Privacy Policy

Last Updated: December 6, 2025

Introduction

InviteDay ("we," "our," or "the app") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use our mobile application.

Information We Collect

1. Information You Provide

• Event Data: When you create an event invite, you provide event information including title, date, time, location, and description.
• RSVP Responses: When recipients respond to invites, we collect their names and response status (yes, maybe, no).
• Short Link Data: We generate and store short links for easy event sharing.

2. Automatically Collected Information

• Subscription Information: We collect information about your subscription status through RevenueCat to manage future Pro subscription features.
• Usage Data: Basic app usage data to improve the service (planned for future updates).

How We Use Your Information

We use your information to:

• Create and host event invite pages
• Track and display RSVP responses in real-time
• Generate shareable short links for events
• Manage your subscription (future feature)
• Provide customer support
• Improve the app experience

Data Encryption & Security

Automatic Data Deletion

Third-Party Services

Supabase (Backend Infrastructure)

We use Supabase to store and manage:

• Event data (titles, dates, locations, descriptions)
• Encrypted RSVP responses (server cannot decrypt)
• Short link mappings
• All communications use HTTPS encryption
• Data Location: EU-hosted servers (Frankfurt, Germany)
• Supabase Privacy Policy: https://supabase.com/privacy

RevenueCat (Subscription Management)

We use RevenueCat to manage in-app subscriptions (planned feature):

• Processes your purchase information and subscription status
• RevenueCat Privacy Policy: https://www.revenuecat.com/privacy
• RevenueCat DPA: https://www.revenuecat.com/dpa

Data Storage and Retention

• Local Storage: Your created events are stored locally on your device using SwiftData (encrypted by iOS).
• Cloud Storage: Event invite pages and encrypted RSVP responses are stored in Supabase database.
• Automatic Deletion: All event data and RSVPs are automatically deleted 7 days after the event ends.
• Manual Deletion: You can delete events anytime before the auto-delete period in the app settings.
• Short Links: Short links expire when the event is deleted (automatic or manual).

Who Can See Your Data

• Event Creator (You): Full access to all event details and RSVP responses via the InviteDay app.
• Invited Guests: Can only see public event details (title, date, time, location). Cannot see other people's RSVP responses.
• InviteDay/Servers: Store encrypted RSVP data but cannot decrypt or read responses due to zero-knowledge architecture.
• Third Parties: We do NOT sell or share your data with advertisers or data brokers.

Your Rights Under GDPR

If you are in the European Economic Area (EEA), you have the following rights:

1. Right to Access: You can request a copy of your personal data.
2. Right to Deletion: You can request deletion of your events and RSVP data by deleting them in the app or contacting us.
3. Right to Rectification: You can correct inaccurate data directly in the app.
4. Right to Data Portability: You can export your event data.
5. Right to Object: You can object to data processing by not using certain features.
6. Right to Restrict Processing: You can limit how we process your data.

To exercise any of these rights, please contact us at kettunen.miika@gmail.com.

Data Security Measures

We implement multiple layers of security:

• End-to-End Encryption: AES-256-GCM encryption for all RSVP data
• Secure Key Storage: Encryption keys derived on-device, never transmitted
• Transport Security: HTTPS/TLS 1.3 for all network communications
• Database Security: Row-level security policies in Supabase PostgreSQL
• Access Controls: Authentication required for all database operations
• No Payment Data: We never handle credit cards (managed by Apple/RevenueCat)
• Automatic Deletion: Data minimization through 7-day auto-delete policy

Children's Privacy

InviteDay is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately.

Pricing & Subscription

International Data Transfers

Your data is primarily stored in EU-hosted servers (Supabase Frankfurt). If you are outside the EU, your data may be transferred to and processed in the EU. We ensure adequate safeguards are in place for such transfers in compliance with GDPR.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date at the top of this policy and, if changes are significant, by providing a notice in the app.

Contact Us

If you have questions about this Privacy Policy or want to exercise your GDPR rights, please contact us:

Email: kettunen.miika@gmail.com
Developer: Miika Petteri Kettunen
Address: Talvionpolku 1, 04300 Tuusula, Finland

Privacy Summary