No. Joining someone's Wi-Fi does not give them access to your photos, messages, contacts or files. The network only carries your traffic, and most of that traffic is encrypted.
Think of the Wi-Fi owner as the postal sorting office. They can see where packages are going and how many there are, but the packages are sealed. Specifically, the owner of the router can usually see:
- The domain names your apps and browser contact (for example, instagram.com or a bank's app server)
- When you were online and how much data you used
- Your phone's device name and the MAC address it presented to that network
They can't see the contents of your WhatsApp chats, the emails in your inbox, the pictures in your camera roll, or what you type into an app, as long as the app uses encryption. The FTC says most sites and apps now encrypt data in transit, which is why ordinary public Wi-Fi use is usually safe.
Where the real risks are
The danger isn't the owner reading your phone; it's being tricked. A fake hotspot can show a login page asking for your email or social media password. The FCC advises confirming a hotspot's name with staff and turning off auto-join for nearby networks. Ignore any prompt to install a profile or certificate, since that is one of the few ways a network operator could start inspecting encrypted traffic.
Simple protections
Keep your phone's OS updated, leave the private Wi-Fi address feature on, and use a VPN such as NordVPN if you'd rather the owner not see even the domain list. Mobile data is another option for anything sensitive.