This page is a first draft for checking. Items marked for confirming are listed at the end.
Privacy
Draft of 13 October 2026
The short version. We keep what you type into an event page, so the page can work. We don’t show ads, we don’t use analytics or tracking cookies, and we don’t sell anything to anyone. Every event, and everything about it, is deleted automatically 90 days after the event.
Who we are
RSVP Me is run by [name of the person or business running it] in New Zealand. You can contact us at [contact email to add].
What we collect
If you host an event
- Your Google sign-in. When you sign in with Google, Google tells us your email address, your name and Google’s ID for you. Google also sends a link to your profile picture; our sign-in service keeps it with your sign-in record, but the site doesn’t use or show it. We never see your Google password.
- Your events. Everything you put on an event page: the title, your name as host, date and time, venue, address and map link, description, dress code, running order, look and emoji, cover photo, bring list, poll, menu and settings.
- Secret words. If you set a secret word, we keep only a one-way scrambled version of it. It can check a guess, but nobody can read the word back from it: not us, and not you as the host. The hint is kept as you typed it.
- Invite links. If you make a named invite link, we keep the label you give it (often a guest’s name) so you can see who has replied.
If you reply to an event
Guests don’t make an account and we don’t ask for an email address or phone number. We keep:
- your name, your reply (going, maybe or can’t) and any emoji you pick
- how many plus-ones you’re bringing and their names, if you give them
- your answers to any optional questions the host asks: what you’re bringing, a song, dietary needs and a note to the host
- if the host has a menu: each person’s food order, dietary needs, BYO bottles, whether they’re drinks only, and which shared dishes they’re in
- anything you claim on the bring list, and your poll vote
- which invite link you used, if any, and when you replied or changed your reply
If you say you can’t come, we keep only your name, your reply and any emoji. No plus-ones’ names, dietary needs, song or what you’re bringing are kept with a “can’t” reply.
If the event is full and you’re on the waiting list, your dinner order is kept so it’s ready if a spot opens. The restaurant’s order sheet only shows people who are going or maybe.
To let you change your reply later, your browser makes up a random private key. Your browser keeps the key; we keep only a scrambled version of it. If the host gives you a fresh link to your reply, that link carries a second key that works the same way.
If you’re the restaurant
Nothing. The order sheet link only shows information; it doesn’t ask for any.
From every visitor
To stop people hammering the site (for example, guessing secret words or order sheet links), we note the internet address of the device making certain requests: replies, secret word guesses, order sheet visits, new events and reports. Newer (IPv6) addresses are shortened to their network part first, which usually covers a whole household. These notes are used only for those limits and are deleted after two days at most.
If you report an event page, we keep what you wrote and your internet address with the report, so we can deal with it and spot misuse. Reports are deleted after 180 days, or sooner if the event is deleted.
Dietary needs
Dietary needs can say something about your health, like an allergy or coeliac disease. They’re always optional. Only the host and, if the host sends one, the restaurant’s order sheet can see them. Other guests can’t.
Who can see what
| Anyone with the event link | The title, date, time, host’s name, description, dress code, look and cover photo. These are public even when there’s a secret word. If there’s no secret word, also everything in the next row. |
|---|---|
| Guests (after the secret word, if there is one) | The venue and address, running order, bring list, poll results, menu and the reply form. The secret word hides all of these. If the host shows the guest list: other guests as first name and last initial (like “Aroha T.”), with their emoji, reply, number of plus-ones, song and what they’re bringing. Bring-list claims show the same short names. Poll votes are counted, not named. If the host turns the guest list off, guests see no other guests’ names anywhere. |
| Guests who are coming, when food ordering is on | To pick who they’re sharing a dish with: the other people at the dinner as first name and last initial. If the host has turned the guest list off, only their own people, and anyone else in a shared dish shows as “Another guest”. Also a count of how many people have ordered and the most popular dishes, with no names. |
| The host | Full names and everyone’s full reply, including plus-ones’ names, dietary needs, notes, food orders, bring-list claims and poll votes, and how many reports their event has had. |
| The restaurant, through its order sheet link | The event title, date, venue and host’s name, and for each person at the dinner who is going or maybe: their full name, who brought them, whether they’re a maybe, their food order, dietary needs, BYO bottles and whether they’re drinks only. Nothing else. The link stops working two days after the event, and the host can turn it off or replace it at any time. |
| Us | We can see what’s stored so we can run the site, fix problems and deal with reports. We only look when we need to. |
Anyone a guest or host forwards a link to can see what that link shows. A secret word helps if a link gets passed around.
What’s kept in your browser
We don’t use tracking cookies or analytics. The site uses your browser’s own storage for three things only:
- a guest’s private key for each event they reply to, and the invite link they came in on
- the secret word a guest typed, so they don’t have to type it again
- a host’s sign-in, so they stay signed in
Clearing your browser’s site data removes these. If a guest does that, they can ask the host for a fresh link to their reply.
When it’s deleted
- Events: every event, with every reply, order, claim, vote, invite link and report attached to it, is deleted automatically 90 days after the event’s date (or its end date, if it has one).
- Hosts can delete an event at any time, from the event’s settings. It goes straight away, with everything attached to it.
- Hosts can delete their whole account at any time, from their list of events. That deletes every event they made and their sign-in record.
- Guests can change their reply, or say they can’t come, at any time while replies are open. To have a reply removed completely, ask the host (who can remove it) or contact us.
- Visitor limit notes: two days. Reports: 180 days at most.
Backups kept by our database provider may hold deleted information for a short time before they’re replaced. [Max to confirm the backup period]
Where it’s kept
The database is run by Supabase and the site is hosted by Cloudflare. Supabase stores the information in [region to be confirmed]. Cloudflare serves the pages from data centres around the world and, like any web host, handles visitors’ internet addresses to do that. These providers may be outside New Zealand. We use them only to run the site.
The site’s fonts are served from this site, so loading a page doesn’t send your address to a font company. If you tap a map, calendar or directions link, you go to that service (for example Google Maps), and its own privacy policy applies.
What we don’t do
- No ads, and no advertising or tracking cookies.
- No analytics.
- We don’t sell, rent or trade anyone’s information.
- We don’t email guests, and we don’t use hosts’ email addresses for marketing.
Under 16?
If you’re under 16 and want to run an event, ask a parent or caregiver to host it for you. Guests of any age can reply, but a host planning a children’s party should think about what they put on the page, and use first names.
Your rights
Under New Zealand’s Privacy Act 2020 you can ask to see the personal information we hold about you, and ask us to correct it. Contact us at [contact email to add]. Because guests don’t have accounts, we may need a few details (the event and the name you replied with) to find your reply, and we may check with the host. If you’re not happy with our answer, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Changes
If we change how we handle information, we’ll update this page and the date at the top.
Max to confirm
- Name of the person or business running the site.
- Contact email (set CONTACT_EMAIL; it fills in on this page automatically).
- Supabase region, and whether Cloudflare or Supabase keep anything (logs, backups) longer than this page says. Supabase’s backup period.
- Whether to keep the profile picture link Google sends, or ask Supabase not to store it.
- Whether hosts who never delete their account should have their sign-in record removed after a period of not using the site. Right now it stays until they delete it.
- Who reads reports and how fast (reports are stored but nobody is notified yet).
- Whether to keep the “Google profile picture” wording.