Privacy Policy

Hosts create accounts and events. Guests RSVP without an account, usually via an invite link or an open event page. Some parts below apply only to one group; we’ll say so.

Account (hosts). Email, password (handled by Amazon Cognito — we don’t store your raw password), name, optional public handle, and optional default time zone.

Events (hosts). Title, description, location, optional arrive-by / door-code note, start and end times, time zone, access mode (invite-only or open), optional settings (plus-ones, capacity, reminders, guest-list visibility, whether the event appears on the host’s public page, one guest question), and the public link path.

Invites & RSVPs (guests and hosts). Guest email, display name, reply (yes / can’t make it / maybe), optional note, optional answer to the host’s guest question, invite and confirmation tokens, and delivery status for invite emails.

Technical & security. Session cookies (HttpOnly auth cookies so you stay signed in), basic request metadata we need for security and abuse prevention (for example soft rate limits by IP or email), and standard cloud/server logs from our hosting provider.

We do not currently use third-party advertising or product-analytics trackers. If that changes, we’ll update this policy before we turn them on. When an event has a location, we may embed a Google Maps preview so guests can see roughly where it is; loading that map contacts Google with the address query (and typical browser request metadata). “Open in Maps” also sends you to Google (or your device’s maps app).

• Provide, secure, and improve the service
• Send transactional email (verification, password reset, invites, RSVP reminders, RSVP confirmation)
• Show hosts who’s replied and manage their events
• Prevent spam, abuse, and fraud
• Comply with law and enforce our Terms

Invite, reminder, and RSVP confirmation emails include an Unsubscribe control (Amazon SES subscription management: List-Unsubscribe header plus a link in the message). If someone opts out, we stop emailing that address for event mail and warn hosts who try to invite them. Cognito account emails (sign-up verification and password reset) are separate and do not offer unsubscribe — they are required to operate your account.

We may later send occasional product-update email (for example, a new feature announcement). Those won’t be ads for unrelated products. You can opt out of non-essential messages; account verification and password-reset mail may still be sent.

When a guest RSVPs, they are sharing their reply with the host through our systems. We process that information to deliver the product. The host decides who to invite, how to use replies for their event, whether to show Going first names to other guests on the event page, and which events appear on their public host page.

We are not responsible for a host’s misuse of guest information that guests voluntarily provide. Hosts should only invite people who expect to hear from them, and should handle guest data lawfully and respectfully.

We don’t sell personal information. We share it only when needed:

• With the event host — guest RSVP details for that event
• With other guests (optional) — if the host turns on “who’s coming,” first names of confirmed Going guests appear on the public event and invite reply pages. Emails and full names are not shown. Off by default.
• Infrastructure providers — currently Amazon Web Services (for example Cognito, DynamoDB, SES email, Lambda, S3, CloudFront, SQS), primarily in us-east-1, to host and run the service
• Legal / safety — if we reasonably believe we must disclose something to comply with law, protect rights, or prevent harm
• Business transfer — if Gray Cat Security, LLC is involved in a merger, acquisition, or asset sale, information may transfer as part of that deal under continued confidentiality expectations

We use essential cookies to keep hosts signed in (secure, HttpOnly session cookies). We don’t use advertising cookies today. Blocking essential cookies will break sign-in.

• Account & events — while your account is active and as needed to provide the service
• Invites & RSVPs — while the related event and account exist, unless deleted earlier
• Renamed links — old handle or event paths may stay as redirects for about 90 days so bookmarks don’t die overnight
• Abuse / rate-limit records — short-lived counters used to slow spam
• Operational logs — kept for a limited time for security, debugging, and reliability (through our cloud provider’s logging)
• Email delivery metadata — enough to show hosts whether an invite sent or failed

After we process a deletion request, we aim to remove or de-identify personal data from active systems within a reasonable period (typically within 30 days), except where we must keep a limited record for security, dispute, or legal reasons, or where copies briefly remain in encrypted backups until they rotate out.

Hosts can update profile details in the app. To delete an account or ask about personal data we hold, email privacy@repondez.click. Self-serve deletion is on the roadmap; until then, email is the path.

Guests who want a reply corrected or removed should contact the event host first. You can also email us and we’ll help where we can — especially if the host isn’t reachable.

The service isn’t directed at children under 13. We don’t knowingly collect personal information from children under 13. If you believe we have, contact us and we’ll delete it.

We use industry-standard practices appropriate for a small serverless app (encrypted transport, managed auth, access controls). No method of transmission or storage is perfectly secure; please use a strong password and protect your inbox (invite links are powerful).

We’re based in Texas and currently host the service on AWS in the United States (us-east-1). If you use repondez.click from elsewhere, your information is processed in the U.S.

We may update this Privacy Policy. We’ll post the new version here and bump the effective date. For material changes, we’ll give reasonable notice when practical.

Privacy questions or requests: privacy@repondez.click.

Gray Cat Security, LLC · Texas, USA