or the one you give (some hosts ask for a name).
The photos you take for the event, with the film stock, size and the date they were taken. The app makes each photo on your phone and sends no location with it.
Notes you write to the hosts (wishes), and any photo you report.
If a planner checks guests in at the door: the name on the guest list they gave us, and when you were checked in.

When you sign in, to host or join an event

Your email address and the name on your account. If you sign in with Apple or Google, we receive the email address and name they share with us (Apple can share a private relay address).
The events you make: their name, dates, cover picture, welcome text, schedule, news and settings.
Purchases made in the app. Apple or Google takes the payment; we receive which product you bought, its status and dates, through RevenueCat. We never see your card details.
Your email choices and when you made them: whether you want news and offers from 36Stories, and whether you also want to hear from Yours Fondly. Both are off unless you turn them on.

When a planner uses the website

The organisation's name, logo and colour, and the email addresses of the team members it invites.
Billing through Stripe. Stripe takes the card or FPX payment; we keep the customer and subscription references and the plan's status.

From every phone and visit

If you allow notifications: a push token for your phone, so we can tell you when photos develop or the host posts news.
The app's version and your phone's platform (iOS or Android).
Our servers' logs: your IP address, the page or request and the time, used for security and to stop abuse.
The website uses only the cookies sign-in needs. There are no analytics or advertising cookies.
What you tell us when you email us.

The app asks for your camera (to take photos), your photo library (only to save photos, or to add photos when a host allows it) and notifications (optional). You can change these in your phone's settings at any time.

Events opened with a Yours Fondly invitation code

While 36Stories moves to its own servers, an event opened in the app with a Yours Fondly invitation code still runs on Yours Fondly's servers. What you send there (photos, your reply to the invitation with your phone number and food choices, and written, voice or video wishes, for which the app asks for your microphone) is handled under the Yours Fondly privacy policy, at yoursfondly.com/privacy/. Yours Fondly is run by the same company.

How we use it

To run 36Stories: load your roll, keep your photos, develop them at the time the host chose, and show them to the right people.
To send sign-in codes and important emails (such as a warning before an event's photos are deleted), and the notifications you allowed.
To send you news and offers by email, only if you said yes. You can stop them at any time in the app.
To take payments and give you what you paid for.
To keep 36Stories safe: handle reports, block abuse, limit repeated attempts and protect accounts.
To meet our legal duties, such as keeping billing records.

We use your data because you asked for the service, because you agreed (for example to notifications), or because we have a legitimate need to keep the service safe and working. We don't use your photos to train AI models and we don't build advertising profiles.

Who sees your photos

Before the event's photos develop: nobody. Not other guests, not the host, and you can't see your own shots either. That's the point.
After they develop: the host and co-hosts, and the event's guests unless the host chose to see them first. The host decides whether guests can download photos.
For events run by a planner, the planner's team; for events made through a partner website, that partner, as part of the service it offers you.
Our staff only when needed to handle a report, help you when you ask, or meet a legal requirement.

When you report a photo, the host is told about the photo, not who reported it.

Who we share it with

We don't sell your personal data or share it for advertising. These companies work for us and only use it to provide their part of the service:

Opalstack: hosts our servers and database.
Cloudflare (R2): stores the photos, privately.
Google Firebase Cloud Messaging and Apple Push Notification service: deliver notifications.
Brevo: sends our emails, such as sign-in codes.
RevenueCat, with Apple's App Store and Google Play: in-app purchases and subscriptions.
Stripe: planner billing on the website.
Apple and Google: sign-in, if you choose to sign in with them.

Yours Fondly: only if you tick the separate box to hear from Yours Fondly, we give Yours Fondly your name and email address so it can send you its own news and offers, and we tell it when you untick the box or delete your account. It may not pass them on or use them for advertising elsewhere.

Some of these companies process data outside Malaysia. We choose providers that protect it to a standard at least as high as this policy. We may also share data when the law requires it, to protect someone's safety, or if 36Stories is sold or merged, in which case this policy still applies to your data.

How long we keep it

An event's photos are kept for a period counted from the time they develop (or the end of the event), then deleted. For an event you host in the app, the period follows your current plan: if your plan changes, it follows the new plan, and you always get the new plan's whole period from the day it changed. Hosts are warned 30, 7 and 1 days before photos are deleted, by notification and email.

The Viewfinder: 15 days
The Film Club: 60 days
Planner Lite: 183 days
Planner Pro: 365 days
The Darkroom: for as long as the host stays on The Darkroom.
Planner Studio: while the plan is active; when it ends, events stay read-only for 30 days and are then deleted.
Events made through a partner website: as agreed with that partner.
Events with Keep forever: until the host deletes them or their account.

Your account stays until you delete it. When you ask to delete it, you have 7 days to change your mind. Then your name, email address and sign-ins are deleted, with the photos and wishes you added to other people's events. Events you host stay open for your guests to view and download for 30 days, then they and their photos are deleted. Sign-ups never confirmed are deleted after 7 days. We keep billing records as long as the law requires, and deleted data can remain in backups for a short time before it is overwritten.

Your choices and rights

You can ask to see the personal data we hold about you, correct it, have it deleted, or withdraw your consent (for example by turning off notifications). You can delete your account in the app or on our account deletion page. You can also ask a host to remove a photo, report it, or email us.

We answer requests within 21 days. If you aren't happy with our answer, you can complain to Malaysia's Personal Data Protection Commissioner, or the data protection authority where you live.

Children

36Stories is not for children under 13, and we don't knowingly collect data from them. If you think a child under 13 has used 36Stories, email us and we'll delete their data.

Security

Everything travels over encrypted connections. Photos are stored privately, and the links that show them are signed and expire within minutes. Sign-in tokens are stored scrambled (hashed), and staff access is limited and protected. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change matters, we'll tell you in the app or by email before it takes effect.

Contact

Questions or requests about your data: email support@36stories.camera. Tanuki Solutions Sdn Bhd (202101016081), Malaysia.