Privacy Policy

Who we are and how to contact us

PartyGuy is run by Shubham Bhatt, an individual based in Dehradun, Uttarakhand, India. There is no company yet. Under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), I decide why and how your data is used.

Write to hello@partyguy.in for anything about your data. Complaints go to the Grievance Officer (that is also me).

What we collect

If you are a host (you have an account and make invites)

• Account details from our sign-in provider, Clerk: your name, email address and profile photo. If you choose to sign in with Google, Clerk receives these from Google. We keep a copy and refresh it from Clerk about once a day.
• Your events: title, description, date and time, venue and map link, the poster you upload (or the built-in one you pick), look and font choices, guest limit, and whether the guest list is shown.
• Your guests' answers to your invites. You can see each guest's name, photo, answer, when they answered, and whether you checked them in. You never see their email address.

If you are a guest (you answer an invite)

To answer Going, Maybe or Can't go you need an account, so we hold the account details above plus your answer, when you gave it and, if the host uses door check-in, when you were checked in. Your name and photo come from your account. If you only look at an invite, you do not need an account.

If you are a visitor, or you report an invite

• Reports: the reason you pick, your optional note (up to 500 characters), the invite, the time, and a one-way scrambled fingerprint (a salted hash) of your account, or of your IP address and browser details if you are signed out. We do not store your IP address, name or email with a report.
• Rate-limit counters: to stop abuse, Cloudflare counts your recent requests for about 60 seconds. When you are signed in the counter is keyed to your Clerk user id (not hashed). When you are signed out it is keyed to a salted hash of your IP address and browser details, and the raw IP address is not kept in it.
• Technical logs: our hosting providers keep ordinary request logs (such as IP address, time, page and browser) for security and debugging. We also send error reports to Sentry, without cookies, headers, request bodies or user details, and with email addresses removed from messages.

Who can see what

• Anyone with an invite link sees its title, description, date, time, poster, and the host's name and photo.
• The venue and map link are shown only to the host and to guests who answered Going or Maybe.
• If the host switches the guest list off, only the host sees guests. If it is on, guests who answered Going or Maybe see names, photos and answers; everyone else sees only a short preview of names and photos.
• The host's dashboard shows recent answers as first name and last initial. The host can download the guest list (name, answer, time answered, checked in) as a file.
• Invite pages ask search engines not to list them, but anyone you send the link to can pass it on.

Why we use it

• To run the service: sign you in, show invites, record answers, run door check-in.
• To keep it safe: review reports, remove harmful invites, limit abuse, fix errors.
• To answer you when you write to us.

We do not use your data for advertising or profiling.

Who we share it with

We do not sell your data and we show no ads. We use these services to run PartyGuy, and they handle data for us:

• Clerk: sign-in and accounts.
• Google: only if you choose to sign in with Google.
• Vercel: hosts the website.
• Cloudflare: runs our server (Workers), stores posters (R2), connects to the database (Hyperdrive) and limits abuse.
• Neon: the database that holds accounts, events, answers and reports.
• Sentry: error monitoring.

We may also share data if the law requires it, or to protect someone from harm. Sharing an invite link on WhatsApp or elsewhere is your choice, and those apps have their own policies.

Where it is stored

The services above run on servers in several countries, so your data may be stored or processed outside India, including in the United States and Europe. We use well-known providers and follow what the DPDP Act allows for transfers.

How long we keep it

• Events and answers: until the host deletes the event or the host's account is deleted. Deleting an event removes its answers and reports, and its uploaded poster unless another of the host's events uses it.
• Account details: until you delete your account. You can do that yourself in Settings, which removes your invites, your answers to other invites, your name and your photo. If you cannot, email us (see your rights below).
• Reports: until they are resolved, and then for a reasonable period so we can spot repeat abuse. They also go when the invite is deleted.
• Logs and error reports: short-term, on the schedules our providers set.
• Rate-limit counters: about 60 seconds.

Backups kept by our providers may hold deleted data for a short while longer.

Your rights

Under the DPDP Act, 2023 you can:

• Access a summary of the personal data we hold about you.
• Correct or update it. Change your name and photo in Settingsand they show on your invites and guest lists straight away. Your email comes from your Google account.
• Erase it, unless we must keep it by law. Use “Delete my account” in Settings.
• Get your complaint heard by our Grievance Officer (grievance redressal).
• Nominate another person to use these rights for you if you die or cannot act.

Updating and erasing are in Settings. For anything else, or if Settings does not work for you, email hello@partyguy.in from the address on your account and say what you want. We acknowledge within 24 hours and aim to finish within 15 days. If you are not happy with our answer, you may complain to the Data Protection Board of India, as the Act provides. See the Grievance Officer details.

Children

You must be 18 or older to create an account. We do not knowingly collect data from children. If you think a child has an account, email hello@partyguy.in and we will remove it.

Security

Pages and data travel over HTTPS. Sign-in is handled by Clerk, so we never see or store your password. Reports and rate limits use hashes, not raw IP addresses. No system is perfectly safe, so please use a strong password and tell us if you notice anything wrong.

Cookies and similar storage

We use only what is needed to sign you in and keep the site safe: Clerk's sign-in cookies, and a little browser storage so the page can remember an unsent draft invite, an answer you were about to give, and which guest answers you have already seen. We use no advertising cookies and no analytics or tracking tools.

Changes to this policy

When this policy changes, we update the “Last updated” date at the top of this page.