Your wedding photographer took 800 photos. Your guests took 3,000 — and 2,900 of them are still sitting on phones you will never see. This is a story about how software fixes that, told from the inside out, with no computer science degree required.
Every event has the same bug. Not a bug in an app — a bug in how humans store memories. A hundred people point their cameras at the same three hours of your life, each one catching an angle nobody else did, and then all hundred of those cameras walk out of the building and go home.
The traditional fix is a WhatsApp group and a lot of nagging. The engineering fix is a shared album that guests can reach in one tap, with no app to install and no account to create. Below is exactly how that works — every step, in plain English, including the decisions that look boring on a diagram and matter enormously at 11pm on a dance floor with bad Wi-Fi.
The Five-Second Journey, from a Guest’s Thumb to a Shared Album
Click through the steps below. The left side is what a guest experiences. The right side is what the software is actually doing while they experience it.
Interactive
What happens when a guest scans your QR code
What the guest sees
They point their camera at a table card. A notification slides up. They tap it. That is the entire interaction — about four seconds, no typing.
What is actually happening
A QR code is not magic and it is not a file. It is a web address, drawn as squares. The phone’s camera reads the address and offers to open it. Nothing is installed, nothing is transmitted yet — this step is exactly as complicated as reading a signpost.
What the guest sees
The couple’s album opens in their normal browser. There’s a name field they can skip, and a big button that opens their camera roll.
What is actually happening
The address contains the event’s unique slug, so the page loads that one album and no other. The camera-roll picker is a browser feature that already exists on every phone made in the last decade. Building an app to reproduce it, would add a download, an app-store trip, and a login — three chances for a guest to give up. The browser is the app.
What the guest sees
Nothing. This step is invisible and takes a fraction of a second.
What is actually happening
Before a single photo byte moves, the browser asks Momento App’s server one small question: may I upload this specific file? The server checks that the event exists, that its album is still open, that the album isn’t private to someone else, and that this phone hasn’t already fired off dozens of requests — then hands back a short-lived signed ticket. Think valet ticket, not luggage.
What the guest sees
A progress bar that keeps moving, even for a 40-second video, even on venue Wi-Fi.
What is actually happening
The photo goes straight from the phone to the storage service, using that signed ticket. It never passes through Momento App’s own servers. That single design choice is why big videos work at all — more on this below.
What the guest sees
“Uploaded.” Their photos appear in the shared album, next to everyone else’s, in seconds.
What is actually happening
One last tiny message tells Momento App’s server “that upload landed, here’s where it lives, here’s who sent it.” Only now does a row appear in the database. If a guest picked twelve photos at once, they’re tagged with a shared batch ID so the album can show them as one moment rather than twelve strangers.
Why the QR Code is the Least Interesting Part (and the Hardest to Get Right)
A QR code is a web link wearing a costume. The engineering problem isn't generating it — that's a solved, boring thing. The problem is that hosts want the sign to be beautiful, and beauty and scannability are frequently at war.
Momento App's print packs — welcome sign, table cards, reception poster — solve this by taking away exactly the right amount of freedom. A host picks two colours: a background and an ink. The other three tones in the design (secondary text, the little botanical sprigs, the hairline border) are calculated automatically by blending those two. It's the difference between handing someone a paint set and handing them a palette that already works.
And one colour is quietly non-negotiable: the QR code's own squares are always forced dark enough to scan against their white card, no matter how pale and dreamy the rest of the design gets. That is a deliberate line in the code, and it exists because a gorgeous sign that fails to scan is worse than an ugly one that works.
The signs themselves are drawn as vector graphics in the browser, then exported to a high-resolution image for screens or a print-sized PDF for a printer. The PDF machinery is only loaded when a host actually opens the print pack — so guests, who will never need it, never download it. If you want to see the finished thing rather than the plumbing, the QR code wedding photo sharing page walks through the printable sign templates, and event QR code photo upload covers the same for conferences, galas and parties.
The Valet Ticket: the One Design Decision that Makes Everything Else Possible
Here's the part engineers get excited about, explained without jargon.
The obvious way to build photo uploads is: phone sends photo to your server, your server sends photo to storage. Simple, and it works fine in testing, where your test photo is a 200-kilobyte cat picture.
It falls apart at a real wedding. Modern app servers run in small, temporary slices of a computer that are cheap and fast precisely because they're small — and they typically refuse to accept a single request larger than a few megabytes. One 4K video of the first dance is a hundred times that. Every guest's phone would be trying to shove a wardrobe through a letterbox.
Under the hood
Three messages, and only one of them is heavy
The heavy step is the one Momento App deliberately stays out of. The two steps it does handle are small enough to stay fast even when two hundred phones fire at once.
The signed ticket is what makes this safe. It isn't a general key to the storage account — it's stamped for one folder, it expires, and Momento App only issues one after checking that the event is real, the album is currently open for uploads, the host's account is in good standing, and the file is a genuine photo or video type under the 50 MB-per-file ceiling. A guest can't talk to storage without a ticket, and a ticket can't be reused as a skeleton key.
There's a small kindness buried in that same step, too. iPhones save photos in a format called HEIC that Windows laptops and older browsers often refuse to open. When Momento App spots one, the ticket it issues instructs storage to convert the photo to a universal JPEG on arrival. The guest does nothing. The grandmother on a 2016 desktop just... sees the photo.
Once the bytes land, the third message is what turns a file into a memory. It records who uploaded it (if they typed a name — it's optional, and remembered on their phone so they only type it once), any hashtags they added, and a shared batch ID when someone selected twelve photos in one go. That batch ID is why an album can show "Amara added 12 photos" as a single moment instead of twelve disconnected tiles. It is a small piece of bookkeeping that changes how the finished shared wedding album reads — closer to a story, further from a dump. The same assembly runs behind every event type in the wedding photo sharing app.
How Much Data is Your Event, Actually?
Move the sliders. The numbers update as you go — this is the same arithmetic that decides whether an upload system needs to be clever or can afford to be simple.
Interactive
Event upload calculator
"Carried by the app servers" is just the two little text messages per file. The photos themselves go phone-to-storage. That gap — gigabytes versus megabytes — is the whole argument for the valet-ticket design.
Two things usually surprise people here. The first is how quickly an ordinary event crosses into multiple gigabytes — a 120-guest wedding where everyone contributes a dozen shots is already bigger than most people's entire phone backup. The second is how little of that the app itself has to touch. Doing the arithmetic before writing the code is what turns "the uploads keep failing" into a problem that never existed. If you want the guest-facing version of this story, it's on the wedding guest photo upload page.
Privacy You Can Actually Feel: Three Doors, One Album
"Private" is a word marketing pages throw around. In a codebase it has to mean something specific, and here it means a host picks one of three doors for their album.
Interactive
Pick a door and see what it does
The guest experience
Scan, upload, done. No password, no friction — the default, because the QR code is only on the tables at your event.
What "private" means here
The album has no public listing and no browsable directory. Its address contains a long random suffix that can't be guessed, and search engines are never handed it. It is private the way an unlisted phone number is private.
The guest experience
One extra screen: type the word printed on the table card. Then they're in, and they stay in.
What "private" means here
The password is never stored as text anyone could read — not by staff, not in a database dump. It's stored as a one-way scramble, and guesses are checked against the scramble. Repeated attempts from the same place get throttled, because a password you can guess a million times isn't a password.
The guest experience
They enter their email, receive a six-digit code, and type it in. Familiar, because their bank does the same thing.
What "private" means here
Only addresses on the host's list get a code at all. Each code allows five wrong guesses and then dies — and unlike the general traffic throttling, that five-attempt limit never relaxes, even if other parts of the system are having a bad day. Some limits are there to keep the system tidy. This one is a lock.
That last distinction is worth dwelling on, because it's the kind of judgement that separates a system that merely looks secure from one that is. Momento App uses traffic limits in several places — how many upload tickets one phone can request, how many emails one address can trigger. If the service that tracks those counters ever becomes unreachable, the code deliberately lets requests through rather than blocking everyone. Those limits exist to discourage abuse, and a temporary outage in the counter shouldn't take down every wedding on the platform.
The five-attempt cap on a verification code is the opposite. It is not tidiness, it's the door itself, and it fails closed — no excuses, no fallbacks. Knowing which of your safety measures is a bouncer and which is a deadbolt is most of security engineering.
A private album that anyone holding its ID could still upload into would be a strange kind of private. So the permission check runs on uploads too, not just on viewing.
Finding Yourself In 900 Photos
A shared album has a scale problem that a private camera roll doesn't: everyone contributes, so nobody can find themselves. The fix is to let a guest take a selfie and get back every photo they appear in.
This is the feature where the implementation details are the ethics, so here they are plainly. The selfie a guest takes to search with is never saved and never added to anything — it exists for the length of one request and is written nowhere. The face data extracted from uploaded event photos is kept in a separate service, in a list that belongs to one single event, so a face recognised at a Lagos wedding cannot be matched against a conference in Berlin. Deleting the event deletes the whole list in one stroke, rather than hunting for stray fragments. And Momento App's own database never stores a face — only a pointer saying "photo 412 contains a face", which is a fact about a photo, not an identity.
Searching is also rate-limited more aggressively than anything else in the product, for a reason worth stating out loud: it is the one place where a stranger could otherwise sit and test faces against a guest list. Building the feature meant building the thing that stops it being misused.
The Recap Video, and An Honest Note About "AI"
At the end of an event, Momento App can assemble a 90-to-120-second highlight reel. It would be easy to slap "AI-generated" on that and move on. What actually happens is more modest and, frankly, more trustworthy: nothing is invented. The system ranks the photos an event already has, using signals it already knows — which ones guests viewed most, which ones contain several faces (a decent proxy for "this is the group shot"), how many different hashtags are represented so the reel isn't twelve versions of the cake, and when things were uploaded so the story runs roughly in order.
It picks around sixteen moments, decides how long each should hold on screen to hit the target length, and hands that running order to a media service that stitches the actual video file. No generative model touches your wedding. The recap is curation, not fabrication — and for a video of your real day, that's the correct choice.
How This Compares to What You're Probably Doing Now
| What you need | WhatsApp group | Shared cloud folder | Momento App album |
|---|---|---|---|
| Guest has to install or sign in | Already installed, but not everyone is in the group | Usually needs an account | Nothing — it opens in the browser |
| Photo quality | Heavily compressed | Original | Original, with iPhone HEIC converted for everyone else |
| Everything in one place | Buried between messages | Yes, if people remember the link | Yes — one album per event |
| Works for 200 guests | Group chat chaos | Permissions become a chore | Designed for it |
| Find photos of yourself | Scroll and hope | Scroll and hope | Selfie search |
| Printable signage for the venue | No | No | Welcome sign, table cards, poster |
| Who can see it | Whoever is in the group | Whoever has the link, forever | Link, password, or a named guest list |
Find the Version of This Built for Your Event
The plumbing above is the same everywhere. What changes is the wording on the sign, the shape of the album, and what guests are actually doing when they pull their phones out. Each page below covers one of those in detail.
Frequently asked questions
Do my guests need to download an app?
No. The album opens in whatever browser is already on their phone. This is a deliberate engineering decision, not a shortcut: every extra step between scanning a code and uploading a photo loses guests, and an app-store trip plus a sign-up loses a lot of them. The browser already has a camera-roll picker and a file uploader built in.
Are the photos compressed like they are in WhatsApp?
No. Files travel from the phone to storage in their original quality, up to 50 MB per file. The only conversion that happens is turning Apple's HEIC format into a universal JPEG, so that guests on Windows machines and older browsers can actually open what the iPhone users uploaded.
Can videos be uploaded, or only photos?
Both. Common video formats including MP4 and the format iPhones record in are supported, alongside JPEG, PNG, WebP, HEIC, AVIF, GIF and more. The 50 MB per-file ceiling means very long 4K clips may need trimming first; a typical 30-to-60-second phone clip fits comfortably.
Who can see my event album?
Whoever you decide. Albums are private by default and reachable only through the link or QR code you share — there's no public directory to browse. You can add a password, or restrict access to a specific list of email addresses, where each guest confirms with a six-digit code sent to them.
What happens to the selfie I use to find my photos?
It is used for that one search and then it's gone. It is never stored, never added to any collection, and never used to identify you anywhere else. Face data from event photos is kept per-event, so it can never be matched across different events, and deleting an event removes it entirely.
What if the venue Wi-Fi is terrible?
Uploads go one file at a time with a live progress bar, so a weak connection makes things slower rather than breaking them, and a failure affects one photo rather than the whole batch. Because photos go directly from the phone to storage rather than through an intermediate server, there's one fewer hop that can time out.
The short version
A QR code is a link. The browser is the app. The photos take the direct road to storage while the servers handle only the paperwork. Privacy is three specific doors rather than one vague adjective. And the highlight reel is honest curation of your real photos rather than something a machine dreamed up.
None of that is visible to a guest at your reception, and that's the point. Good engineering, at an event, looks like nothing happening at all — just a table card, a scan, and a shared album that quietly fills up with the night you'd otherwise have only half of.
