Privacy policy

Leaverbook (leaverbook.com) helps people collect photos, videos and messages from a school formal, prom, graduation or similar event. Leaverbook ("we", "us") runs the site. This policy explains, in plain English, what personal information we collect, why, who we share it with and what you can do about it. Many people who use Leaverbook are school students, so we have tried to write it so anyone can follow it. If anything is unclear, email us at hello@leaverbook.com.

We follow the Australian Privacy Act 1988 and the Australian Privacy Principles. If you are in the UK or European Union, the UK GDPR or EU GDPR also gives you rights, and if you are in the United States, laws such as the Children's Online Privacy Protection Act (COPPA) may apply. This policy is written to work for all of them.

The short version

An organiser signs in, connects their own Google Drive or Dropbox and gets a QR code. Guests scan it and upload without making an account.
Guests' photos, videos and voice or video messages go straight into the organiser's own Drive or Dropbox. We don't keep our own copy of those files. We do keep some details about each upload, and a copy of written messages, as explained below.
We don't sell personal information and we don't use it for advertising.
Organisers must have permission to collect and share photos of the people at their event, and must follow their school's photo rules.
Want a photo taken down, your data deleted, or have a question? Ask the organiser, or email us at hello@leaverbook.com.

Young people and children

Organiser accounts are for people aged 13 or older. If you are under 18, please set up an album with a parent, guardian or your school involved, and follow any extra rules where you live (for example, in some countries you need a parent's consent to use online services until you are 16). Google and Dropbox also have their own minimum ages.

Guests do not need an account and only need to give us an optional name.Leaverbook is meant for school-leaver events, so guests are usually teenagers and adults. It is not designed for children under 13, and we do not knowingly collect personal information from children under 13, other than photos or videos they appear in that an organiser collects at their event. If you are a parent or guardian and think your child under 13 has given us personal information, or you want a photo of your child removed, email hello@leaverbook.com and we will help (see "Removing a photo" below).

Photos of students and other people

Photos and videos from school events often show people under 18. The organiser decides what is collected and who can see it, and is responsible for:

having permission to collect and share photos and videos of the people at the event;
following their school's photo and media policies, and any opt-outs students or families have made;
keeping guest and gallery links within the intended group; and
removing photos when someone reasonably asks.

Guests should only upload photos and videos they took or are allowed to share, and should think about whether the people in them would be happy for them to be shared.

Removing a photo: first ask the organiser, who can hide or delete it from their album dashboard. If they won't, or you can't reach them, email hello@leaverbook.com with the album name or link and a description of the photo. We can remove it from the album's guest gallery and live display, and we can take further action under our terms. Because the original file sits in the organiser's own Drive or Dropbox, we may not be able to delete that copy ourselves, and we can't recall copies other people have already downloaded.

What we collect

Organiser accounts: your name and email address from Google or Dropbox (or the name, email and password you choose if you sign up with email; we store only a scrambled "hash" of the password), an account identifier from Google or Dropbox, encrypted access tokens that let us save into and read from your connected storage, and sign-in sessions. When you sign up we also save where your browser first came from (the referring website, any campaign tags or referral code in the link, and the first page and time) and, if you answer it, how you heard about us.
Albums: the album name, date and location you enter, references to the storage folder, guest and live-display links, settings (such as approval, gallery and an optional upload passcode), whether the album is upgraded and, for upgraded albums, any cover photo you add.
Helpers: if an organiser invites helpers to manage an album, we store the email address the invitation was sent to and, once accepted, the helper's name and email from their own account.
Guest contributions: the optional name a guest types, the file type and size, the identifier of the file in the organiser's storage, when it was sent, whether it is waiting for approval, approved or hidden, and the text of any written message. To stop abuse and enforce upload limits we also store a one-way hash of the guest's IP address and of a random device code kept in their browser, each combined with the album. A hash is hard to reverse, but it is still a security identifier, not a promise of anonymity.
Payments: see "Payments" below.
Help chat and messages to us: see "Help chat and contacting us" below.
Register your interest: if you sign up to hear about upcoming Leaverbook products (such as class leavers books, year-level farewells or teacher time capsules), we store your email address, the role you pick (student, parent or carer, teacher or school staff, or something else), the products you're interested in, which page you signed up from, that you agreed to be emailed, and when you signed up or last updated your details.
Feedback offer: if you send feedback through our feedback offer, we store your account identifier, name and email, your report, the album you chose and our review decision.
Usage, error and security information: see "Cookies, browser storage, analytics and error reports" below. Our hosting providers also process IP addresses, requested web addresses, browser details and security logs to run and protect the site.

Where guest uploads go and who can see them

Photos, videos, voice messages and video messages upload directly from the guest's phone into the organiser's connected Google Drive or Dropbox. We do not keep a separate copy of these files in our own database. When the organiser, a helper or a gallery visitor views a file, our servers fetch it from the organiser's storage and pass it on; browsers may keep a temporary cached copy.

Written messages (an upgrade feature) are different: we save the message text in our database, so it can show quickly in the gallery and on the live display, and also save it as a text file in the organiser's storage. Album cover photos that organisers add are stored in our database.

The organiser and any helpers can see everything sent to the album, including items waiting for approval or hidden from the gallery. Anyone with the guest link can see the album name, date, location and cover. On upgraded albums with the guest gallery turned on, anyone with the link (and the passcode, if the organiser set one) can also see approved photos, videos and messages, including the names guests gave. Anyone with the live-display link can see what it shows. Links can be forwarded, and people can save copies of what they can see.

Hiding a contribution removes it from the gallery but leaves the file in the organiser's storage. If the organiser deletes a contribution, we also ask their storage provider to delete the file; we keep the contribution's record in our database (marked as deleted) until the album or account is deleted. Photos can contain hidden details such as where they were taken; we don't remove these from the original files. Your browser asks before we use your camera or microphone for a recording.

Connected Google Drive and Dropbox

Google sign-in asks for your basic profile (name, email) and the drive.file permission. That only lets Leaverbook see and change files and folders it created, or that you open with it; it does not give us access to the rest of your Drive. Dropbox access is limited to Leaverbook's own app folder inside your Dropbox's Apps folder. We use these permissions to create album folders, save and check uploads, show files to you and the people you share the album with, delete files when you ask, and warn you when your storage is getting full.

How we use information

We use personal information to:

run organiser accounts and albums, and collect and show contributions;
process upgrades and gifts, and handle refunds;
send emails about your account, albums and storage (see below);
answer questions and support requests;
tell people who registered their interest about new Leaverbook products;
understand how the site is used, fix errors and improve it; and
keep the service safe, prevent abuse and meet our legal obligations.

Emails: we email organisers about their account, albums, upgrades, sign-in and storage problems; these are part of the service. Welcome tips and after-the-event recap emails include an unsubscribe link. If you registered your interest, we'll only email you about Leaverbook products; you can ask us to stop at any time by emailing hello@leaverbook.com. Helpers receive an invitation email when an organiser invites them.

If you are in the UK or EU, our legal bases are: providing the service you asked for (contract); your consent (interest sign-ups, optional analytics where consent is required); and our legitimate interests in keeping the service secure, fixing problems and understanding how it is used. Where we rely on consent you can withdraw it at any time.

Who we share information with

We do not sell or rent personal information, and we don't share it for advertising. The organiser receives what guests send to their album. We use these service providers to run Leaverbook, and they handle information only as needed to provide their service to us:

Google Cloud / Firebase: hosting, servers and our database.
Google Drive and Dropbox: the organiser's own connected storage.
Stripe: payments.
Resend: sending emails.
Anthropic: the optional AI help chat.
Sentry: error reports, so we can fix bugs.
Google Analytics: website analytics, only when it is switched on.

We may also disclose information if the law requires it, to protect someone's safety, or to deal with fraud, abuse or a security incident.

Information sent overseas

Our servers and database run on Google Cloud in the United States (us-central1). Our other providers may process information in the United States and other countries where they operate. Files in your Drive or Dropbox are stored wherever your provider keeps them. This means personal information is sent outside Australia (and outside the UK and EU). Before doing so we take reasonable steps, as required by Australian Privacy Principle 8, to make sure these providers handle it in line with the Australian Privacy Principles, mainly by choosing established providers with published privacy and security commitments and using their standard data-protection terms. For UK and EU users, transfers rely on the safeguards those providers offer, such as standard contractual clauses or recognised data frameworks.

Payments

Upgrades are paid through Stripe Checkout, a payment page run by Stripe. We send Stripe the organiser's email address, the album name and our account and album identifiers. Stripe collects card or other payment details itself; we never see or store full card numbers or security codes. Our album record keeps a checkout reference, the amount and currency charged and when it was paid. If a guest gifts an upgrade, Stripe collects their email for the receipt, and we store that email plus the name and note they enter. Only the organiser is shown the name and note. See Stripe's privacy policy.

Help chat and contacting us

Our optional help chat is powered by Claude, an AI model made by Anthropic. When you ask a question, the recent conversation is sent to Anthropic to write a reply. We keep a log of each chat (your questions, the answers, the page you were on, a random chat code and a hash of your IP address) to check answer quality and fix problems. The chat cannot see your account, albums or files. Please don't type passwords, payment details, album links or other private information into it. Anthropic processes chats as our service provider under its privacy policy and commercial terms.

If you use the "Message us" form, we store your name (if given), email address, message, the page you were on and the chat so far, and email it to our team. If you email us, we keep the email and our reply.

Cookies, browser storage, analytics and error reports

Sign-in cookie: we use one essential cookie, __session, to keep organisers signed in and to protect sign-in. It lasts up to 30 days. Blocking it stops sign-in working.

Browser storage: the site also saves some things in your own browser: on the guest page, your name (so you don't retype it), any album passcode you entered and a random device code used for upload limits; while setting up an album, your progress and a pending cover photo; and the visit and error codes described below. These stay in your browser until you clear its site data.

Our own visit log: to see how the site is used and spot problems, we keep a simple log of visits without cookies. It records pages viewed, the names of buttons and links clicked, errors you hit (such as a failed upload), the referring website and campaign tags, your browser's language, timezone and screen size, whether this browser has visited before, and your device and browser type. Album codes, links and secret keys are removed from page addresses, and nothing you type into forms is recorded. Visits are identified by a random code, not your IP address. Visit and server-error logs are deleted automatically after 90 days.

Google Analytics: when we switch it on, Google Analytics 4 runs on our marketing and organiser pages. It is not loaded on guest upload pages or the live display. It uses cookies to measure page views, device and browser details, where visitors came from, and actions such as creating an album or completing an upgrade (including the amount and currency). We don't send it names, emails, messages or files. Google processes IP addresses to provide it; see Google's privacy policy. You can block analytics cookies in your browser or use Google's opt-out add-on.

Error reports: when something breaks, an error report goes to Sentry. It includes the error, where in our code it happened, the page address with album codes, links and secret keys removed, your browser and device type, the steps leading up to it and a random code kept in your browser (so we can count how many people are affected). For signed-in organisers it may include their account identifier. We set it up not to collect emails, cookies, form contents or what you type. See Sentry's privacy policy.

Use of Google user data

Leaverbook's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information from Google APIs is used only to provide the account and album features described here. It is not sold, not used for advertising, and not used to develop, improve or train generalised AI or machine-learning models. It is only transferred to others to provide those features, to follow your instructions, for security or to meet legal requirements, as that policy allows. Our AI help chat does not receive data from Google APIs.

How long we keep information

Sign-in sessions end after 30 days. Password-reset links expire and are then deleted.
Organiser accounts, albums and contribution records are kept until the organiser deletes the album or their account. They don't expire automatically when an event ends.
Help chat logs are set to be deleted 180 days after the last message.
Visit logs and server-error logs are deleted after 90 days.
Interest sign-ups are kept until you ask us to stop emailing you or to delete them, or until we no longer need them.
"Message us" messages, feedback reports and support emails are kept until they're no longer needed for support, or until you ask us to delete them (unless we need to keep them, as explained below).
Payment records are kept as long as tax and accounting laws require. To prevent repeat claims of the feedback offer, we keep a record of who received it (including hashed account and email identifiers), even after an account is deleted.

Automatic deletion can take a little extra time to run, and our providers' backups follow their own schedules.

Deleting your account and data

Organisers can choose "Delete my account & data" at any time. This asks Google and Dropbox to cancel our access, and deletes your account, sign-in sessions, albums, cover photos, contribution records and connected-storage details from our database, and removes you as a helper from other people's albums. Files and messages already saved in your Drive or Dropbox stay there; delete them through your provider if you want them gone. You can also remove our access in your Google account connections or Dropbox connected apps, but that alone doesn't delete what we hold. The delete button doesn't remove support messages, interest sign-ups, feedback reports or payment records; email hello@leaverbook.com to ask us to delete those.

Security

We encrypt the access tokens for connected storage, store passwords only as hashes, block direct access to our database from browsers, use HTTPS, scrub secrets out of error reports and rate-limit uploads, sign-in attempts and forms. No online service can be perfectly secure, so keep your guest and gallery links within your group and protect your Google or Dropbox account. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires, and other regulators where their laws apply.

Your rights: access, correction, deletion and complaints

You can ask us for a copy of the personal information we hold about you, to correct it, or to delete it. In the UK and EU you can also object to or restrict some uses, and ask for your data in a portable format. A parent or guardian can make these requests for their child. Email hello@leaverbook.com with enough detail for us to find the information (for example the album name or link, or the email you used). We may need to check who you are first. We aim to reply within 30 days and will explain if there is a legal reason we can't do everything you ask. For files in an organiser's Drive or Dropbox, please also contact the organiser, because they control those copies.

If you have a complaint about how we've handled your personal information, email us first and we'll try to sort it out. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner in Australia, the Information Commissioner's Office in the UK, the Office of the Privacy Commissioner in New Zealand, your local data protection authority in the EU, or the Federal Trade Commission or your state attorney general in the United States.

Changes to this policy

If we change this policy we'll update this page and the date below. If a change is significant, we'll tell organisers by email or on the site, and ask for consent where the law requires it.

Contact

Leaverbook. Email: hello@leaverbook.com.

Last updated 7 November 2026. Questions: hello@leaverbook.com