Privacy Policy

rsvp-ify ("we," "us," or "our") operates the rsvp-ify web application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy. Our Service is designed to collect only the minimum information necessary to function. We do not require accounts, do not track you across the web, and do not sell your data.

Information You Provide Directly

When you use our Service, you may voluntarily provide:

• Event Creation Data: Event title, date, time, location, description, cover image URL, and guest capacity. No personal information is required to create an event.
• RSVP Data: Your name and attendance status (going, maybe, or can't go) when registering for an event.
• Comment Data: Your name and comment text when posting in an event discussion.

Information Collected Automatically

We collect minimal technical information automatically:

• Theme Preference: Your light/dark mode selection, stored locally in your browser (localStorage). This data never leaves your device.

We do not use cookies, analytics trackers, advertising pixels, or any third-party tracking technology.

We use the information we collect exclusively to:

• Display event details on event pages
• Show RSVP responses to event visitors
• Display comments in event discussion sections
• Deliver real-time updates when new RSVPs or comments are submitted
• Enforce guest capacity limits on events

We do not use your information for marketing, advertising, profiling, analytics, or any purpose beyond operating the Service as described.

Your information is shared only in the following limited circumstances:

• Public Event Pages: When you RSVP or comment on an event, your name and response are visible to anyone who visits that event page. This is the core functionality of the Service.
• Infrastructure Provider: Your data is stored on Supabase (a database hosting provider) which acts as our data processor. Supabase processes data on our behalf and is contractually obligated to protect your data. See their privacy policy at supabase.com/privacy.
• Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.

We do not sell, rent, or trade your personal information to any third party.

We do not use cookies.The only client-side storage we use is a single localStorage entry ("rsvpify-theme") to remember your light/dark mode preference. This data is stored entirely on your device and is never transmitted to our servers.

We do not use any analytics services, advertising pixels, session replay tools, or any form of cross-site tracking.

• Event Data: Retained until the event host deletes the event. When an event is deleted, all associated RSVPs and comments are permanently and immediately removed.
• RSVP & Comment Data: Retained for the lifetime of the associated event. Automatically deleted when the event is deleted.
• Theme Preference: Stored in your browser's localStorage indefinitely until you clear your browser data.

We implement appropriate technical measures to protect your data, including:

• All data transmitted over HTTPS (TLS encryption in transit)
• Host tokens are cryptographically hashed (SHA-256) before storage — we never store raw access tokens
• Constant-time token comparison to prevent timing attacks
• Server-side validation on all user inputs
• No user accounts or passwords to be compromised

While we use reasonable measures to protect your information, no electronic transmission or storage method is 100% secure. We cannot guarantee absolute security.

You have the following rights regarding your data:

• Deletion: Event hosts can delete their events at any time, which permanently removes all associated data (RSVPs, comments). There is no account to delete as we don't require registration.
• Access: All RSVP and comment data is publicly visible on event pages. There is no hidden data profile.
• Correction: Since there are no accounts, you may submit a new RSVP with corrected information.
• Data Portability: Event data is accessible via the public event page.

If you have specific data requests, contact us at the address listed below.

Our Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

Your data may be processed and stored in servers located outside your country of residence. By using the Service, you consent to the transfer of your information to facilities and servers outside your jurisdiction. We ensure appropriate safeguards are in place for such transfers.

If you are located in the European Economic Area (EEA) or United Kingdom:

• Legal Basis: We process your data based on legitimate interest (operating the Service you choose to use) and your consent (voluntarily submitting information).
• Rights: You have the right to access, rectify, erase, restrict processing, and port your data. You also have the right to object to processing and to lodge a complaint with a supervisory authority.
• Data Minimization: We collect only the data strictly necessary for the Service to function.

If you are a California resident:

• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising.
• You have the right to know what data we collect, request deletion, and opt out of any sale (though we never sell data).
• We will not discriminate against you for exercising your privacy rights.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, you can reach us through the Service or by visiting our project repository. As we are a free, open-source project, we respond to privacy inquiries as promptly as possible.