How Swipick protects your photos

Private links

• Every photographer, guest and photo editor gets their own link containing a long random key that can't be guessed.
• Swipick stores only a fingerprint of each key to recognise it, plus an encrypted copy so the owner can share the link again.
• The owner can turn off a photographer's link or remove a guest at any time.
• Every request is checked against the event it belongs to, and automated tests check that no one can reach another event's photos.

Encryption

• Everything travels over HTTPS.
• Photos in Swipick storage are kept on Cloudflare R2, which encrypts every stored file.
• Passwords are stored only as salted hashes, never as text.
• The key that lets Swipick reach a connected Google Drive is encrypted with a separate key that isn't stored in the database.

Links to photos expire

Photos are shown through signed links that stop working after an hour. The editor's download links last 12 hours. A copied link stops working soon after.

Google Drive access is limited

Swipick asks Google only for access to the files and folders it creates. It can't see or change anything else in your Drive.

Every upload is checked

The photographer's browser computes a checksum of each file before sending it, and Swipick accepts the file only when the stored copy matches. A broken upload is never shown as received.

Deleting means deleting

Deleting an event removes its photos and previews from Swipick storage, along with its links, guests and choices. Photos in a Google Drive event stay in the owner's Drive.

Limits on attempts

Sign-ins and uploads are rate-limited, so keys and passwords can't be guessed by trying many times.

Found a problem?

Write to [email protected]. Security reports are answered first. The same address is listed in swipick.app/.well-known/security.txt.