Privacy, in plain English

For hosts (signed-in users): your email address (for magic-link sign-in) and your display name. If you opt into “Let guests contact me,” the email and/or phone you provide are shown on the invite.

For guests: your first name and your RSVP response. No account needed. We set a long-lived device cookie (hearth_device) so we can recognize you when you return to the same invite — this prevents accidental double-RSVPs and lets you edit your response.

Optional guest info: when you RSVP, you may optionally provide an email (for reminders), a phone number (for day-of updates), dietary notes, or an ETA. Email and phone are stored in a separate locked table that only the host and our server can read. They are never exposed to other guests through the invite page.

Guest lists a host builds: a host can add your name with an email address or a mobile number so they can invite you. Hearth emails invitations to email addresses. For a mobile number, the host texts you themselves, from their own phone; Hearth never sends text messages. These entries sit in a locked table only the host and our server can read, and they are deleted with the event.

Ticketed events (Bonfire): buying a ticket requires your name and email; a phone number is optional. Waitlist sign-ups collect the same. If the host enables ticket transfers, claiming a transferred ticket collects your name and at least one of email or phone.

Event content: titles, dates, locations, cover photos, chat messages, shared photos, and collaborative “who’s bringing what” lists — whatever hosts and guests put in.

Push notifications: if you tap the bell icon to enable reminders, your browser’s push subscription endpoint is stored so we can deliver notifications. You can unsubscribe at any time through your browser settings, and we automatically remove subscriptions that stop working.

Every cookie we set does a job for you, and none of them track you. They are:

• A sign-in session cookie (from Supabase) that keeps signed-in hosts signed in.
• A device token (hearth_device) that recognizes a returning guest, so you can edit your RSVP instead of answering twice.
• A passphrase pass, set for one event after you enter its passphrase, so you don’t have to type it again on every visit.
• An invite pass, set for one invite-only event when you open your personal invite link, so the invite stays open when you come back through the plain link.

That’s the whole list. We don’t use cookies for advertising or analytics.

No ads. No ad tracking. No third-party analytics (no Google Analytics, no Facebook pixel, no session replay, no fingerprinting). We do not sell or share your data with anyone except the service providers listed below — and each sees only the slice they need to do their job.

Supabase — database and file storage (US region). Hosts your event data, RSVPs, photos, and chat messages.

Resend — transactional email (sign-in links, event reminders, update notices). Sees the recipient’s email address and the message content.

Vercel — web hosting and edge delivery. Serves the app; does not store your event data.

OpenStreetMap / Nominatim — address geocoding (turning an address into map coordinates). Only inputs that look like mappable places (street addresses, city & state) are sent; colloquial location names like “Grandma’s” stay local.

Upstash — rate limiting to prevent abuse. Sees anonymized request counters only; no names, emails, or event content.

Push services (Apple, Google, Mozilla) — if you enable push reminders, your browser’s own push service delivers the encrypted notification. This is standard web-push infrastructure; they don’t receive your event data.

That’s the complete list. When we add payment processing in the future, we will update this page before collecting any payment information.

Events are ephemeral by default. After an event ends, we keep it around for about 30 days so you can grab photos and look back — then it’s actually deleted: event details, RSVPs, guest contact info, chat, photos, all gone from our database and storage. We can’t leak what we’ve deleted.

Hosts can also archive or permanently delete their events at any time from the dashboard.

See what we have — sign in, go to Account settings, and tap “Download my data.” You’ll get a JSON file with everything we store about you (events, RSVPs, photos, messages).

Delete your account — same page, one tap. We erase your account and everything tied to it: hosted events, RSVPs, photos, messages, contacts, payment records. Irreversible. You can also email us if you prefer.

Delete your RSVP — guests can remove themselves from any event (“Remove me” on the invite — including recurring and multi-day events), which erases their RSVP and any contact info they gave, immediately. When a host removes a guest from their list, that guest’s email and phone are erased right away too (the name stays briefly recoverable in case of an accidental removal, then goes with the event’s normal deletion).

Hosts can create tracked share links for their event. Each link has a unique token so the host can see which link a guest used to find the invite — useful for knowing whether the Slack post or the group text drove more RSVPs. These tokens do not identify you personally; they identify the link, not the clicker.

A host can choose to connect an AI assistant, like Claude, to their Hearth account. Nothing is connected unless you approve it on a Hearth sign-in screen. A connected assistant can see your own events (titles, dates, places, descriptions) and how many people have RSVPed, and it can save event drafts, which wait on your events page until you publish them yourself. Unpublished drafts are deleted after 30 days.

If the host also turns on See guests and chat, the assistant can see what the host sees about guests: names, RSVP answers, party sizes, dietary notes, questionnaire and poll answers, the bring list and the event chat. It never receives guests’ email addresses or phone numbers, whatever the host allows.

If the host turns on Add people to your guest lists, the assistant can add names with an email or mobile number (for example from the host’s own contacts) to the host’s guest lists, exactly as if the host had typed them in. It can’t read those details back out, and nothing is sent to a guest until the host sends the invitations.

A host can also give their assistant a picture to use as an event’s cover. The assistant sends Hearth the image, or a link that Hearth’s server downloads it from. We crop it to the cover size and save it as a new file, which drops hidden details like camera and location data. It’s kept with the draft until the host publishes or discards it, and a published cover is deleted with its event.

What the assistant does with what it sees is governed by that assistant’s own privacy policy. Hosts can change what an assistant can see, or disconnect it, any time under Account settings; the change applies right away.

We haven’t received any requests for user data. We’ll only disclose data in response to valid legal process, such as a subpoena or court order. We’ll limit any disclosure to what’s strictly required, and we’ll tell the person affected where the law allows. Because events and their data are deleted about 30 days after they end, there’s usually very little to disclose.

Hearth isn’t for kids under 13. Don’t set up an account for a child.

If we change anything that affects what we collect or how we use it, we’ll email every host. Material changes go into effect 30 days after notice.

Questions, data requests, or deletion requests? Email hello@hearth.rsvp.