Privacy Policy

BringWhat ("we", "us", "our") operates bringwhat.com (the "Service"). This Privacy Policy explains what information we collect, how we use it, and what choices you have. The food allergies you can add to your profile are covered by our separate Consumer Health Data Privacy Policy.

1. Information We Collect

Information You Provide

• Account data — your email address, username and password when you register. We store only a one-way hash of your password.
• Profile data — your name, phone number and profile photo, all optional.
• Food allergies — allergies and intolerances you add to your profile, and how severe they are. We store them only after you agree, and show them on events only if you agree to that separately. See the Consumer Health Data Privacy Policy.
• Event data — event titles, descriptions, dates, addresses, cover photos, item lists, and the names and email addresses of the people you invite.
• RSVPs — your response, your name and email address, any message you send the host, and the items you are bringing.
• Feedback — feedback about the Service, and after an event your rating and comments, whether you'd like to host, and whether we may share your feedback publicly.
• Communications — support requests and anything else you send us.

Information About People Who Are Invited

When a host invites you, they give us your name and email address. We use them to show you on that event's guest list and to send you the invitation and other emails about the event. If you never sign up, we erase them a year and 30 days after the event, so a host can invite the same people again next year. To have them removed sooner, ask the host or email support@bringwhat.com. Only people with an account can be shown to others as someone they've gathered with.

Information Collected Automatically

• Sign-in records — the time, IP address, browser, sign-in method and whether each attempt to sign in to your account succeeded.
• Email records — which emails we sent you, when, and whether they were delivered.
• Who you've gathered with — after an event, we record which account holders attended it together and how many events they have shared. See Section 4.
• Usage limits — if an account hits one of our usage limits, we record which limit and where, so we can review it.
• Blog reactions — if you react to a blog post without signing in, we store a salted, one-way hash of your IP address and browser so that each visitor counts once. We never store the IP address itself.
• Product suggestion counts — how often each suggestion is shown and clicked, in total, without recording who.
• Analytics — if you accept cookies, the pages you visit and how you use them. See Section 6.
• Device data — like every website, our servers receive your IP address and browser details with each request.

Information from Third Parties

• If you sign in with Google, we receive your name, email address, and profile photo from Google. We only request the minimum information needed to create your account. Google's use of your data is governed by the Google Privacy Policy. You can review and revoke BringWhat's access to your Google account at any time in your Google Account permissions.
• Hosts give us the names and email addresses of the people they invite, as described above.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service, and create and manage your account.
• Send transactional emails: email verification and its reminders, password resets, account deletion notices, replies to your feedback, and a link to your email settings when you ask for one.
• Send emails about events you are invited to, on the host's behalf: the invitation and reminders to respond. Once you say yes, an RSVP confirmation, a reminder the day before and a day-of email with the address. Hosts get a recap afterwards, and guests with an account a request for feedback.
• Send optional emails only if you turn them on: "Interested in hosting?" and "people you met" after an event, and, once you confirm your subscription, seasonal reminders and product updates.
• Suggest dishes and their usual ingredients when you ask for suggestions while adding an item to a bring list. The text you typed is sent to an AI provider (currently Google Gemini), and nothing else about you is.
• Respond to your support requests and feedback.
• Enforce our Terms of Service, including rate limits and acceptable-use policies.
• Detect and prevent fraud, abuse, and security incidents.

We do not sell your personal information, use it for targeted advertising, or use it to train AI models.

3. Communication Preferences

Every email we send has an Email settings link that opens the settings for your address, with or without an account and without signing in. You can also ask for that link at Manage my email; we send it only to the address you enter. If you have an account, the same settings are in your Account Settings.

• Invitations and reminders to respond have an unsubscribe link. It stops all email to your address except emails about a party you've already said yes to. You can turn email back on from your email settings at any time.
• Recaps, feedback requests and the other emails for account holders each have a link that turns off that type of email, and every promotional email has an unsubscribe link.
• Emails about a party you've said yes to (the RSVP confirmation, the reminder the day before and the day-of email) have no unsubscribe link. To stop them, change your RSVP.

Please note that transactional emails (account verification, password resets, and security alerts) cannot be opted out of, as they are essential for the operation of your account.

4. How We Share Your Information

We do not sell your personal information.

• People at your events — the host and guests of an event you join can see your name, profile photo, RSVP response and the items you are bringing. The host also sees the email address they invited you with. Your phone number is never shown to other users. Your allergies are shown, without your name, only if you agree; see the Consumer Health Data Privacy Policy.
• People you've gathered with — if you turn on "Show me in recently gathered with", your name may appear in "people you met" emails sent to people who attended an event with you. It is off unless you turn it on.
• Public feedback — if you say we may share your event feedback publicly, we may quote it.
• Service providers — we use these third-party services to run the Service:
  • DigitalOcean — hosts our servers, database and backups in the United States.
  • SendGrid (Twilio) — delivers our emails. SendGrid processes recipient email addresses and message content solely to deliver email for us. See the Twilio Privacy Policy.
  • Cloudinary — stores, resizes and serves the images you upload, such as event covers and profile photos. See the Cloudinary Privacy Policy.
  • Google Analytics (GA4) — helps us understand how visitors use the Service. It loads only after you accept cookies. See Section 6 and the Google Privacy Policy.
  • Google sign-in — lets you log in with your Google account if you choose to. We only receive the profile information you authorize.
  • Google Gemini — suggests dishes and ingredients from the item text you type, as described in Section 2.
  • Google Fonts and jsDelivr — serve the fonts and page code that every page loads, so they receive your IP address and browser details whether or not you accept cookies. The page code is two open-source libraries, Bootstrap and Unpoly, each fixed at one version. Your browser checks every file of it against a fingerprint in our page and refuses to use one that does not match.
• Legal requirements — we may disclose information if required by law, regulation, or valid legal process.
• Business transfers — if BringWhat is merged, acquired or sold, your information may transfer with it, and this policy will continue to apply to it.

5. Data Retention

• Account data is retained for as long as your account is active.
• When you delete your account, you have three days to change your mind. After that we erase your personal data, always within 30 days of your request. Your name, contact details, photos, allergies, sign-in details and the record of who you've gathered with are deleted, and your RSVPs remain on events as "Deleted User".
• If you were invited but never signed up, your name, email address, RSVP and email settings are erased a year and 30 days after the event.
• If you asked us to stop all email, then when your account or guest details are erased we keep only a one-way, keyed hash of your email address, so we can go on honouring that without keeping the address. It is deleted if you turn email back on.
• Sign-in records are deleted after 180 days, and email records after 365 days.
• Allergies are kept until you delete them, withdraw your consent or delete your account.
• Accounts whose email address is never verified are deleted as described in our Terms.
• We back up the database before each update. Backups older than seven days are deleted, so nothing stays in a backup for more than 30 days.
• We may retain anonymized, aggregated data for analytics purposes indefinitely.

6. Cookies

We use the following types of cookies:

• Essential cookies — keep you signed in and protect forms from forgery. These cannot be disabled.
• Preference cookies — bw_cookie_consent remembers your cookie choice, and bw_mode and bw_contrast remember the appearance and contrast you pick at the foot of each page. They are set only when you make a choice, last one year and are never sent anywhere else.
• Analytics cookies — if you accept cookies, Google Analytics (GA4) sets _ga and _ga_<ID> to tell visits apart and to measure which pages are used, how long visits last and roughly where visitors are. Google Analytics 4 does not log or store IP addresses. If you decline, Google Analytics never loads and we delete any analytics cookies already set. For more information, see How Google uses data from sites that use Google Analytics.

We do not use advertising cookies. You can manage cookies in your browser settings, and you can see the cookie banner again by clearing the bw_cookie_consent cookie. Disabling essential cookies may prevent you from using parts of the Service.

7. Do Not Track and Global Privacy Control

Your browser may send a Do Not Track or Global Privacy Control signal. We do not sell personal information or use it for targeted advertising, so these signals do not change anything on BringWhat. Analytics loads only if you accept cookies, whatever your browser sends.

8. Product Suggestions

Event pages and blog posts may display a small number of product suggestions, such as a serving dish next to "salad bowl" on an event's list. These are not third-party advertisements and are not personalized using your browsing history, profile, or any data about you.

• How suggestions are chosen — we keep our own catalog of products. On an event, the suggestion depends only on the items on that event's list. On a blog post, it depends on keywords chosen for that post.
• Affiliate links — some suggestions link to third-party retailers (such as Amazon or Instacart) through affiliate programs. If you click through and make a qualifying purchase, BringWhat may earn a commission. This does not affect the price you pay, and each suggestion discloses which retailer it links to.
• No data is shared with advertisers — we do not share your personal information, event data, or usage data with any advertiser, affiliate network, or retailer. We count how often each suggestion is shown and clicked, in total. If you have accepted analytics cookies, Google Analytics also records your click along with the rest of your visit.
• No ad-tracking — product suggestions do not use advertising cookies, pixels, or cross-site tracking.

9. Your Rights

You can do the following yourself, in your Account Settings:

• Access and portability — download a copy of your data as a PDF, or as a JSON file another service can import.
• Correction — update inaccurate information in your profile at any time.
• Deletion — delete your account and the personal data associated with it.
• Allergies — stop showing them, or withdraw consent and delete them, at any time.
• Emails — turn off event and promotional emails.

You can also email support@bringwhat.com from the address on your account. We may ask you to confirm that the request comes from you. We answer within 45 days, and if we need longer we'll tell you why and still answer within 90 days. If we turn down a request, you can appeal by replying with "Appeal" in the subject. We'll reply in writing within 45 days, and if we still turn it down, you can complain to your state attorney general. Using these rights never changes how BringWhat works for you.

10. Security

We protect your data with industry-standard measures including:

• Encrypted connections (HTTPS/TLS) for all traffic.
• Passwords stored using one-way cryptographic hashing (bcrypt or Argon2).
• Rate limiting to prevent brute-force and abuse.
• Signed URLs for sensitive operations (email verification, unsubscribe).
• The database and its backups stored on encrypted disks.
• Database access limited to the people who run BringWhat.

No system is 100% secure. If you become aware of a security vulnerability, please report it to security@bringwhat.com.

11. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. International Users

The Service is operated from the United States. If you access the Service from outside the US, your information will be transferred to and processed in the United States.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Before a material change takes effect, we will notify registered users by email or with a notice in the Service. The version and publish date at the top show which version this is.