Privacy Policy

Last updated: draft, October 2026.

The short version

Parents (adults) use BirthdayPartyPal to plan their child's party. Children don't have accounts and we don't collect information directly from children.
We collect only what's needed to run a party, show it only to the people it's for, and erase guests' details automatically 30 days after the party.
No ads. No third-party trackers. Never sold or shared.

Who we are

BirthdayPartyPal ("we") provides party invitations, RSVPs, reminder texts and party-night tools at birthdaypartypal.com. Contact: privacy@birthdaypartypal.com. [Company name and address to be added.]

Information we collect

From hosts (the parent who creates a party): email address (to sign in), and what you enter for the party: your first name and phone number, the party address, the birthday child's first name and age, the plan, optional pet names, and your guest list (children's first names, parents' names and mobile numbers). Payment details are handled by Stripe; we see only the payment status and amount, never your card number.

From invited families: what you choose to enter on your RSVP (your child's first name, your name, your mobile number, allergies or food notes, choices like a party buddy), optional wish-wall messages, optional photos (only if the host added the photo album), and arcade scores (a preset hero name only).

Automatically: when a family opens their personal invite link we note that it was opened and when, so the host knows who has seen it. We keep short-lived security records (for example, how many sign-in attempts came from a network) using salted hashes, not raw IP addresses. We use only essential cookies: one to keep a host signed in. Families' browsers store small conveniences on their own device (like a packing checklist and game high scores); those never leave the device.

To learn which parts of BirthdayPartyPal help parents (for example, how many people who start a free trial go on to unlock a party), we count a few product events ourselves, on our own servers. These counts use no cookies, no advertising or cross-site identifiers and no third-party analytics service. If your browser sends Global Privacy Control or Do Not Track, we don't record these events for you at all. Raw events are deleted after 90 days; we keep only totals after that.

Children's information

BirthdayPartyPal is meant for adults. Information about children is provided by their parents (the host, or an invited family's parent on the RSVP). We ask only for a first name and, for the birthday child, an age; we never ask for photos of children, birthdates, schools or last names. Hosts choose whether to enable the photo album add-on; photos appear only after the host approves them and only to invited families. We erase guest information automatically 30 days after each party unless the host chooses to keep it longer, and parents can ask us to delete their child's information at any time. If you believe a child has given us information directly, contact us and we will delete it. [Counsel: confirm COPPA analysis and any state law requirements.]

How we use information

To run the party: show the invite to invited families, record RSVPs, show the host their guest list and party-night tools.
To send emails to hosts (sign-in, RSVP updates they chose to get) and texts to families about that party only.
To keep the service safe (rate limits, abuse prevention) and to process payments.

We do not use party or guest information for marketing, profiling or advertising, and we don't sell it.

Text messages

Hosts may text families about their party, either from their own phone or from the BirthdayPartyPal number. Before using our number, the host confirms they have permission to text the families on their list. Every text says it's from "BirthdayPartyPal for" the host. Reply STOP to stop all texts from our number and HELP for help; message and data rates may apply. We text only numbers a host entered for their own party, and only about that party.

Only service providers that help us run BirthdayPartyPal, under contracts that limit their use of it: Cloudflare (hosting, storage), Stripe (payments), Twilio (texts), and our email provider [Resend or Postmark] (sign-in and host emails). We may disclose information if required by law. We don't share information with advertisers or data brokers.

How long we keep it

Guest information, RSVPs, texts, wishes, photos and the party address: erased automatically 30 days after the party (photos kept up to a year only if the host buys that option), or sooner if the host erases them.
Host accounts: until you delete your account. Payment records: kept as required for tax and accounting, without guest information.
Security logs: a few days.
Product analytics events (see "Our own, cookie-less analytics"): raw events deleted after 90 days.

Your choices and rights

Hosts can download their guest list, erase a party's guest information, delete a party, and delete their account from the app. Families can change or withdraw their RSVP from their link, ask the host to remove them, or contact us to delete their information. Depending on where you live you may have additional rights (access, correction, deletion, portability); contact us to use them.

Security

Information is encrypted in transit. Access to a party is limited to its hosts and, for invite details, to families holding a personal link. Sign-in uses one-time email links and codes, not passwords.

Changes

We'll post changes here and update the date above. Significant changes will be emailed to hosts.