Privacy
Last updated 13 September 2026
Your photos go into your own Google Drive. They never touch our servers, because we do not have any. We cannot see your photos, and we could not hand them over if we were asked to.
What we store
Almost nothing. Potluck has no user accounts and no photo storage. An album is an ordinary folder in the host's Google Drive, and the photos in it belong to whoever uploaded them.
The only things we keep on a server are:
•
Invite codes. When you create an album, the folder address and album name are encrypted with the album password and stored so the invite link can be short. The password is never sent to us, so this data is unreadable without it.
•
Hidden-photo reports. If someone reports a photo, we store the photo's ID and an anonymous device identifier, so the same photo stays hidden for everyone.
•
Feedback you choose to send. Your message, your email address if you give one, and an anonymous device identifier. Nobody can read this back through the app.
What stays on your device
Your list of albums, your Google sign-in token, and a random device identifier are stored on your device only. Clearing your browser data removes them. For hosts, the album list is also backed up to a private folder in your own Google Drive so a lost device does not lose your albums.
How we use Google Drive
When you sign in with Google, Potluck asks for the narrowest permissions that work:
•
See, edit, create and delete only the files you use with this app. This lets us create your album folder and add photos to it. It gives us no access to anything else in your Drive.
•
A private app folder. An area of your Drive that only Potluck can see, used to back up your album list. It does not count against your storage.
We never request access to your existing Drive files, and we do not read anything we did not create. Your sign-in token stays on your device and is never sent to us. You can remove Potluck's access at any time at myaccount.google.com/permissions.
Who can see an album
Album folders are shared so that anyone holding the link can view and add photos. That is what lets guests join without an account. The link is only useful to someone who also has the album password, which is why the two are best shared together and no more widely than you intend.
We cannot see your photos — but they can still be deleted
These two things sound contradictory, so it is worth being exact about who does what.
•
We have no access to anything anyone uploads. Photos go straight from a guest's device to the host's Google Drive. We never receive, store or view them, and we have no way to list what is in an album.
•
Deleting is done by you, not by us. When you delete a photo in Potluck, the request goes from your device to Google Drive using your own Google sign-in. We are not in the middle of it and we cannot delete anything on our own.
•
Others can delete too. An album folder is shared so that anyone with the link can add photos, and Google Drive has no “add but never remove” setting. So anyone who has the link could, through Google Drive itself, delete photos in that album — including ones they did not upload. Potluck's own screens only offer deletion to the host, but we cannot enforce that outside the app.
•
Reporting hides, it does not delete. The report button hides a photo for everyone in Potluck. The file itself stays in the host's Drive, for the host to remove.
The short version: only people, using their own Google accounts, can remove photos. Share the link and password with people you would trust with the photo album itself, and if a photo matters to you, keep your own copy.
What we do not do
•
No advertising, and no selling or sharing of data.
•
No analytics, tracking pixels or third-party trackers.
•
No facial recognition or image analysis of any kind.
•
No use of Google Workspace API data to develop, improve or train generalised artificial intelligence or machine learning models.
Children
Potluck is not directed at children under 13, and we do not knowingly collect their information.
Deleting your data
Delete the album folder in your Google Drive and the photos are gone — we hold no copy. To remove an invite code or a feedback message, get in touch and we will delete it.
Changes
If this policy changes, the date at the top changes with it. Potluck is run by one person, so it will always be short enough to re-read.
Contact
Questions, or anything you want removed — send a message here.