That’s messed up. Just on the basis of it being a picture of a different door is grounds for a refund, that clearly shows they did not deliver it to the address they were paid to deliver it to. Super frustrating and I hope it all gets worked out for you.

I know you mentioned Nextcloud and if you happen to already be running it you can use the add-on/module/whatever called Secrets, its exactly what you describe. You make note, send link (can password protect if you want) and once its been viewed its gone.

If you don’t already have Nextcloud, check out vaultwarden’s (bitwarden) send feature.