What about guests who don't register, like kids or people who just won't do forms? Can they still find their photos?

Every guest needs to go through the same short registration — name plus email or phone — and upload their own selfie to get matches. That registration is what links a person to their private photo set and keeps the whole system secure, so there's no back door for unregistered browsing. For kids, a parent usually registers and uploads their own selfie, then downloads the kid's photos from their own matched set. For the rare guest who absolutely won't do the form, the full-access link is your fallback, but it hands over everything, so use it judiciously.