Privacy policy

Information we handle

• Host accounts. Google provides a host’s name, email address, verification status, and Google account identifier. We keep account and session records to sign hosts in, identify who owns an event, and protect access. Google is not used to read your Gmail, contacts, or calendar. We do not retain Google access, refresh, or ID tokens after the sign-in flow, or store your Google profile photo.
• Events and RSVPs. Hosts provide event details, addresses, artwork, and settings. Guests provide a name, attendance choice, party size when attending, optional comments, and guest-list preferences. Records include submission and update times and secure edit-link identifiers.
• Optional activities. Depending on the event, we handle song suggestions and optional names, questions and optional names, poll votes, playlist applause, and bring-something signups with names and quantities.
• Host-added contacts. A host may keep a private invitation tracker containing names, contact details, invitation status, and links to RSVPs. These entries are separate from a guest’s optional contact-sharing preferences.
• Support and security. We receive what you send to support, including attachments. Hosting and authentication services process technical information such as IP addresses, browser details, request logs, session information, and timestamps for operation, troubleshooting, and abuse prevention.

We use this information to run invitations and event activities, manage host access, provide requested support, and maintain the service’s security. Only share information needed for the event; avoid sensitive personal details in messages, questions, or artwork.

Who can see what

A published invitation or Event Hub can be viewed by anyone who obtains its link; guests do not sign in. A link that is not listed publicly is not the same as a confidential page. Hosts should only publish event details and artwork they intend to share.

If the guest list is enabled, attending guests who choose to display their names appear with their party sizes. Hidden attending guests still count toward the total. Declined guests, RSVP comments, and contact details are not displayed in that list.

Song suggestions and the optional “suggested by” name can be public. Questions appear only after the host answers and publishes them; the separate guest-name field is not published. Names or personal details written inside a question can still appear as part of its text. Poll results show aggregate counts. Public bring-something lists show items and claimed quantities, not claimants’ names.

The event’s authorized host can see private RSVP details, submitted questions, bring-something signups, and contact information shared with them or entered in their invitation tracker. Authorized service administration and service providers may also need access to operate, secure, or support Shindig. Information may be disclosed when required by applicable law or to address security and abuse.

Optional contact sharing

You can RSVP without giving a phone number or email address. If you choose to share one, it is for that event’s host to send event reminders and updates using their own email or messaging app. Shindig currently does not send these messages. Contact details are not verified, and this choice is not permission for unrelated marketing.

We store the chosen contact details and the time permission was recorded separately from the RSVP. They are excluded from the public Hub and RSVP CSV export. The host can copy the details you share for their own communication tools.

While the event remains published, use your private RSVP link and its “Keep in touch” form to change your choices. Unchecking a channel and saving removes its contact detail and permission timestamp from Shindig’s active contact record. If you cannot access the link or event, contact the host or our support address.

Hosts can also clear collected contacts and end further collection. Neither action retracts messages already sent, host copies, or contact information the host independently entered in their invitation tracker. Ask the host directly to stop contacting you and remove those copies if needed.

Services that help Shindig work

We use the following services for the stated purposes. They process relevant information under their own policies and service terms, and processing may take place outside your country.

Vercel and Neon

Vercel hosts the application and uploaded artwork; Neon stores application records, including events, accounts, RSVPs, and enabled activities.

Google

Google verifies host identity at sign-in. Separately, Gmail receives our support email. Signing into Shindig does not grant access to your mailbox or calendar.

ImprovMX

ImprovMX forwards messages sent to our support address to our support inbox, processing email content and delivery information. Replies may come from our Gmail support account.

Spotify

Music searches use Spotify’s catalog and artwork. Search text is sent for catalog lookup; guests do not connect a Spotify account to Shindig.

Open-Meteo and the U.S. Census Geocoder

Weather uses the event’s configured coordinates, not your device’s location. A host using address lookup sends the entered address to the U.S. Census Geocoder, including when the event is still a draft.

Calendar, directions, and other external links

When you choose these actions, the selected service receives the relevant event details. Calendar entries can include your private RSVP edit link. Do not share or forward that entry if it includes a private link. External services apply their own privacy policies.

Cookies, device storage & private links

Host sign-in uses secure session cookies. Guest interactions use an anonymous browser cookie to remember votes and applause and help prevent repeat actions; a hashed identifier is stored with those interactions. This cookie can last up to one year and is not a guest account.

If you explicitly choose to remember a private RSVP or bring-something link on your device, Shindig stores that shortcut in the browser. Shortcuts stop appearing after 180 days. Use “Forget” or clear your browser’s site data to remove the saved shortcut; this does not cancel an RSVP or signup or delete its server record. The Hub also uses temporary browser storage to remember the selected section.

Private edit links grant access to the associated response or signup without a password. Anyone with such a link may be able to view or change that record, including RSVP contact choices. Keep links and calendar copies private, especially on shared devices. Clearing browser storage cannot remove copies you have already shared or saved elsewhere.

How long information stays

Event records do not automatically expire or disappear after the event. Unpublishing or archiving an event does not delete its stored information. Hosts can use available controls to remove individual records and clear collected contact details. For events created in their workspace, hosts can also choose Data & privacy from the event Overview to permanently delete the event and its active guest records, after explicit confirmation.

Event deletion removes the event’s database records and disables its guest links. Uploaded artwork has a separate cleanup step: wait at least three minutes, then return to the deletion page to finish. Pending cleanup is listed under Account & Privacy; it does not run automatically. A minimal owner-linked deletion receipt and a reserved event link remain to support cleanup and prevent a deleted link being reused for a different gathering. They do not contain guest records or the deleted event’s content.

Account closure, requests concerning the original Jasper Shucks invitation, and broader deletion requests require contacting support; there is no self-service account-deletion button.

Information remains as needed to provide the service and address support, security, or legal requirements. Removal from active records may not immediately remove provider backups or security logs. We cannot delete copies that hosts or guests have exported, saved in a calendar, or kept in their own inboxes and devices.

Your choices & requests

Use your private RSVP link to update your response and guest-list visibility, subject to the event’s RSVP rules. Contact-sharing choices can be changed separately while the event remains published. Ask the host for help with event-specific information or copies the host holds outside Shindig.

For access, correction, deletion, or account-closure requests, email support@haveashindig.com. Tell us what you need and, if relevant, the public event link. We may need to verify your identity or authority before acting. Do not send passwords, verification codes, private edit links, or a guest list. We review requests manually and explain any limitations that apply.

You can also manage Shindig’s Google connection in your Google Account. Removing that connection does not itself delete your Shindig account or event records.

Security & policy changes

Shindig uses server-side authorization for host tools and private records, secure session cookies in production, input validation, and unguessable edit links. No online service can guarantee absolute security. Contact support if you think a private link or account has been exposed.

We may update this policy as the service changes. The date at the top identifies the latest version. For questions about a change or this policy, contact Have A Shindig at the support address above.