Privacy

Who we are

SimpleInvite is a product of Bangarang Apps, Inc., a corporation formed in Delaware, United States. In this policy, "we" and "us" mean Bangarang Apps, Inc., and "you" means whoever is reading — a host who signed up, or a guest who was sent an invite.

We are responsible for the information described here. To reach a person, write to help@simpleinvite.app.

Hosts and guests are not in the same position

A host chose us. They open an account, make an event, and decide who to invite.

A guest did not. Their name and their number or email reached us because a host they know typed it in or pasted it from their own contacts. A guest never gets an account, never sets a password, and is never asked for anything but an answer.

That difference shapes everything below.

What a host gives us

A host supplies, or creates by using the product:

Account information: Name, email address, time zone, and a mobile number if the host adds one — along with whether they chose to show that number to their guests. Clerk handles sign-in. We hold the account identifier Clerk gives us. We never hold a password.
Where you host: A host can save the place they usually host: a venue name, a street address, and any note about parking, gate codes or which door. We keep it so a new event can fill itself in, and it appears on the invitations sent from that event.
Event information: The title, the date and time, the time zone, the venue name and address, any note, and any photo the host uploads. Photos are stored with our hosting provider.
The guest list: The names, numbers and email addresses the host types in, pastes, or imports from a spreadsheet for the people they are inviting; any group the host saves; any household label like Sam & Lee; and any private note the host writes about a guest. A note is the host's own — the guest it is about never sees it.
Payment information: Stripe takes the payment and holds the card. We never see or store a card number. What we keep is the record of the purchase: what it was for, the amount, the date, whether it was refunded, the identifiers Stripe gives us for the customer and the payment, and — so a receipt can show it — the card's brand and its last four digits.
Keys and connections: A host can create an API key and register an address for us to notify when an answer changes. Where a host does that, the answers on their own events are sent to the address they chose, and what happens to the information after it leaves us is governed by whatever they connected it to, not by this policy.
Usage information: Which screens a host used and what they did there, so we can find where the product is confusing, and a record of the significant actions taken on an account — an event sent, an event cancelled, a key created — so we can answer what happened when a host asks. Measured in the host app only, never on a guest page.

What we hold about a guest

We take nothing from a guest before they act. Everything below either came from the host, or is the answer the guest gave.

Supplied by the host: A first name, and a mobile number or an email address, sometimes both. Sometimes a last name. Sometimes a household label: Sam & Lee, the Nguyens. Sometimes a private note the host wrote for their own use.
The answer: Yes, no, or not sure yet. How many people are coming, and how many of them are children, where the host asked. When they answered, and whether they changed it. After the event, whether the host marked them as having come.
Message contents: The invitation, reminder and update we send. Where a guest replies by text, the words of that reply, so the host reads what was said and we can tell a yes from a no.
Technical logs: When an invite link is opened, and the ordinary server records any website keeps: an IP address, a browser user agent, a timestamp. They make links work, stop abuse, and tell us when something breaks.

We do not follow a guest across other websites.
We do not build advertising profiles.
The guest page loads no third-party scripts, and sets no cookie until they answer.

Texts, for guests who ask for them

Our number texts a guest only after someone answering the invite asks for texts on the invite page, by entering a mobile number and ticking a box that starts unticked. SimpleInvite has no setting that turns texts on for anyone, a host included, and every text can be stopped by replying STOP. An invite a host texts from their own phone is their message, not ours, and we never see it.

We text mobile numbers in the United States and Canada only.

When a guest asks, we keep a record of that consent, because carriers require us to be able to show it. The record holds:

The number: The mobile number the guest confirmed.
The words shown: The wording beside the box, exactly as the guest saw it, event name included.
The time: When the guest ticked the box, and when they stopped texts, if they did.
The IP address: The address the request came from.
The browser: The browser's user agent string.
The event: Which event it covers. Consent is for one event at a time.

Texts carry no marketing, ours or anyone else's.
Most replies are read by our own code. A reply it cannot read, like “consider us there”, is read by a language model running on our own server, given the event title and the host's first name for context. The reply goes to no other company.
We do not share, sell or give a guest's mobile number or their consent to texts to anyone for marketing or promotional purposes.
Reply STOP to any text and texts from SimpleInvite end, for every event and every host.

What we use it for

These purposes, and no others:

Sending the invitation, the reminders and the updates the host asked for.
Texting a guest who asked for texts, about the event they asked about.
Recording an answer and showing the host who is coming.
Letting a guest change their answer later.
Honoring an opt-out, so someone who said stop stops hearing from us.
Billing a host for a paid event.
Keeping the service running, finding what broke, and stopping abuse.
Answering a message sent to help@simpleinvite.app.

The vendors who handle it for us

Each company below processes information on our instructions, under a contract, for the one purpose named. The list is current as of the effective date above, and we update it when it changes.

Vercel: Hosting for the websites and the host app, the server logs that come with it, and the storage holding event photos.
Neon: The database holding events, guests, answers and messages.
Clerk: Host sign-in and sessions. Clerk never runs on a guest page.
Resend: Sending email: invitations, reminders, updates and sign-in codes.
Stripe: Taking payment for a paid event or a host year. We never see or store a full card number.
PostHog: Product analytics, in the host app only. Never loaded on a guest page.
Sentry: Fault reporting, so we find out when something breaks.
Surge: Sending and receiving texts, for guests who asked for them. Where no text goes out, no guest detail reaches Surge.
Mapbox: Looking up an address while a host types it, and drawing the small map on an invitation. It receives the place being searched for and the event's address — never a guest's details.
fdbck: The feedback button in the host app. It loads only for a signed-in host, and receives the host's account identifier and whether they are on a paid plan, so a reply can be sent back. It never loads on a guest page.

If you are a guest

You never had an account, and you do not need one to be left alone.

To stop texts, reply STOP to any message we send you. That ends texts from SimpleInvite for every host, not only the one who invited you, and it takes effect at once. Reply HELP and we will tell you who we are and how to reach a person.

To stop emails about an event, use the line at the foot of any invitation we email you. It stops our emails about that event without your having to ask anyone.

To come off an event, ask the host who invited you. Removing you is one action on their event page, which makes it the fastest route. You can also write to help@simpleinvite.app with the event and the number or address you were invited on; we will remove you and tell the host we did.

To ask what we hold about you, or to have it deleted, write to help@simpleinvite.app. We answer within 30 days. Where we have to keep something — the record that you opted out, so we can honor it — we say so, and say why.

If you are a host

You can see and change most of what we hold from inside the product: your name, number, time zone and saved place in settings, and every event, guest and answer on the events themselves. A guest list downloads as a spreadsheet from any event.

To get everything we hold in one go, or to correct something you cannot reach yourself, write to help@simpleinvite.app. We answer within 30 days, and we do not charge for it.

To close the account, use settings. It is marked deleted at once, live events are cancelled, every scheduled message stops, and the rest follows the schedule below. We do not require you to write to anyone to leave.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have no advertising business of any kind, so there is nothing here to opt out of.

Some states give residents rights to know, delete, correct, and to appeal a refusal. We apply all of them to every host, wherever they live, because running two standards would mean the worse one is the default. Write to help@simpleinvite.app and say what you want; if we say no, we say why, and you can reply asking us to look again.

We will not treat you differently for asking — no worse price, no reduced service.

How long we keep it

We keep each thing for as long as the event or the obligation needs it, then get rid of it.

An event and its answers: Kept while the host's account is open, so they can see what happened and invite the same people again.
A closed host account: Marked deleted the moment the host confirms. Live events are cancelled and every scheduled message stops.
Guest records after a host deletes their account: Anonymized 30 days after the account is deleted: the name, the number, the email address, the household label and the host's note are all removed. What remains is the shape of the event and cannot be tied back to a person.
The contents of messages: Kept 180 days, the window in which we must be able to show what was sent and on what consent, then purged.
Text consent records: Kept four years, so we can show a carrier the consent behind a text: each time a guest asked for texts, changed their number or stopped them, each STOP and START, and a host's word when they ask us to text their guests, with the number, the words shown, the time, the IP address and the browser. Then it is deleted. The copy we send from is purged sooner, once it is older than 180 days and no message about that invitation remains.
A count of the texts we send: Each text our number sends is counted, with the number it went to and when, but never its words, so the limits on how many texts go out hold even after an event is deleted. Kept 180 days, then deleted.
The number a guest's texts come from: We note which of our numbers first texted a guest, so our messages keep arriving from the same sender rather than a new one each time. The note holds their mobile number. It is deleted once it has gone 180 days without being used.
Email addresses that bounced: Kept for as long as we operate, so we never send to a broken address again. We keep a one-way fingerprint of the address, not the address itself.
Email addresses that asked us to stop: When a guest stops a host's emails or marks one as spam, we keep a one-way fingerprint of their address with that host, so the host cannot start the emails again by changing the address and changing it back. Deleted along with the host's account.
Opt-out records: Kept for as long as we operate. It is the only way to keep honoring a STOP. The record is a phone number and the fact that it opted out.
Server and fault logs: Kept for a short operating period, then rotated out.

Cookies

None of them are for advertising. A guest page and the host app behave differently here, so they are described separately.

The guest page sets exactly one cookie, named guest_session, and only once the guest has answered. It lets the same person return to the same link and change their answer. It is not set on first view, no third party sets anything there, and it never follows anyone anywhere.

The host app, once a host signs in, sets the cookies Clerk needs to keep them signed in, and the cookies our analytics uses to recognize the same host between visits so a confusing screen can be found. The feedback button sets its own so it can match a reply to the message that prompted it. These live on simpleinvite.app and nowhere else.

We use no advertising cookies, sell no advertising, and run no advertising network anywhere in this product.

Children

SimpleInvite is for adults. A host must be 18 or older to open an account, and we do not knowingly hold information about a child under 13.

Children do appear in guest lists: a host counts the kids in a household when they say how many are coming. What we hold then is a number, and sometimes a first name the host typed. If a child's details are in our system and should not be, write to help@simpleinvite.app and we will remove them.

Security

Traffic to and from our sites is encrypted in transit, and our provider encrypts the database at rest. An invite link carries a long random code that cannot be guessed, and we store only a scrambled form of it.

Only the people who operate the service reach production data, and their sign-in requires a second factor.

No system is perfect. If we find that information was exposed, we tell the people affected and the authorities we are required to tell, without dressing it up.

Where information is held

We operate in the United States, and our vendors store information in the United States. If you write to us from elsewhere, what you send is handled there.

Changes to this policy

When we change this policy we change the effective date at the top, and we keep the previous version available on request.

If a change materially affects how we treat information we already hold, we email hosts before it takes effect.

How to reach us

Write to help@simpleinvite.app. A person reads every message.

The terms of service at simpleinvite.app/terms cover the agreement itself, and the SMS terms at simpleinvite.app/sms-terms cover texting.

This policy is governed by the laws of the State of Delaware, United States.

SimpleInvite is a product of Bangarang Apps, Inc., a corporation formed in Delaware, United States.