Privacy

Last updated 22 September 2026

The short version

QuickEvites is free, has no ads, and does not sell or share your data with anyone. Guests can RSVP without creating an account. We collect the least we can get away with and still run the service.

What we store

• Your invitation. The event title, date, time, location, description, registry links and the design you chose — plus any photo you upload for a custom card.
• RSVPs. The name a guest types, their yes / no / maybe answer, and an optional message. If they are coming we also ask for their email address, and optionally a phone number, so the host can send a reminder and tell them if the event moves or is called off. Declining never requires an email.
• Who is in a guest’s party. A guest can list the people coming with them: a name, whether each is an adult or a child, any allergies or dietary needs, a short note, and optionally an email so a reminder can reach that person directly. Every one of these is optional except the number of people.
• A host’s invite list. Hosts can type or paste the people they are inviting (a name, and an email if they have one) so the dashboard can show who has not replied yet, and so we can email those people the invitation if the host asks us to. This list is visible only to the host who created it.
• Your account, if you make one. Email address and a securely hashed password, handled by our database provider, Supabase. An account is optional — it just keeps your invitations in one place.

All of this lives in a Supabase (PostgreSQL) database. The website runs on Vercel, which keeps standard server logs, including IP addresses, for operational and security purposes.

Bot protection

We use Cloudflare Turnstile to check that a real browser — not an automated script — is submitting an RSVP. It runs once per visit and is invisible unless it needs you to confirm something. Cloudflare receives your IP address and some technical details about your browser in order to make that judgement. It is not used to track you across other sites, to build a profile of you, or to show you advertising.

Analytics

We count how the site is used two ways, and neither uses a cookie, tracks you across other sites or builds a profile of you. Product events — an invitation being created, a share link being copied, an invitation being opened, an RSVP being sent — are counted in our own database. Page views are counted by Vercel Web Analytics, run by Vercel, who host this site; it is cookie-free and records the page, not the person.

Those events carry the public invitation id so we can count how many invitations actually get used, plus a random id that lives only until you close the tab. They never include guest names, RSVP messages, email addresses, phone numbers, dietary notes or uploaded photos. Neither counter is told the address of a host dashboard or a password-reset page, and neither is ever sent a query string — which is where an emailed invitation link carries a guest’s address.

Email we send to guests

If a host adds your email address to their invite list, we can send you the invitation for that event, once. If you give us an email address when you RSVP, we use it for this one event and nothing else: a reminder the day before, a notice if the host changes the details, and a notice if the event is cancelled. Change and cancellation notices go to everyone who replied — including people who said no, since a new date can change the answer.

Invitation links in those emails include the address we sent them to, so the page can greet you by name and show the reply we already have instead of an empty form. It identifies one address for one event; it is not a login and it cannot be edited to open somebody else’s reply.

There is no newsletter and no marketing email. Every message has a one-click link to stop emails about that event, and it applies to every kind. Opting out of one event never affects invitations from other hosts.

Who can see your invitation

Invitation links and host dashboard links are unlisted: they are not indexed by search engines and are not listed anywhere public — but anyone holding the link can open it. The dashboard link in particular is a secret. Share it only with people who should see your responses.

How long we keep things

Invitations, RSVPs and guest contact details stay until the host deletes them or asks us to — deleting an invitation deletes everything attached to it. Analytics data is kept for six months, then automatically deleted; the aggregate counts that remain are never linked back to a person.

Deleting your data

You can delete an invitation from your dashboard, which removes its RSVPs with it. To delete your whole account, go to your account page and use “Delete my account”. It happens immediately and it is complete: your login, every invitation, every RSVP your guests sent, and any photos you uploaded. Nothing is kept, and you do not have to email anyone to ask.

Children

QuickEvites is meant for adults organising events. We do not knowingly collect information from children under 13. Kids’ party invitations are of course fine — the account holder is the grown-up.

Contact

Questions, or a deletion request: hello@quickevites.com