Privacy

What is stored

For an account: a name, an email address, a password (as an Argon2id hash - the password itself is never stored), a language, a timezone, and the address and time of the last sign-in.

For an event: whatever the organizer puts into it, and the guest list they build. A guest entry can hold a name, an email address, a phone number, a household, dietary notes and allergy notes.

Counting visits

The public pages count how often they are read. There is no cookie and no third party involved: a visit adds one to a daily total, and the only record of a person is a keyed hash of their network address and browser, which exists so the same reader is not counted twice in one day. The key changes every day, so today’s hash cannot be matched against yesterday’s, and the hashes are deleted within days. Nothing kept here can say who read what. Event pages are not counted at all. Presses are counted the same way: pressing a button on a public page adds one to a daily total for that button, from the same daily hash, with nothing about who pressed it. Nothing is counted on a party page - those belong to the organizer, not to us.

Who can read a guest list

The organizer, and anyone they have explicitly invited as a co-host. Contact details and dietary or allergy notes are separate permissions that are not part of a co-host invitation by default - they have to be granted on purpose.

Platform staff cannot read guest lists. The administration console works on accounts, plans and abuse reports: it can see that an event exists, who owns it and how many guests it has, and it can take an event off the public web after a report. It has no screen that lists guests.

Guests

A guest never makes an account. They are identified by the personal link they were sent, which is a random token; only its hash is stored, so the link cannot be reconstructed from our database. Replying records the answer, the head count, and a hashed form of the network address the reply came from - enough to notice one machine answering for a whole list, and not enough to locate anybody.

How long things are kept

• Sign-in sessions: until they expire, and removed a week later.
• Password and confirmation links: one hour to three days, then removed.
• A deleted event: recoverable for 30 days, then permanently deleted with its guest list.
• A closed account: recoverable for 14 days by signing in again, then permanently deleted.
• The activity log: about 13 months.

What is never logged

Passwords, session tokens, invitation tokens and payment details are redacted from the application log wherever they appear. Allergy and dietary notes are never written to the activity log or included in an export unless the person exporting has been given that permission.

Asking for a copy, or for deletion

An organizer can export their own guest list at any time, and deleting an event or closing an account deletes the data on the schedule above. For anything else, write to hello@togetherwe.party.