Privacy Policy

• Account details: your name, email address and password (stored only as a secure hash by our sign-in provider). If you choose "Continue with Google", Google shares your name, email address and profile picture with us (see section 3).
• What you add to a celebration: events, guest names, phone numbers, email addresses, headcounts and notes, RSVPs, budgets, expenses and receipt photos, vendors and payments, to-dos, gift records, travel and room details, outfits and photos. You, and the people you invite to plan with you, decide what goes in.
• Guests' replies: when a guest opens their invitation link we record that it was opened, and we store their RSVP answers and any photos they choose to upload after an event.
• Technical information: IP address, browser type and request logs, used to keep the service running and secure (for example rate limits and abuse prevention), and delivery status for emails we send (delivered, bounced or marked as spam). When you sign in, create an account or ask for a password reset, Cloudflare Turnstile checks that a person (not a bot) is making the request, using signals from your browser.
• Security settings: if you turn on two-step verification, its setup is stored by our sign-in provider.

• To run Celebracia: showing each celebration to you and the people you invite, with the access you choose.
• To send the emails you ask for (invitations to your guests, invitations to collaborators, notices about duties assigned to someone) and account emails (confirming your email, password resets and security alerts).
• To keep accounts and data safe, prevent abuse and fix problems.
• To answer your support and plan requests.

We don't sell personal information and don't use it for advertising. Celebracia has no advertising. We use Google Analytics to count visits and see which pages are used, so we can improve the app; it gets the kind of page visited (never invitation codes, celebration details or anything you've entered), your browser and device type and rough location, and it doesn't receive your name or email. Google Analytics' advertising features are switched off.

Celebracia offers "Continue with Google" so you can sign in with your Google account instead of a new password. Signing in is the only thing Celebracia uses Google APIs for.

What we access. When you choose "Continue with Google", Google asks your permission to share the following with Celebracia, and nothing else:

• your name and profile picture (the "profile" permission);
• your email address (the "email" permission);
• your Google account ID, which identifies your account (the "openid" permission).

Celebracia does not request, and cannot see, your Gmail, Google Drive, contacts, calendar, photos or any other Google data.

How we use it. Only to create your Celebracia account, sign you in, and show your name and picture to the people you plan a celebration with. Your email address is also used for account emails (such as security alerts) and the celebration emails you ask us to send.

How we store and protect it. It is stored with your account by our sign-in provider, Supabase, in Mumbai, India. It is encrypted in transit (HTTPS) and at rest, and the database's access rules limit who can see it to you, the people you plan with, and Celebracia's administrators when running the service (see section 8).

Who we share it with. We don't sell, rent or trade Google user data, and we don't share it with anyone except the service providers in section 5 that run Celebracia for us (only to provide the service), the people you plan a celebration with (your name and picture), and where the law requires it. We don't use it for advertising, and we don't use it to develop, improve or train AI or machine-learning models.

How long we keep it, and deleting it. For as long as you have a Celebracia account. You can disconnect Celebracia from your Google account at any time at myaccount.google.com/permissions. To delete your account and this information, email support@celebracia.com; we'll delete it within 30 days, and remaining copies in backups expire as described in section 7.

Limited Use. Celebracia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Some optional features use Claude, an AI model made by Anthropic: an assistant that answers questions about your celebration, starter checklists, message drafts and reading receipts. When you use one, only the details needed for that request are sent to Anthropic to produce the answer. Under Anthropic's commercial terms, this data isn't used to train their models. AI answers can be wrong, so please check them before relying on them.

• People you invite to a celebration, according to the role and access you give them. With Private Groups on, one side's private events are hidden from the other side.
• Each guest sees only their own invitation and RSVP page.
• Service providers that run parts of Celebracia for us, only to provide the service:
  • Supabase: database and sign-in, hosted in Mumbai, India, on Amazon Web Services
  • Cloudflare: delivering the website, and storing uploaded photos and documents (Cloudflare R2)
  • Amazon Web Services (Simple Email Service): sending email
  • Brevo: sending some account emails (such as sign-in links)
  • Google: only if you choose "Continue with Google"
  • Cloudflare Turnstile: the "are you a person?" check when you sign in, create an account or reset your password
  • GitHub and Google Drive: storing our encrypted backups (see section 7)
  • Google Analytics: counting visits (see section 2)
  • Anthropic: AI features, only when you use them
• Authorities, if the law requires it, or to protect the safety and rights of our users or the public.

WhatsApp: when you send invitations by WhatsApp, Celebracia opens WhatsApp on your own device with the message ready and you send it from your own account. We don't connect to your WhatsApp or read your messages.

Your celebration data is stored in India (Mumbai). Uploaded photos and documents are stored with Cloudflare R2, which may keep them outside India. Some providers process data in other countries, for example email delivery in the United States. We use providers that protect data with industry-standard safeguards.

For as long as your account or the celebration exists. When an owner deletes a celebration, its content is deleted. To delete your account, email support@celebracia.com and we'll delete it along with your personal information, except anything we must keep by law.

To recover from mistakes and to keep a record of who changed what, the database keeps a history of changes to celebration data for up to 1 year. Encrypted backups of the whole service are kept for up to 180 days. Deleted information stays in that history and in backups until they expire, and is then removed.

Encrypted connections (HTTPS), access rules enforced by the database itself (people only see the celebrations, and the parts of them, they've been given), private file storage, optional two-step verification, and limits that prevent misuse. No method of storing or sending data is perfectly secure, but we work hard to protect yours, and we'll tell affected people about a breach as the law requires.

You can view and update your account and celebration details in the app. You can ask us to access, correct, export or delete your personal information, or withdraw your consent, by emailing support@celebracia.com. We'll reply within 30 days. Depending on where you live (for example under Canada's PIPEDA, India's Digital Personal Data Protection Act or the GDPR), you may have additional rights, including complaining to a data protection authority.

Hosts add their guests' details and are responsible for having permission to do so and to invite them. We use guests' details only to run that host's celebration, for example sending the invitations the host asks us to send. If you're a guest and want your details removed, ask the host or email support@celebracia.com.

Accounts are for adults (18 or older). Hosts may list children as guests; we use that information only for the celebration.

We use your browser's local storage to keep you signed in and remember preferences such as your language. Google Analytics sets its own cookies to tell visits apart. We don't use advertising cookies.

We'll post any changes on this page and update the effective date. For significant changes we'll also let you know by email or in the app.

Dax Patel, operating as Celebracia. Email support@celebracia.com.