Draft only. This is not legal advice and must be reviewed by an attorney before it is published.

Privacy Policy

Last updated: November 2, 2026

The short version. Whoyay helps a host pick a date, invite people, split a bring list and share photos. Hosts sign in with Google. Guests never make an account: they type a name, and if they want, a phone number or email. We use that information to run the event, and we text only guests who entered a phone and opted in. We do not sell your information. We do not show ads today; if that changes, this policy changes first.

Who We Are

Whoyay is operated by {OPERATOR} ("we", "us", "our"). This policy covers the Whoyay website and web app at whoyay.com, including invite pages, the guest flow and the host tools.

Questions and privacy requests go to {PRIVACY_EMAIL}. General questions go to {HELLO_EMAIL}.

Two Kinds of People Use Whoyay

Hosts create events. A host signs in with Google and has an account.

Guests open an invite link. A guest does not sign in, does not make an account and does not get a verification code. When a guest joins, we create a private personal link for them. That link (and a cookie holding the same token on the guest's browser) is what identifies them. Anyone who has a guest's personal link can act as that guest for that event, so treat it like a key and do not post it publicly.

What We Collect

From Hosts

From Google sign in: your email address, your name and your profile picture. We ask Google only for the basic scopes openid, email and profile. We do not get your Google password, contacts, calendar, Gmail or Drive.
Events you create: title, description, cover choice, layout and color, the place name and address (and map coordinates for it), the date or the date range and days guests may vote on, the reveal day, the locked date, capacity, the "it's on if" minimum, the RSVP deadline, and your choices for who can see the guest list and the bring list.
Your people and groups: names, phone numbers, email addresses and pictures of people you add as contacts, the groups you put them in, and anyone you untick for a given event. You are giving us information about other people, so only add people you know and who would expect to hear from you about your event.
Messages you send through Whoyay: the text of any update or text blast you send to guests.
Co-hosts: if you add a co-host, we record which signed in host co-hosts which event.

From Guests

Your name, which is required to join.
Your phone number or email, if you choose to give one. A phone is stored in standard international format. Giving a phone does not by itself sign you up for texts; you must also tick the box to get texts.
Your text preference: whether you opted in to texts and whether you replied STOP.
Your responses: your RSVP (going, maybe, no, waitlist or awaiting host approval), when you responded, any plus one, the days you said you can and cannot make, the bring list items you add or claim, and comments you post on the event.
Photos you add to an event album.

If a host invited you from their own contacts, the host may have already entered your name and phone or email before you ever opened the link.

Collected Automatically

Cookies. We set a cookie on a guest's browser that holds their personal link token for that event, so they do not have to reopen the link each visit. It lasts up to one year. Hosts get a sign in session cookie. These cookies are needed for the app to work. We do not use advertising or analytics cookies today.
Server logs. Our hosting provider records standard request information such as IP address, browser type and the pages requested, to run and secure the service.
Text delivery records. For every text and email the app sends, we keep the message text, the type (date reveal, update, reminder or blast), the channel, and whether it was sent, delivered, failed or skipped.

What We Do Not Collect

No passwords. Hosts sign in with Google; guests have no password at all.
No access to your phone's contacts, messages or call history. The first invite is shared from the host's own phone by the host; Whoyay does not read anything on that phone.
No device location. The only location we hold is the event address a host types in.
No face recognition on photos.
No payment card details today.
We do not store the text of replies you send to our texting number, other than acting on the keywords described below.

How We Use Information

To run events: show the invite, collect RSVPs and date votes, find the best date, manage the waitlist and capacity, split the bring list (including spotting duplicate dishes), and show comments and the album.
To send the texts and emails described in this policy, and to honor STOP.
To keep Whoyay secure, prevent abuse and fix problems.
To answer you when you contact us.

We do not use your information to build advertising profiles.

Who Can See What Inside Whoyay

The host and co-hosts of an event can see every guest's name, phone or email (if given), RSVP, date votes, bring items, comments and photos for that event.
Other guests can see the guest list and the bring list only if the host has turned that on for the event. Both are on by default, and the host can turn either off.
Event visibility is set by the host. A "link" event can be opened by anyone with the event link. A "private" event requires the host to approve each person who asks to join. A "public" event can be opened by anyone and may be listed where the public can find it.
Albums can be set by the host so that only guests who RSVPed can see the photos, or so that the album is protected by a PIN. Anyone the host gives the PIN to can see a PIN protected album.

Texts From Whoyay (SMS)

Who gets texts. Whoyay texts only guests who entered a phone number and ticked the box to get texts about that event. The first invite is never sent by Whoyay: the host shares the invite link from their own phone. Hosts are not texted by Whoyay for sign in, and there are no verification codes.

What we text. Texts are about an event you joined: the date reveal when the host locks the date, updates and cancellations from the host, reminders, and short messages the host writes to the group (a text blast, up to 320 characters). Each text starts with "Whoyay:", usually includes a link to the event, and ends with "Reply STOP to opt out." We do not send marketing or promotional texts.

How often. Message frequency varies by event and depends on the host. Most events send a handful of texts in total.

Cost. Msg and data rates may apply.

STOP. Reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT) to any Whoyay text to stop all texts from Whoyay to that number. This applies to every event that number is on. You will get no further texts unless you reply START or UNSTOP. You can also turn texts off on the event page.

HELP. Reply HELP for help, or email {HELLO_EMAIL}.

Consent is optional. Agreeing to texts is not a condition of any purchase or of using Whoyay. You can RSVP, vote and claim items without opting in.

No sharing of your number for marketing. We do not sell, rent or share mobile phone numbers or text opt-in data with third parties for marketing. We do not sell, rent or share your mobile number or your text opt in with third parties or affiliates for their marketing or promotional purposes. Text opt in data and consent are not shared with any third party, except the texting provider that delivers the messages for us.

Carriers are not liable for delayed or undelivered messages.

Emails From Whoyay

If a guest gives an email address instead of a phone, the host may send event updates to it by email. These are messages about the event, not marketing. We do not send sign in, confirmation or password emails.

Who Else Receives Information (Service Providers)

We use these companies to run Whoyay. Each receives only what it needs to do its job for us.

Provider	What It Does	What It Receives
Vercel	Hosts the website and app	All requests to the site, including IP address and the data you submit
Neon	Our database (Postgres)	Everything listed in What We Collect, except photo files
Google	Sign in for hosts	Your sign in request; Google sends us your email, name and picture
Telnyx	Sends and receives texts	Guest phone numbers, text content, delivery status and replies such as STOP
Resend	Sends email	Guest email addresses and email content
Cloudflare	Domain, email forwarding and photo storage (R2)	Album photos, and email you send to our addresses
Geoapify or Google Places	Address search for hosts	The address text a host types while searching

We may also disclose information if the law requires it, to protect people's safety, to protect our rights, or as part of a merger or sale of the business, in which case this policy would continue to apply to your information.

We do not sell your personal information, and we do not share it for cross context behavioral advertising.

Ads and Affiliate Links (Not Yet Live)

Whoyay does not show ads or use affiliate links today. We plan to earn money later from things like labeled sponsored listings in a Discover section and affiliate links for bring list delivery, and we have decided not to put ads on invites, votes, RSVPs, texts or albums. Before any ad or affiliate feature ships, we will update this policy to say exactly what is shared, with whom, and what choices you have, and we will change the "Last updated" date.

How Long We Keep Information

We keep event information, including guest responses, comments, photos and message records, for as long as the event exists on Whoyay, so the host and guests can come back to it. When a host deletes an event, its guests, votes, bring items, comments, message records and photo records are deleted with it. Host accounts are kept until the host asks us to delete them. Server logs are kept by our hosting provider for a limited time. (Have counsel confirm a stated retention period.)

Your Choices and Rights

Texts: reply STOP at any time, or turn texts off on the event page.
Your RSVP and answers: change your RSVP, votes and bring items on the event page at any time.
Access, correction and deletion: email {PRIVACY_EMAIL} from the phone or email involved, or include your personal invite link, and tell us what you want. We will confirm the request is yours before acting. Hosts can also ask us to delete their account and events.
Host contacts: if a host added you as a contact and you want to be removed, email {PRIVACY_EMAIL} and we will remove you.

Depending on the state you live in, you may have additional rights under state privacy law. We will honor requests as the law requires and will not treat you differently for making one. (Have counsel confirm which state laws apply.)

Security

We use encrypted connections (HTTPS) for the site. Personal links use long random tokens. Text webhooks from our texting provider are signature checked. Access to the database and provider accounts is limited. No system is perfectly secure, so please keep your personal invite link private.

Children

Whoyay is not for children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has given us information, email {PRIVACY_EMAIL} and we will delete it. (Age limit pending owner and counsel decision; see OPEN-QUESTIONS.md.)

Where Whoyay Works

Whoyay is run from the United States and is intended for people in the United States. Information is stored and processed in the United States.

Changes to This Policy

If we change how we handle information, we will update this page and the "Last updated" date. If a change is significant, such as adding ads, we will give notice in the app before it takes effect.

Contact

{OPERATOR} {MAILING_ADDRESS} Privacy: {PRIVACY_EMAIL} General: {HELLO_EMAIL}