Privacy Policy

BringWhat ("we", "us", "our") operates bringwhat.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, and what choices you have.

1. Information We Collect

Information You Provide

• Account data — email address, name, phone number, and password when you register.
• Profile data — profile photo, allergens, and dietary preferences you choose to add.
• Event data — event titles, descriptions, dates, locations, item lists, and guest information you create.
• Communications — feedback, support requests, and any messages you send through the Service.

Information Collected Automatically

• Usage data — pages visited, features used, and interactions with the Service.
• Device data — IP address, browser type, operating system, and device identifiers.
• Cookies — we use essential cookies for authentication and session management. See Section 6 below.

Information from Third Parties

• If you sign in with Google or another OAuth provider, we receive your name, email address, and profile photo from that provider. We only request the minimum information needed to create your account. Google's use of your data is governed by the Google Privacy Policy. You can review and revoke BringWhat's access to your Google account at any time in your Google Account permissions.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Create and manage your account.
• Send transactional emails (account verification, password resets) that are necessary for the Service to function.
• Send event-related emails (RSVP invitations) on behalf of event hosts, when you are invited to an event.
• Respond to your support requests and feedback.
• Enforce our Terms of Service, including rate limits and acceptable-use policies.
• Detect and prevent fraud, abuse, and security incidents.

3. Communication Preferences

You can manage your email preferences in your Account Settings at any time. You may also unsubscribe from promotional emails using the unsubscribe link included in every email we send.

Please note that transactional emails (account verification, password resets, and security alerts) cannot be opted out of, as they are essential for the operation of your account.

4. How We Share Your Information

We do not sell your personal information.

• Event participants — when you join an event, the host and other participants may see your name and the items you've claimed. Your email and phone number are never shared with other users.
• Service providers — we use trusted third-party services to operate and improve the platform:
  • SendGrid (Twilio) — delivers transactional emails (account verification, password resets, RSVP invitations) and event-related notifications on our behalf. SendGrid processes recipient email addresses and message content solely to deliver email for us and is contractually prohibited from using this data for any other purpose. See the Twilio Privacy Policy.
  • Google Analytics (GA4) — helps us understand how visitors use the Service so we can identify issues, improve features, and prioritize development. Analytics data is anonymized (IP anonymization enabled) and loaded only after you accept cookies via our consent banner. See Section 6 and the Google Privacy Policy.
  • Google OAuth — provides optional single sign-on so you can log in with your Google account without creating a separate password. We only receive the profile information you authorize. See the Google Privacy Policy.
  • Cloudinary — stores and optimizes images you upload (event banners, profile photos). Uploaded images are processed and served via Cloudinary's CDN. See the Cloudinary Privacy Policy.
  • Cloud hosting — for server infrastructure and data storage.
  These providers process data on our behalf to improve and maintain the Service, and are contractually obligated to protect it.
• Legal requirements — we may disclose information if required by law, regulation, or valid legal process.

5. Data Retention

• Account data is retained for as long as your account is active.
• When you delete your account, we schedule it for permanent removal. All personal data associated with the account is deleted within 30 days.
• We may retain anonymized, aggregated data for analytics purposes indefinitely.
• We keep short-lived operational backups of the database, taken before deployments. Backups are encrypted at rest and automatically deleted within 30 days, so a closed account is not retained in a backup beyond the window described above.

6. Cookies

We use the following types of cookies:

• Essential cookies — required for authentication, session management, and security (e.g., CSRF protection). These cannot be disabled.
• Preference cookies — store your cookie-consent choice and display preferences.
• Analytics cookies — if you accept cookies, we use Google Analytics (GA4) to understand how visitors interact with the Service so we can improve features and fix issues. Google Analytics sets cookies (such as _ga and _gid) to collect anonymized usage data, including pages visited, session duration, and general geographic region. We enable IP anonymization so your full IP address is never stored by Google. These cookies are only loaded after you accept cookies via our consent banner. If you decline, no analytics cookies are set and no data is sent to Google. For more information, see the Google Privacy Policy and How Google uses data from sites that use Google Analytics.

We do not use third-party advertising networks or behavioral/interest-based advertising cookies. See Section 7 (Advertising) for information about the product suggestions shown on event pages.

You can manage cookies through your browser settings or by using the cookie consent banner. Disabling essential cookies may prevent you from using parts of the Service. You may change your cookie preference at any time by clearing the bw_cookie_consent cookie in your browser settings.

7. Advertising

Event pages may display a small number of product suggestions related to items on your event's list (for example, a serving-dish suggestion next to "salad bowl"). These are not third-party advertisements and are not personalized using your browsing history, profile, or any data about you.

• How suggestions are chosen — we maintain our own curated catalog of products. An event's item list is matched against this catalog using keyword matching; the suggestion shown depends only on what's on that event's list, not on who you are or how you've used the Service.
• Affiliate links — some suggestions link to third-party retailers (such as Amazon or Instacart) through affiliate programs. If you click through and make a qualifying purchase, BringWhat may earn a commission. This does not affect the price you pay, and each suggestion discloses which retailer it links to.
• No data is shared with advertisers — we do not share your personal information, event data, or usage data with any advertiser, affiliate network, or retailer. We track, in aggregate only, how many times a given suggestion is shown and clicked, to evaluate which products are useful to show.
• No ad-tracking cookies — as noted in Section 6, product suggestions do not use cookies, pixels, or any cross-site tracking technology.

8. Your Rights

Depending on your location, you may have the following rights:

• Access — download a copy of your personal data from your Account Settings.
• Correction — update inaccurate information in your profile at any time.
• Deletion — delete your account and all associated data from your Account Settings.
• Opt-out — unsubscribe from promotional emails in your Account Settings or via the unsubscribe link in emails.
• Portability — export your data in a standard format (CSV) from your Account Settings.

To exercise any of these rights, visit your Account Settings or contact us at support@bringwhat.com.

9. Security

We protect your data with industry-standard measures including:

• Encrypted connections (HTTPS/TLS) for all traffic.
• Passwords stored using one-way cryptographic hashing (bcrypt).
• Rate limiting to prevent brute-force and abuse.
• Signed URLs for sensitive operations (email verification, unsubscribe).
• Backups encrypted at rest.

No system is 100% secure. If you become aware of a security vulnerability, please report it to security@bringwhat.com.

10. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. International Users

The Service is operated from the United States. If you access the Service from outside the US, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or an in-app notice. The "Effective" date at the top indicates the latest revision.