Accounts and authorization
Passwords use scrypt with unique salts, sessions use HTTP-only cookies, and Google refresh tokens are encrypted with AES-256-GCM.
Security and data flow
Your photos stay yours. Permissions stay clear.
Vowlight requests only the access needed to run your album and keeps account, payment, and event actions traceable.
Photo ownership
Participant originals go directly to the host's Google Drive. Deleting a Vowlight event does not delete event photos.
Payment confirmation
Paddle and any enabled payment provider must pass signature verification before a plan becomes active.
Abuse protection
Event-specific token links, file validation, rate limits, completion checks, and administrator audit logs work together.