Moderating customer photos: approve, reject, delete

A customer-photo form is easy to switch on and slightly nerve-racking to live with, because the question is never whether photos will arrive but what happens to the ones you did not ask for. Snug Gallery answers that with a moderation queue, three tabs and five buttons. This guide goes through each of them, in the order a photo meets them, and says exactly what is written, deleted or kept at every step, so you can run the queue in a minute a day without wondering what a click just did.

What arrives, and what is checked before you see it

The Share your photo button under a gallery opens a small form: a file, an optional display name, an optional caption and a consent checkbox. When the shopper submits it, the request travels through your own store domain as a Shopify app proxy call, which Shopify signs, so Snug Gallery knows which store it came from and that it was not forged from elsewhere.

Several things are checked before anything is stored. The consent box must be ticked, or the shopper is asked to confirm it. The file is read by its first bytes, not its name or the type the browser claims, and must be a JPG, PNG, WebP or HEIC under 10 MB; anything else is refused with a message naming the accepted formats. A hidden field that real shoppers never see is checked for content, and a bot that fills it is told its photo is awaiting review while nothing is saved at all. The display name is trimmed to 80 characters and the caption to 500, with control characters stripped. And the gallery must have Accept customer photos switched on and the store must be on a paid plan, or the form answers that this gallery does not accept customer photos right now.

Then two rate limits apply: five submissions per hour from the same address, and sixty per hour across the whole store. A shopper over the limit sees a polite request to try again later. The address itself is never stored; a salted one-way hash of it is kept on the submission so that abuse can be recognised without keeping personal data. If the store-wide limit is what stops a submission, the shopper's own slot is handed back, so one flood does not burn every honest visitor's allowance.

Only after all of that is the file uploaded to Shopify Files, renamed to a neutral customer-photo name with the right extension, and a submission record created in your store as a metaobject. The record holds the gallery, the file, the name, the caption, the status, the time, the consent flag and the hashed address. Nothing lives on Beacon Wave Studio's servers; uninstalling the app leaves the records and files in your store, where you can delete them yourself.

The three tabs

The Customer photos page in the app has Pending, Approved and Rejected tabs, each with a count. Every submission is in exactly one of them. Each row shows the thumbnail, the display name (or Anonymous when the shopper left it blank), the caption, the gallery it was sent to and when it was submitted; consent is required at submission, so every row you see was consented to. There is a select-all checkbox at the top and one per row, and the buttons that appear depend on the tab you are on, because each status has different things that make sense to do to it.

Approve selected

Available on the Pending tab. Approving does two things, in this order: it adds the photo to the gallery it was submitted to as a regular gallery image, and then it marks the submission approved. The new gallery image gets the whole caption as its caption text, the first line of the caption, up to 255 characters, as its alt text, and the display name as its submitted-by field, which is what the block's Show names setting reads. If the shopper typed no caption, the alt becomes Photo by followed by the name, or Customer photo when there is no name either. You can edit all of that afterwards exactly as you would for an image you uploaded yourself; the captions guide explains which field appears where.

Two things can stop an approval, and both are reported rather than silently dropped. If the gallery has since been deleted, the submission is skipped with the reason that its gallery no longer exists. If the gallery is already at your plan's image limit, the submission is skipped with the gallery's name and the reason, and stays pending so you can approve it after making room or upgrading. The toast after a bulk approve says how many photos were added and how many were skipped, with the reasons listed once each.

Approval is safe to repeat. If a previous attempt added the image to the gallery but failed before the status was updated, approving again sees the file already in the gallery, does not add it twice, and simply fixes the status.

Reject selected

Also on the Pending tab. Rejecting deletes the uploaded file from Shopify Files first, then marks the submission rejected. The order matters: if the file deletion fails for any reason, the submission stays pending, and rejecting it again retries the deletion. You never end up with a record that says rejected while the file still sits in your Files library.

What remains after a rejection is the record: name, caption, time, hashed address and the fact that it was declined. That record is why a rejected photo is not reviewed twice, and it is the evidence you would want if a submitter later asked what happened to their photo. The toast reads that the photos were rejected and removed from Files.

Delete selected permanently, and Remove selected records

These are the same action with two labels, because what it does differs by tab. On the Rejected tab the button is Delete selected permanently: it removes the submission records, and since those submissions never made it into a gallery, any file still attached to them is deleted too. Use it to clear the rejected list once it has served its purpose.

On the Approved tab the button is Remove selected records. It deletes the submission record only. The gallery image created at approval stays, and so does its file, because that file now belongs to the gallery, not to the queue. Removing an approved record is housekeeping for the moderation page, not a way to take a photo down; to remove an approved photo from the storefront, delete it from the gallery like any other image.

Auto-approve, and when it quietly falls back

In the gallery editor, next to Accept customer photos, there is an Auto-approve checkbox; it is only active once accepting is on. With it ticked, the approval described above runs immediately when a submission passes the checks, and the shopper is told their photo has been added to the gallery.

Auto-approve does not bypass the limits. If the gallery is at the plan's image cap, or anything else prevents the approval, the submission stays pending for you to review and the shopper sees the awaiting-review message instead. So a gallery with auto-approve on still deserves a glance at the Pending tab now and then, because that is where the overflow lands.

Whether to use it is a judgement about your audience. A gallery of hats on customers at a small brand with a hundred orders a month can run on auto-approve with a weekly look at the Approved tab for anything off-brand. A gallery promoted in a parcel insert to tens of thousands of customers should start on manual review for a few weeks, and the guide on owning your customer photos makes the case for starting strict and loosening later.

A one-minute daily routine

Open Customer photos. On Pending, select everything that belongs on the storefront and approve; read the toast for skips. Select what does not belong and reject; the files are gone before the toast appears. Once a month, open Rejected and delete permanently to keep the list short. Leave Approved alone unless you want the moderation page tidy. If a shopper asks you to take their photo down, remove it from the gallery and then, if you like, remove the record. That is the whole job.

Frequently asked questions

Where are customer photo submissions stored?

In your own Shopify store. The photo is uploaded to Shopify Files and the submission is a metaobject holding the gallery, file, display name, caption, status, time, consent flag and a salted hash of the submitter's address. Nothing is kept on the app's servers, so the records stay with you if you uninstall.

What happens to the file when I reject a customer photo?

It is deleted from Shopify Files before the submission is marked rejected. If the deletion fails, the submission stays pending so rejecting again retries it. The record of the rejection, without the file, remains on the Rejected tab until you delete it permanently.

Does removing an approved record delete the photo from my gallery?

No. Approval creates a normal gallery image that owns the file from then on. Remove selected records on the Approved tab only clears the moderation entry. To take an approved photo off the storefront, delete it from the gallery in the gallery editor.

Why is an approved submission still showing as pending?

Most often the gallery is at your plan's image limit, so the approval was skipped and the toast said so. Free up space or upgrade and approve again. The same happens with auto-approve: when the gallery is full the submission falls back to pending and the shopper is told it is awaiting review.

How many customer photos can one shopper submit?

Five per hour from one address, and the store as a whole accepts sixty per hour. Beyond that the form asks the shopper to try again later. Both limits reset on a rolling one-hour window and exist to stop floods, not to cap a genuine customer who sends a handful of photos.