Privacy policy

InviteCraft (invitecraft.app) makes interactive invitation websites, personal guest links, RSVPs and free picture cards. When we say “we” or “us” we mean the people who run InviteCraft. For anything in this policy, write to support@invitecraft.app.

Your account. When you sign up we store your name, email address and, if you use Google, your profile photo. Sign-in is handled by Firebase Authentication (Google). We never see your password; Firebase keeps it hashed.

Your invitations. Everything you type into an invitation (names, dates, venues, messages), your guest list (family names, greetings, seat counts and, if you add them, WhatsApp numbers), and when each guest last opened their link. This is stored in Google Cloud Firestore. Photos and music you upload are stored with Cloudinary.

Guest replies (RSVPs). When a guest replies we store the name they enter, whether they are coming, how many people, which celebrations, and any message they leave. Replies are visible only to the host who sent the invitation (and our admins when helping with support).

Payments. We don't take card payments on the site. You pay by bank transfer (bank QR code) or arrange payment with us on WhatsApp. We keep a record of your plan, the amount and the date so we can give and confirm your access. The screenshot and chat you send stay in WhatsApp; your bank and WhatsApp (Meta) handle that data under their own policies.

Newsletter. If you join the “new templates” list in the footer we store that email address and send you a welcome email and news about new designs, nothing else. Ask us to remove you at any time.

To understand how the site is used, fix problems and see which designs people like, we keep a simple activity log of visits and actions. It records:

• the pages you open and what you do there (for example viewing a template, playing a demo, publishing an invitation, sending a reply);
• a random visitor id kept in your browser's local storage, and a random id for each visit;
• your approximate location (country, region and city) as reported by our hosting provider, worked out from your connection;
• your device type, operating system, browser, screen size and language, and the page or campaign that brought you here;
• if you are signed in, your account name and email, so the log can show your activity across your devices.

We don't store your IP address, and the activity log uses no cookies. Guest visits to an invitation are logged too (for example “the Khan family opened their link”), so hosts' invitations work and we can spot problems. The log is visible only to our admins. Entries are kept for 180 days and removed automatically by a daily clean-up.

InviteCraft doesn't use cookies. We also use Google Analytics (through Firebase) to count visits in aggregate, but we run it in cookieless mode: it stores nothing in your browser and doesn't use advertising features. Google still receives basic information about the page and your device when you visit, under Google's policies. You can block it with a content blocker or the Google Analytics opt-out add-on.

Apart from that, we use your browser's storage only for conveniences such as remembering your country for prices, your preferred language for messages, and which tips you have already seen, and to keep you signed in.

• to run your account and show your invitations to the guests you send them to;
• to give, confirm and support your plan after you pay;
• to answer you when you contact us;
• to keep the site secure, fix bugs and improve our designs;
• to send newsletter emails, only if you signed up for them.

We don't sell your data and we don't use it for advertising.

We use a few trusted services to run InviteCraft. They process data only to provide their service to us:

• Google Firebase and Google Cloud for sign-in, the database and analytics;
• Cloudinary for photos and music you upload;
• Vercel for hosting the site (including the location headers used by the activity log);
• Google (Gmail) to send emails such as the newsletter welcome;
• WhatsApp and your bank when you choose to pay or chat with us there.

These providers may store data outside your country. We may also share information if the law requires it.

An invitation is private until you publish it. Once published, anyone with its link can open it, so share links only with people you want to invite. Personal guest links are random and hard to guess, and we ask search engines not to index invitations, but we can't control who a guest forwards a link to. You can unpublish or delete an invitation at any time.

You can delete your account yourself in Dashboard → Account. This permanently removes your profile, sign-in, every invitation with its guests and replies, and your uploaded photos and music. Activity log entries are not deleted straight away; they expire on their own within 180 days.

You can also ask us to see, correct or delete your data, or to stop sending you emails, by writing to support@invitecraft.app. Guests who replied to an invitation can ask the host, or us, to remove their reply.

• Account and invitation data: until you delete it or your account.
• Activity log: 180 days.
• Newsletter email: until you ask to be removed.
• Payment records: as long as we need them for accounting and to resolve questions about your access.

InviteCraft is meant for adults planning celebrations. Please don't create an account if you are under 16. Hosts may include children's names in an invitation (for example on a birthday) and are responsible for doing so with their family's permission.

Data travels over HTTPS and access to it is limited by security rules, so only you (and our admins) can change your invitations. No system is perfectly secure, so please use a strong password and keep it to yourself.

If we change this policy we will update the date at the top, and tell you by email or on the site if the change is important. Questions? Write to support@invitecraft.app. See also our Terms of Service.