Privacy

Last updated: 20 October 2026

Once is for sending a private photo that opens only once. We collect the minimum needed to run this service, protect it from abuse and comply with the law.

Anonymity: what it means

Other users never see your name, your email or your number: only your nickname. However, Once (the publisher) knows which account sent which photo. This is essential to handle reports, suspend abusive accounts and respond to lawful requests from the authorities. Once is therefore not anonymous with respect to the publisher or authorised authorities.

The recipient is notified by Once itself (a text message signed “Once”, or a WhatsApp message from Once if they have opted in): your number is never shown to them. If you choose to share the link yourself, it is then your own account that sends the message.

Received a text from Once and don't want anything more? oncephoto.com/en/stop.

Data we process

• Account: email address (sign-in), automatically generated nickname, age declaration and acceptance of the terms.
• Photos: the photo you send, stripped of its metadata (location, device, date) before sending.
• Recipient: the number you enter is used by Once to notify the recipient with a text message signed “Once” (via the provider Brevo, in France). It is not stored in plain text. We keep an encrypted fingerprint (to limit repeated sends to the same number) and its last 2 digits, visible only to you in “My sent photos”.
• WhatsApp alerts (if you turn them on): your WhatsApp number, verified with a code, stored encrypted and used only to let you know a photo is waiting for you. Photos sent to that number then go straight to your account. You can turn alerts off at any time: the number is then deleted.
• Purchases: transaction IDs, product, date, status (via Apple, Google and RevenueCat). We never receive your bank details.
• Security: a technical log of actions (send, open, report), with no content or number, and the reports you make.

Why (legal bases)

• To provide the service you ask for (performance of the contract).
• To prevent abuse, protect people and minors, and check photos (legitimate interest and legal obligations).
• To keep accounting records of purchases (legal obligation).

How long we keep data

• Unopened photo: deleted no later than 1 hour after it expires (7 days after sending), or as soon as the sender withdraws it.
• Ephemeral photo (default setting), once opened: inaccessible immediately; the file is deleted 24 hours after opening, which gives the recipient time to report it.
• “Viewable again” photo (if the sender turned off “Ephemeral”): the recipient can view it again for 7 days after sending; the file is deleted no later than 1 hour after that deadline, or as soon as the sender withdraws it.
• If the sender allows saving, the recipient can keep a copy in their phone's gallery: that copy is then outside Once's control and these retention periods.
• Reported photo: kept for 30 days for moderation, then deleted, unless we are legally required to keep it longer (for example at the request of a judicial authority).
• Account: until it is deleted. Deletion erases your photos, your balance and your history; accounting records of purchases are kept for 10 years, detached from your account.
• Technical log: 12 months.
• Automatic database backups (without photo files) are overwritten on a rolling basis, within 30 days at most.

Service providers

• Supabase (hosting of the database, files and functions, in Paris, European Union).
• Automatic photo checks: OpenAI (United States), which analyses the image at the time of sending, under the European Commission's standard contractual clauses.
• Brevo (France) for sending the invitation text message to the recipient: the message contains no photo, no name and no nickname.
• RevenueCat (United States), Apple and Google for in-app purchases.
• Meta Platforms (WhatsApp Business), only for the WhatsApp alerts you have turned on: the message contains no photo, no name and no nickname.

Your rights

You can access your data, correct it, delete it (“Delete my account” button in the app, or on the page oncephoto.com/en/delete-account, without the app), object to processing or request portability by writing to support@oncephoto.com. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Age

Once is for people aged 18 and over.

This policy is a translation of the French version (Confidentialité), which prevails in case of any difference.

Publisher: Benjamin Taieb, sole trader (entreprise individuelle) — 11 rue Jacques Duchesne, 75019 Paris, France — SIRET 528 074 370 00032 — VAT FR13528074370 — contact: support@oncephoto.com.