Privacy and your data
This page says exactly what the site keeps about you and who can see it.
When you sign in with Google
- Google tells us your name, email address, profile picture and a Google account number. We never see your password.
- These are kept in one sign-in cookie in your browser for up to 7 days, so you stay signed in. Logging out removes it.
- We keep a customer record for everyone who signs in: the Google account number, your email address, your name, and the dates you first and last signed in. Only the people who run this site can see it. It is used to show which templates you own, to help you if something goes wrong, and for nothing else.
- The pages the people who run this site use to manage accounts do not show what is in your invitations, photos, guest lists or guest replies. They show your customer record, the templates you own, and your orders: the template and size, what you paid, what was refunded and when. To deal with a refund or a fault they also show two facts about an invitation: whether any guest has been emailed from the site, and how many replies it has received.
- You can close your account. Your invitations go offline at once. Everything is kept for 7 days in case you change your mind, and we can reopen the account if you ask in that time. After 7 days, or within a few days after that, these are erased for good: your customer record, your invitations, photos, guest lists and guest replies, and the list of templates you owned. Order records and the notes of what the people who run this site did are kept, with your account number removed so they no longer point to you.
- Your invitations are stored against the Google account number. Your email address is stored with an invitation only if you enter it to receive guest replies by email; guests never see it.
Your invitations
- An invitation holds only what you type into the editor and the photos you add.
- Photos are shrunk in your browser before upload. This also removes hidden details such as the camera model and where the photo was taken.
- A draft is visible to you alone. Before you sign in, it is kept only in your own browser.
- A published invitation can be opened by anyone who has its link. The link is long and random, and search engines are asked not to list it.
- Photos of a draft can be opened by you alone; photos of a published invitation by anyone with the link.
- You can unpublish or delete an invitation at any time. Deleting removes it, its photos, its guest list and its guest replies from our storage.
- An invitation that is not published and has not been paid for is deleted automatically, together with its photos, guest list and guest replies, no sooner than four months after it was last saved, and only after we have emailed your sign-in address two weeks before. This applies while the site is free to use as well: an unpublished invitation left unsaved for four months is treated the same way. If that email cannot be sent, the draft is not deleted. My invitations shows the date it is kept until. Published invitations, invitations made before payments existed, and anything paid for or unlocked with a gift code are never deleted this way.
Your guest list
- If you upload a spreadsheet of guests, it is read in your own browser and is never sent to us. Only the guest names and email addresses found in it are saved; other columns, such as phone numbers, are ignored.
- We keep each guest's name, their email address if you gave one, whether you have marked them as done, and a random code that makes their personal link.
- A guest's email address is used for one thing: sending that guest their invitation link when you press Email. It is never shown on the invitation and is never used for anything else. When the site sends the email, it goes through Google's Gmail service, and a guest's answer to it goes to your own Google address, which the guest then sees.
- Only you can see the whole list. A personal link shows that one guest's name on the invitation to whoever opens the link, so send each link only to the person it is for.
- You can remove one guest or the whole list at any time. A removed guest's link then opens the invitation without a name.
If you are a guest replying to an invitation
- We keep what you enter in the reply form: your name, whether you are coming, how many guests, and your message.
- Only the couple who made the invitation can read replies. They are not shown on the page. If the couple asked for email notifications, your reply is also emailed to them, through Google's Gmail service.
- We set no cookie when you view an invitation or reply, and we do not keep your IP address. To stop abuse, we count replies per visitor for one hour using a scrambled code that cannot be turned back into an address.
- If you opened a personal link, your reply is matched to your name on the couple's guest list.
- If a couple emailed you an invitation, they gave us your address for that purpose only. We send at most three emails to you per invitation and nothing else. Ask the couple to remove you from their list to have your address deleted.
- To have a reply removed, ask the couple; they can delete it from their account.
- If your name appears on an invitation and you would like it removed, ask the couple; they can remove you from their guest list.
If you buy a template or use a gift code
- Payment is made on the secure page of our payment partner, Polar (polar.sh), which is the seller of record. Polar takes your card details, works out any tax and sends your receipt. We never see or store your card number or billing address.
- To start the payment we send Polar your email address, so you do not have to type it again; your Google account number, so the paid order can be matched to your account; a random code that says which invitation the payment is for; and what you are buying: the template, the guest-list size and its price. We do not send Polar your name, anything written in your invitation, your photos or your guest list.
- We keep a record of each order: Polar's order number, your Google account number, the invitation it was for, the template and guest-list size it bought, the amount, the currency, the dates, and whether it was paid or refunded. This record is kept even if you delete the invitation, because it is a financial record.
- When Polar tells us an order was paid, its message also contains your name and billing details as Polar holds them. We read only the items listed above and keep none of the rest.
- We keep a list of the templates your account owns: the template, the number of guests it covers, the invitation it is used on, when you got it, and how (a purchase, a gift code, or given to you by us). If a purchase is refunded, the entry is marked as withdrawn; it is not erased.
- Gift codes are kept only in a scrambled form that cannot be turned back into the code. When you use one, we record that your account used it.
- When the people who run this site give or withdraw a template, create a gift code or change a price, a note is kept of what was done, when, by whom and to which account, so that mistakes can be traced. These notes are kept for 2 years and then deleted.
- This section applies only once payments are switched on. Invitations made before then stay free.
What we do not do
- No advertising, analytics or tracking scripts.
- No selling or sharing of your details.
- Nothing is loaded from other companies except Google's sign-in button, on the pages where you can sign in. Guests opening an invitation load nothing from Google.
Questions and requests
- To ask what we hold about you, to have something corrected or removed, or to reopen a closed account within its 7 days, email [email protected] from the address you signed in with. We answer within 5 working days.
Where it is kept
The site and its storage run on Cloudflare. Connections are encrypted (HTTPS only).