Privacy Policy

1. Introduction

Celebrate is a party-planning app that helps hosts create parties, design and send invitations, collect RSVPs, coordinate group gifts, share party pictures, and send thank-you cards. Celebrate is operated by Tyler Stenson, doing business as Celebrate, a sole proprietorship based in Canada ("Celebrate", "we", "us", or "our").

This Privacy Policy explains what personal information we collect, why we collect it, how we use, share, and protect it, and the choices and rights you have. It applies to the Celebrate mobile app (iOS and Android), the guest web experience at mycelebrate.ca, and any related services (together, the "Service").

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, substantially similar provincial privacy laws, including Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25), Alberta’s Personal Information Protection Act, and British Columbia’s Personal Information Protection Act. Our practices follow the ten fair information principles set out in PIPEDA.

By creating an account or using the Service, you consent to the collection, use, and disclosure of your personal information as described in this Policy. If you do not agree, please do not use the Service.

2. Who this Policy covers

• Hosts — people who create a Celebrate account to plan parties and send invitations.
• Guests — people (or the parents/guardians of children) who receive an invitation and respond to it, including through the guest web experience. Guests do not need an account; they access their invitation with a personal guest code or QR code.
• Gift contributors — guests who chip in money toward a group gift.

3. Personal information we collect

3.1 Information you provide directly

• Account information (hosts): your name, email address, phone number (optional), and a password. Passwords are handled by our authentication provider (Google Firebase Authentication) and are never visible to us in plain text.
• Party details: party name, date and time, location or venue address, theme, and related details you enter when creating a party.
• Guest list information: names, email addresses, and phone numbers of guests — typically the parent or guardian of an invited child — that a host enters manually or imports from their device’s contacts (with the host’s permission, and only for the contacts the host selects).
• Invitations and cards: invitation designs, photos, and text you add to invitations, thank-you cards, and greetings.
• RSVPs and messages: RSVP responses, dietary or other notes a guest chooses to share, party message threads between hosts and guests, and group-gift chat messages.
• Photos: pictures you choose to add to invitations or share to a party’s picture gallery, selected from your photo library or taken with your camera. With your permission, the app can also save invitations and party pictures to your photo library.
• Group-gift information: gift ideas, contribution amounts, who has chipped in, and the designated purchaser for a gift.

3.2 Payment information

• Group-gift contributions are processed by Stripe. Your card details are entered directly into Stripe’s payment interface and are sent to Stripe — we never receive or store your full card number. We receive confirmation of the payment (amount, status, and a payment reference) so we can record your contribution.
• Party credits are purchased through the Apple App Store or Google Play, with purchases managed by RevenueCat. Apple or Google processes your payment; we receive confirmation of the purchase so we can credit your account. We never see your payment card details.
• Payouts: when pooled group-gift funds are paid out (for example, to a gift’s designated purchaser or e-transferred to the host), we use the contact information already on file to arrange the payout.

3.3 Information collected automatically

• Push notification tokens so we can deliver notifications you have enabled (for example, RSVP updates or new messages).
• Delivery logs for invitations and other emails/texts we send on your behalf (recipient, subject, and delivery status), so hosts can see whether invitations arrived.
• Crash and diagnostic data collected through Sentry (device model, operating system version, app version, and technical details of errors) to help us find and fix bugs.
• Basic technical information needed to operate the Service, such as device type and app version.

We do not collect precise device location. Maps shown in the app are used only to display the party venue address the host entered. We do not use your information for third-party advertising, and we do not sell personal information.

3.4 Device permissions

The app requests certain device permissions, each for a specific purpose. You can decline or revoke any permission in your device settings; the related feature simply won’t work.

• Contacts — to let hosts quickly add parent/guardian details when inviting guests. Only the contacts you select are used.
• Camera — to scan an invitation QR code.
• Photo library — to add pictures to invitations and party galleries, and to save invitations and party pictures to your device.
• Notifications — to send you party updates you have opted into.

4. How we use personal information

We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and only as needed to:

• create and manage host accounts and guest access (guest codes and QR codes);
• create parties and deliver invitations, reminders, updates, cancellation notices, and thank-you cards by email (via SendGrid) or text message (via Twilio) at the host’s request;
• collect and display RSVPs, messages, and party pictures for the people involved in a party;
• process group-gift contributions, track pooled funds, send contribution reminders, and arrange payouts or refunds;
• process party-credit purchases and maintain credit balances;
• send push notifications you have enabled;
• provide customer support and respond to your requests;
• monitor, debug, and improve the reliability and security of the Service;
• detect and prevent fraud or misuse; and
• comply with legal obligations.

If we want to use your personal information for a new purpose not covered by this Policy, we will ask for your consent first.

5. Consent

We rely on your consent to collect, use, and disclose your personal information. The form of consent depends on the sensitivity of the information and your reasonable expectations: we obtain express consent for things like account creation, payments, and device permissions, and implied consent for uses that are obviously necessary to deliver a feature you have chosen to use (for example, sharing your RSVP with the party’s host).

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by adjusting your device permissions, disabling notifications, or contacting us (Section 13). Withdrawing consent may limit or prevent our ability to provide parts of the Service.

Guest information entered by hosts

Hosts provide us with the contact information of their guests (or guests’ parents/guardians) so that we can deliver invitations and party communications on the host’s behalf. As a host, you confirm that you have the authority or consent needed to share a guest’s contact information with us for this purpose. We use guest contact information only to deliver and manage communications for that host’s parties — never to market to guests or for any unrelated purpose. Invitation emails and texts identify the host and the party they relate to, and messages sent through the Service comply with Canada’s Anti-Spam Legislation (CASL).

6. Children’s privacy

Celebrate is designed for use by adults. Many parties planned with Celebrate are for children, but invitations, RSVPs, and communications are directed to parents and guardians — the app is built so hosts invite a child’s parent or guardian, not the child. We do not knowingly create accounts for, or collect personal information directly from, children under 13.

Information about a child that a host chooses to include (for example, the child’s first name on an invitation or a party photo) is provided by the host or guests, who are responsible for having the appropriate consent to share it. If you believe a child’s personal information has been provided to us improperly, contact us and we will delete it.

7. When we share personal information

We do not sell, rent, or trade personal information. We share it only in these circumstances:

7.1 With other people at your party

• Hosts see their guest list, RSVP responses, notes guests share, messages, contributions to group gifts, and party pictures.
• Guests of the same party can see shared party content, such as party details, the picture gallery, party messages, and (for group-gift participants) gift chat and contribution progress.

7.2 With service providers

We use a small number of carefully chosen service providers who process personal information on our behalf, only as needed to run the Service and under contractual protections:

• Google Firebase (Google LLC) — authentication, database, file storage, cloud functions, and push-notification delivery.
• SendGrid (Twilio Inc.) — email delivery of invitations and party communications.
• Twilio Inc. — text-message (SMS) delivery of invitations.
• Stripe, Inc. — payment processing for group-gift contributions.
• RevenueCat, Inc. — in-app purchase management for party credits (alongside Apple and Google, which process the payments).
• Sentry (Functional Software, Inc.) — crash reporting and error diagnostics.
• Expo (650 Industries, Inc.) — app delivery infrastructure and push-notification services.

7.3 Other disclosures

• When required or permitted by law — for example, in response to a valid court order, subpoena, or other lawful demand, or to report a breach to authorities.
• To protect rights and safety — to investigate fraud, enforce our terms, or protect the rights, property, or safety of Celebrate, our users, or the public.
• Business transitions — if Celebrate is incorporated, or if we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. Any successor will be bound by commitments materially consistent with this Policy, and we will notify you of any change in control or use of your personal information.

8. International transfers

Our service providers listed above store and process data primarily in the United States. This means your personal information may be transferred to, stored in, and processed in a jurisdiction outside Canada, where it is subject to the laws of that jurisdiction, including lawful access by courts, law enforcement, and national security authorities there. We use contractual and technical safeguards to require a comparable level of protection wherever your information is processed. If you have questions about our transfers of personal information outside Canada, contact us using the details in Section 13.

9. Retention and deletion

We keep personal information only as long as necessary to fulfil the purposes it was collected for, to meet legal, accounting, or tax requirements (for example, payment records), and to resolve disputes. In general:

• Account information is kept while your account is active and deleted or anonymized within a reasonable period after you delete your account.
• Party content (invitations, guest lists, RSVPs, messages, and pictures) is kept while the party and account remain active; when a party or account is deleted, associated content is removed from our systems, and our systems automatically clean up data linked to deleted records.
• Payment and contribution records may be retained longer where required for financial, tax, or fraud-prevention purposes.
• Email and SMS delivery logs and crash reports are retained for limited periods for troubleshooting and then deleted.

Information that no longer needs to be identifiable is deleted or irreversibly anonymized. Copies held by our service providers are deleted in accordance with their retention schedules.

10. Safeguards

We protect personal information with safeguards appropriate to its sensitivity, including:

• encryption of data in transit (TLS/HTTPS) and at rest in our cloud infrastructure;
• authentication and per-user access rules on our database and storage, so party content is available only to the host and invited guests;
• unique, hard-to-guess guest codes and access tokens for invitation access;
• secrets management for all service credentials, and payment processing delegated to PCI-DSS-compliant providers (Stripe, Apple, Google);
• secure credential storage on your device (system keychain/keystore); and
• server-side validation of all requests to our backend.

No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for the security of your own device.

11. Breach notification

If a breach of security safeguards creates a real risk of significant harm to you, we will report it to the Privacy Commissioner of Canada, notify you as soon as feasible, notify any other organizations that may be able to reduce the risk of harm, and keep records of the breach, all as required by PIPEDA and applicable provincial law (including Quebec’s confidentiality-incident requirements, where they apply).

12. Your rights

Subject to limited exceptions set out in law, you have the right to:

• Access — request a copy of the personal information we hold about you, an account of how it has been used, and a list of third parties to which it has been disclosed.
• Correction — have inaccurate or incomplete information corrected. Hosts can update their name, email, and phone number directly in the app’s account settings.
• Withdrawal of consent — withdraw consent to our handling of your information (Section 5).
• Deletion — ask us to delete your account and personal information, subject to information we must retain by law.
• Portability (Quebec) — if you are in Quebec, request the computerized personal information you provided to us in a structured, commonly used technological format.
• Complaint — challenge our compliance with this Policy and applicable privacy law (Section 13).

Guests who received an invitation can ask us to correct or delete their contact information, or to stop communications about a party; we will act on the request and inform the host where appropriate.

We will respond to written requests within 30 days as required by PIPEDA. We may need to verify your identity before acting on a request. If we refuse a request in whole or in part, we will explain why and tell you what recourse you have. There is no fee for reasonable access requests.

13. Accountability and contact

Tyler Stenson is responsible for Celebrate’s compliance with this Policy and applicable privacy laws, and acts as Celebrate’s Privacy Officer (in Quebec, the person in charge of the protection of personal information).

To exercise your rights, ask a question, or make a complaint, contact:

Privacy Officer — Celebrate

Email: celebrate.support@gmail.com

Website: https://mycelebrate.ca

We take every complaint seriously, will investigate, and will take appropriate measures to correct any problem we find. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376) or, where applicable, your provincial privacy regulator: the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Information and Privacy Commissioner for British Columbia.

14. Changes to this Policy

We may update this Policy from time to time as the Service or the law changes. The "Last updated" date at the top shows when it was last revised. For material changes, we will give you notice in the app or by email before the change takes effect, and where required we will seek your renewed consent. Your continued use of the Service after a change takes effect means you accept the updated Policy.

15. Governing law

This Policy and our handling of personal information are governed by the laws of Canada and, where applicable, the province in which you reside.