PIN and security

A Client PIN is the 6-digit PIN the studio shares with the main client. It gives full rights: view, select, submit, download the share quota, create share galleries and request deletion. The studio shares the gallery link and PIN as separate WhatsApp messages, and can change the PIN at any time.

After 5 wrong PIN attempts, the gallery locks for 15 minutes. This applies to the Client PIN and to share-gallery PINs, which makes guessing impractical. If a PIN leaks, the studio can change the Client PIN, and the old one stops working at once.

The studio can change the Client PIN, and every session using the old PIN ends immediately. If a share-gallery PIN leaks, the client can disable that share gallery, or the studio can disable all share galleries for the event in one tap. Active downloads on revoked access are also cut.

No. Galleries show only web-quality watermarked previews, and full-quality files are never reachable through any gallery or share link. Full quality is released only after the studio confirms payment and approves the exact final files. Right-click and long-press are blocked, though no app can honestly promise screenshots are blocked.

No, and Pikvaa never promises that. Pikvaa blocks right-click and long-press, shows only watermarked web-quality previews, and never exposes full-quality files before release. A screenshot captures only a low-resolution watermarked image, so your finished work stays protected until payment. Clean files arrive only after release.

The OTP goes to the main client's phone so that only they can lock the final selection. A relative cannot submit without the client knowing. The OTP record, with time and version, also gives the studio proof of what was chosen if there is ever a dispute.

Login uses phone OTP. Each person can have at most 3 active devices, and the Owner is alerted on any new device login. Sensitive actions such as payments, release and deletion ask for a fresh OTP if the last check was over 12 hours ago. Idle sessions log out after 60 days.

Remove the device from Settings, Devices and its session ends at once. A stolen phone used offline is rejected the next time it reaches the server. If you lose your number, a recovery request checks ID proof, waits 72 hours with notices to the old number and email, and is reviewed by the platform.

Only if their role allows it. Photographers see their assigned events and schedule but no amounts or client phone numbers. Editors upload finals and see selections but cannot publish or release. Freelancers never see payments, the CRM or client phone numbers. Billing and deletion are Owner-only.

No. Each studio's data is isolated, and cross-studio isolation is tested for every gallery, download, API and background job. An Owner sees and controls only their own studio's sessions, even when a freelancer works for several studios. Platform admins cannot see photos or client data without the Owner's support access.

Only with your permission. You grant support access for 1 hour, 24 hours or 3 days. Support sees settings, events and errors, with photos blurred unless you allow them. Support can never delete, release, mark payments or message clients, every action is logged, and you can end access in one tap.

Yes. Every payment entry, cancellation, approval, release, undo, deletion, role change, PIN change, device logout and support access is recorded with who, when and what. Audit entries cannot be edited. Audit logs are kept 1 year and payment and invoice logs 8 years, and logs never contain photos.

Yes. The studio can disable all share galleries for an event in one tap, for example if a share PIN spreads too widely. The client controls individual share galleries and can rename, edit, disable or delete each one. Share-gallery viewers can only view and heart photos.

Their access to your studio ends instantly on every device, and they are removed from future shoots, with the Owner alerted. If their app is open offline, the session is rejected the next time it contacts the server, so no new downloads are possible. Their past audit entries remain.