Privacy Policy

Your account. Your email address and a hashed password. We never store your password itself. What we store is a bcrypt hash, which cannot be reversed.

What you enter about your wedding. Names, dates, venues, budgets, tasks, themes, seating plans, and notes.

Information about other people. This is the part worth reading carefully. To plan a wedding you enter details about people who are not our customers:

• guests: names, how many are coming, dietary and transport needs, and their RSVP replies
• vendors: business names, phone numbers, email addresses, prices, and payment records

You decide what to enter about these people and how long to keep it. We store and process it on your behalf so the service works. If someone asks you to remove their details, you can delete them yourself at any time, and we will help if you ask.

Payment records. Payment is by bank transfer or WhatsApp, so we see the slip or message you send us. We never receive or store card numbers. There is no card payment in the service at all.

• run the service: save your plans, show your dashboard, generate RSVP links
• send transactional email: address confirmation and password resets
• activate your plan when you send proof of payment
• investigate faults and abuse

We do not sell your data, share it for advertising, or send marketing email without asking you first.

Only the suppliers needed to run the service:

• Railway: hosting and the database the service runs on
• Resend: sends confirmation and password-reset email
• Cloudflare: counts visits to the site (see Cookies below)

They process data on our instructions. We may also disclose information where the law requires it.

Each guest gets a link containing a unique token. Anyone holding that link can see the wedding details you chose to show and submit a reply, without signing in. That is what makes it easy for your guests. Treat the links as semi-private and share them directly with the guest concerned.

Your data stays while your account is open. Ask us to close it and we will delete your weddings and everything in them, including guest and vendor records. Backups are kept for a short period for disaster recovery and age out on their own.

• passwords are hashed with bcrypt
• traffic is encrypted with HTTPS
• sessions use signed, HTTP-only cookies your browser will not expose to scripts
• password reset links are single-use, expire within an hour, and are stored only as a hash

No service can promise perfect security, but if a breach affects your data we will tell you.

One cookie, used to keep you signed in. There is no advertising tracking.

To know how many people visit, we use Cloudflare Web Analytics. It counts page views and records which site sent you, your country, and your type of device. It sets no cookies, does not build a profile of you, and does not follow you to other sites. It is never loaded on RSVP, password-reset, or email-confirmation pages, because their addresses contain private links.

You can ask for a copy of your data, ask us to correct it, or ask us to delete it and close your account. Most of it you can edit or delete yourself in the app. Sri Lanka's Personal Data Protection Act gives you these rights; we will honour them regardless of where you live.

The service is for adults planning a wedding and is not directed at children.

If we change this policy we will update the date above, and tell you by email if the change is significant.

Questions, or want your data removed? Message us on WhatsApp at +94 77 540 9889.