Privacy Policy

This policy describes what Friends RSVP collects, how it is used — including for advertising and analytics — and when it may be shared or sold to third parties. It applies to hosts, to guests who reply to an invitation, and to anyone who visits our public pages.

What we collect

Hosts. The event details you enter (title, date, place, description, design) and your email address if you provide one. If you create an account we store your email address, your name if you give it, and your profile image if you sign in with Google or Apple. Passwords are stored only as a one-way hash — we never hold your password itself and cannot tell you what it was.

Guests. Your name, your reply, any dietary note or message you leave, and your email or phone number only if you provide them. If you claim a bring-list slot or a gift, we record which one so others can see it is taken. A guest does not sign up for Friends RSVP or agree to anything directly — a host invites you, and the information above is what you or your host enter about your attendance at that host's event.

Phone numbers. If you give a phone number, we record that you consented to be texted and when, so that consent can be demonstrated. Numbers are used only to send the invitation for the event you were invited to.

Payments. Card details are handled entirely by Stripe. They never reach our servers. We store only a Stripe customer identifier and your subscription status.

Technical and usage information. We record the IP address that creates an event or submits a reply, and we count requests, so that we can rate-limit abuse and block it. Where analytics is switched on for a deployment (see Cookies, below) we also collect device, browser and interaction information about visits to our public pages. When you sign in as a member of staff we also record the IP address with the action, so that staff actions can be audited.

Sensitive information. A dietary note is the one category of what we collect that several state laws class as sensitive (it can reveal a health condition, a religious observance, or similar). We do not ask for government ID, precise geolocation, biometric data, or financial account numbers, and do not collect them. See “Sensitive personal information” below for the extra right this creates.

How we use information

Beyond running the service itself — sending the invitations you ask us to send, showing a host their guests' replies, processing a subscription — we use the information above, and permit our advertising and data partners to use it, to:

• measure and improve Friends RSVP and understand how it is used;
• personalise and measure advertising, including ads shown by us or by partners on other services, and including profiles built from your activity across sessions and, where a partner links it, across other services they work with; and
• develop aggregated, de-identified, or statistical products and insights, which we may license, share or sell without further restriction because they do not identify you.

We and JetFuel AI may also share or sell personal information itself — not only aggregated data — to advertising partners, data partners and other third parties, in exchange for money or other value, as described in “Sale and sharing of personal information” below. That section, not this one, is where the opt-out right lives, and it applies to everything in this section.

Who we share it with

We use a small number of service providers to run the app:

• Resend — delivers invitation and notification emails.
• Twilio — delivers text messages, only if you are a subscriber sending texts and the recipient gave a number.
• Stripe — processes subscription payments.
• Google Analytics — counts visits to our public pages, when it is switched on for this deployment. It is never loaded on an invitation page, a reply page, or a host dashboard, because the web address of those pages is the credential that grants access to them.
• Advertising and data partners. Where we work with advertising networks, data partners or brokers, we may disclose the categories of information described above to them, including by sale, as described in the next two sections. We do not name specific advertising or data partners in this policy because the set of partners changes; the categories of information and the opt-out below do not change without notice.
• Our hosting provider — runs the servers and the database.

When a guest taps a gift link, they are sent to the retailer's own website, which sets its own cookies and has its own privacy policy. See “Gift links and affiliates” below.

We disclose personal information if the law requires it, or where it is necessary to investigate abuse of the service.

Who can see your data

Beyond the service providers above, access is limited to the operator of Friends RSVP. A small number of staff accounts can access a private administrative panel that shows account and event records and can act on them — for example, to remove an abusive account or to resolve a billing problem. Access to that panel is restricted to explicitly configured staff accounts, requires a second factor, and every action taken there is recorded in an audit log with who did it, when, and what changed.

Hosts can already see their guests' replies and any contact details guests gave them — that is the purpose of the service. A guest's reply is shared with the host of the event they replied to, and with other guests only to the extent the host has chosen to show the guest list.

Advertising

We may show advertising on our own public pages, and we and our partners may use the information described above — including how you use Friends RSVP, and information gift links or retailer redirects generate — to select and measure ads, on Friends RSVP and on other services. This can include interest-based or “retargeted” advertising, where an ad you see elsewhere is chosen because of something you did here.

Ads are not shown on the invitation or RSVP pages your guests open — no advertising code runs there, on any plan. Advertising, where it exists, is on our own marketing pages and through the sharing described above, never inside the invitation itself.

Sale and sharing of personal information, and your opt-out right

Several state privacy laws define “sale” broadly: disclosing personal information to a third party for money or any other valuable consideration counts, even if no cash changes hands. Under that definition, we do and may in the future sell and share the following categories of personal information, for the purposes described above:

• identifiers (name, email address, phone number, device and IP information);
• commercial and event information (RSVP responses, bring-list and gift-registry activity, which invitations you interact with);
• internet or network activity (how you use the service, what you click); and
• inferences drawn from any of the above, such as interests derived from event or gift activity.

We do not sell or share sensitive personal information (see the next section), and we do not sell or share information we know relates to a guest under 13 (see “Children's information”, below) — those two categories are excluded from everything in this section.

Your right to opt out. If the law where you live gives you the right to opt out of the sale or sharing of your personal information, you can exercise it at any time, at no cost, by emailing [email protected] with the subject line “Do Not Sell or Share My Personal Information” and telling us which email, phone number, or event you are asking about. We will confirm the request and stop selling or sharing your information going forward. We do not currently detect automated opt-out signals such as Global Privacy Control in the browser — if that matters to you, use the email request above, which we do honour.

We will not deny you service, charge a different price, or provide a different level of service because you exercised this or any other right in this policy.

Sensitive personal information

A dietary note you or a guest enters is sensitive personal information under some state laws. You have the right to limit our use of it to what is necessary to provide the bring-list feature you used it for — we do not use dietary notes for advertising, and do not sell or share them. To exercise this right explicitly, or ask what we hold, email [email protected].

Children's information

Friends RSVP is not directed at children under 13, accounts require you to be at least 13 (see the Terms of Service), and we do not knowingly collect personal information directly from a child.

A host may nonetheless include a child as a guest — a kids' birthday invitation is one of the occasions the service is built for, and a parent or another adult host typically adds the child's name (and sometimes a dietary note) to the guest list on the child's behalf. We cannot always tell that a guest record relates to a child, but where a host has marked an event as a children's occasion, or otherwise tells us a guest is a minor, we exclude that guest's personal information from the advertising, sale, and sharing described in this policy, regardless of what the rest of this policy otherwise permits. We do this because a Terms of Service or Privacy Policy cannot substitute for the verifiable parental consent that US federal law (COPPA) requires before a child's personal information is sold or used for behavioural advertising, and we would rather exclude a category of data than rely on a legal basis we do not have.

If you are a parent or guardian and believe a child's information has been added to the service and you would like it removed, email [email protected] and we will remove it.

Emails we send you

We send transactional email: invitation and reminder emails to guests, and account-related email to hosts — including a verification code when a staff account signs in to the administrative panel. We may also send marketing email about Friends RSVP to a host who has an account, with an unsubscribe link in every message; guests are not added to a marketing list from replying to an invitation.

Gift links and affiliates

Where we take part in an affiliate programme, gift links on a wishlist may pass through our own domain on the way to the retailer, so that a commission can be attributed to us. That redirect records which link was followed and which item was clicked, both of which are personal information handled as described in the rest of this policy — including, where applicable, the sale and sharing described above. Retailers may also set their own cookies once you arrive at their site, under their own privacy policy, which we do not control.

Cookies

We set a session cookie when you sign in, which is what keeps you signed in. It is strictly necessary for the service.

Staff accounts that pass the second factor get one additional short-lived cookie recording that the second factor was satisfied, so it is not demanded on every page.

If analytics is switched on for this deployment, Google Analytics sets its own measurement cookies on our public pages to tell a returning visit from a new one. Those cookies are not set on an invitation page, a reply page, or a host dashboard — the analytics tag is not loaded there at all. If we or an advertising partner add advertising or remarketing cookies in the future, they will be described here, on our public pages only, and never on an invitation, reply, or host-dashboard page. Blocking cookies in your browser does not stop you from replying to an invitation or creating one.

Guest lists

By default a guest can see how many people have replied, but not who. A host can change this per event.

Links

Anyone holding a host link can edit the event and see every reply. That is what makes the app work without accounts, and it is also why the host link should be treated as a password.

How long we keep it

Event data is kept while the event exists. Deleting an event removes its guests and their replies with it. Subscription and payment records are kept as long as tax and accounting rules require. Records of abusive behaviour and the staff audit log may be kept after an account is closed, because they exist to prevent repeat abuse and to account for actions taken. Aggregated or de-identified data derived from personal information may be kept indefinitely, because it no longer identifies you. Ask us to delete your account and we will remove your personal data, except what we are required to retain.

Your choices

You can reply to an invitation without giving an email address or phone number. You can reply STOP to any text message to opt out. To access, correct, or delete your data, or to opt out of the sale or sharing of your personal information, email [email protected].

Your rights

Depending on where you live, you may have the right to know what personal information we hold about you and where it came from, to have it corrected, to have it deleted, to opt out of its sale or sharing, to limit the use of sensitive personal information, to object to or restrict certain processing, and to receive it in a portable form. To exercise any of these, contact us at the address above. We will not discriminate against you for exercising a right — we will not deny service, charge a different price, or provide a different quality of service because you did. We will respond as the applicable law requires, and we will not charge you for a reasonable request. If you believe we have handled your information badly, you can complain to your local data protection or consumer protection authority.

Security

Passwords are hashed, staff access is restricted and requires a second factor, and the private pages of the app are reachable only with the credential in the link. No system is perfect, and this one is in development — if you believe your data has been exposed, tell us at the address below and we will investigate.

International transfers

Our service providers may process and store your information in other countries. Where they do, we rely on the safeguards those providers have in place for transferring data, such as standard contractual clauses.

Changes to this policy

If we change how we handle personal information, we will update this page and change the date at the top. If the change is significant — including expanding the categories of information we sell or share — we will give you notice before it takes effect.

Contact

Questions about privacy, or to exercise any of the rights in the section above: [email protected]. See also Terms of Service and the End User Licence Agreement.

Friends RSVP is a product of JetFuel AI.