Two ways to hide a photo

Hide it in the interface. The photo is uploaded and sent back down to phones like any other. The app draws a blur over it, or a lock, or a countdown. This is quick to build. It is also a promise the app is making to itself. Anyone who screenshots the right screen, inspects the network traffic, or opens the app’s cache can see the photo early. Hosts often get a special view.

Do not deliver it. The photo is uploaded and stored. Until the develop time, the server answers every request about the roll with names and frame numbers and nothing else. There is no photo on any phone because none was sent. There is nothing to blur. When the time comes, the server starts including photo addresses in its responses and the roll opens for everyone at once.

What Kept does

Kept does not deliver. Before a roll develops, the API leaves photo URLs out of every response, to everyone. The host does not get a preview. The guest who took the photo does not get a preview. Inspecting the traffic shows a list of guest names and frame numbers, which is exactly what a real disposable camera would tell you: whose it is and how many are left.

The one exception is deliberate. A host can develop the roll early from their phone. This is immediate, cannot be undone, and opens the roll for everyone at the same moment. There is no way to open it for one person.

Why it matters

  • Guests behave differently. If people believe the reveal, they stop checking. If they suspect a host can peek, they shoot for the host.
  • The moment is real. Everyone opens the roll at the same second, including the couple. Nobody has seen it first.
  • Privacy is structural. A photo that was never delivered cannot leak from a phone that never had it.

How to test any app

  1. 01

    Take a photo on a fresh roll

    Then look for any place in the app where the host or the photographer can see it before the develop time. A “preview” or “host view” means the photo is on the device.

  2. 02

    Turn on airplane mode after shooting

    If a blurred thumbnail still appears, the image was downloaded. A real reveal shows nothing, because nothing arrived.

  3. 03

    Read the documentation

    An app that never delivers photos early will say so plainly, because it is the hardest part of the product to build and the easiest to be proud of. Kept’s docs describe it under “How the reveal actually works”.

Questions

Can the Kept host see photos before the roll develops?
No. The server does not send photo addresses to anyone before the develop time, including the host. The host can develop the roll early, which opens it for everyone at once.
Can the person who took a photo see it?
No. The photographer sees their frame counter go down and nothing else until the roll develops. It is the same for everyone.
Where are the photos before they develop?
Stored encrypted on AWS S3 in us-east-1, with addresses withheld from every API response until the develop time.
What if the roll never develops?
It always does. The develop time is set when the roll is created and defaults to the moment the roll closes, so a roll cannot be created without one. The host can bring it forward but not remove it.

Give everyone a camera. Take away the screen.

Free for your first 5 guests. Your first roll takes about a minute to set up, and nobody has to install anything.

Start a filmTry the demo filmDownload for iPhoneGet it on Google Play