Who's allowed to buy and download when photos are paid?

The same privacy rule applies to sales as to everything else: guests can only access or download photos in which they appear. So someone can't browse the album and buy their cousin's photos — they're limited to their own matched set. The payment is collected before the download unlocks, so there's no honour-system risk of someone grabbing files and paying later. Clean, simple, and it respects everyone's privacy at the same time.