Privacy Policy

An event organizer creates an event and invites their guests. The organizer decides what information to collect from their guests and is responsible for the accuracy and legality of the guest list they provide. I process that information to run the RSVP on the organizer’s behalf: sending invitations, hosting the invite pages, and recording responses.

This copy of Attend is run separately from any other copy of Attend, and the information entered here is held in this service’s own systems, not in any other copy.

If you’re a guest with questions about how your information is being used, your first point of contact is the person who invited you. You can also reach me directly at hello@rsvp.abdxl.com.

Organizer account. When you sign in as an organizer, I collect the email address you provide. Attend uses passwordless, magic-link sign-in: you get a one-time link by email rather than a stored password.

Event and guest information organizers provide. Organizers enter information about their event (name, type, dates, venue, description, and optionally a cover image they upload) and about their guests, organized into parties: a party name, seat count, an optional email address, the names of individual guests in the party, and any notes the organizer adds. Organizers can enter guests one at a time or import them from a spreadsheet (CSV) file. Organizers may also define custom RSVP questions, which can include a dietary-restrictions question or other information they choose to ask, and may tag individual guests with a category they define themselves (for example, to plan seating or catering).

Information guests provide. When a guest responds to an invitation, Attend records their RSVP (accepted or declined) and headcount, any per-category headcounts the organizer asks for, their answers to the organizer’s custom questions, and, if they choose to provide one, a contact email address for their confirmation. If a guest unsubscribes from an event’s announcements and automatic reminders, Attend records that choice against their party.

Organizers can define their own guest categories, such as separate counts for men and women where an event has separate seating. Because organizers write these categories themselves, a category can reveal or suggest sensitive information about a guest, such as their gender or, in context, their religious or cultural practices. I use category information only to show the organizer their own counts, seating and catering totals, and budget figures for that event, and to pre-fill a party’s per-category headcounts on its own RSVP form, which anyone with that party’s invite link can see. I do not use it for any other purpose, combine it across events or organizers, or share it with anyone other than the service providers listed below. Organizers should create only the categories they need to plan their event, and guests who have concerns about how they have been categorized should contact the person who invited them, or me at hello@rsvp.abdxl.com.

Attend uses three cookies, all functional:

• a session cookie that keeps a signed-in organizer signed in (HttpOnly, so page scripts can’t read it);
• a preference cookie that remembers a light/dark/auto theme choice;
• a per-event cookie that remembers whether an organizer has dismissed their setup checklist.

None of these track you across other sites or build an advertising profile, and none come from a third-party analytics or advertising service. Attend does not run analytics, tracking, or advertising scripts of any kind.

Attend sends email only to operate the service: magic-link sign-in, invitations, reminders and announcements an organizer sends to their own guest list, RSVP confirmations to guests, and, if an organizer turns them on for an event, automatic reminders sent to parties that have not yet finished responding, ahead of the organizer’s RSVP deadline. Each party receives at most one automatic reminder per event. Email is delivered through Resend, my email provider, and each send attempt is logged (recipient, type, and delivery outcome) so organizers can see what was sent.

Every announcement and automatic reminder includes an unsubscribe link. Unsubscribing stops further announcements and automatic reminders about that event for your party; it takes effect immediately, and the organizer can see that you have unsubscribed but cannot reverse it. You will still receive messages directly tied to your invitation, such as the invitation itself, a reminder the organizer sends you individually, and confirmation of your own RSVP.

I do not send marketing email and do not use your email address for any purpose other than delivering the messages described here.

I share information with the following service providers, each of which processes it only to help me run this service:

• Supabase: database and file storage, including cover images
• Cloudflare: application hosting, content delivery, and forwarding email sent to hello@rsvp.abdxl.com
• Resend: email delivery

A software developer who helps me set up and maintain this service may access its systems at my request, only to do that work and under my instructions.

I do not sell personal information, and I do not share it with advertisers or data brokers.

Event and guest information, organizer accounts, and cover images are stored in Canada, in Supabase’s Canada Central region. Supabase may also process some of this information outside Canada where needed to provide its service.

Some processing happens outside Canada:

• Cloudflare runs this service on its global network, so a visit to this site can be handled at a Cloudflare data centre in another country.
• Resend sends email from the United States. To deliver a message, it processes the recipient’s email address and the content of the message, and keeps copies of sent email for up to 30 days.

Outside Canada, information may therefore be processed in the United States and in other countries where Cloudflare or Supabase operate. These providers use it only to host the service and deliver email for me. Information held or processed outside Canada is subject to the laws of the country where it is held, and may be accessed by that country’s courts, law enforcement, or national security authorities.

You can ask me questions about service providers outside Canada, or ask for written information about how I use them, at hello@rsvp.abdxl.com.

Each guest party receives a unique invite code and link. Anyone who has that code or link can view the invite page and submit an RSVP for that party. This is how Attend works, in the same way a printed invitation or a shared link works. Organizers and guests should treat invite links and codes with the same care as a physical invitation.

Event and guest information is kept for as long as the organizer’s event exists. Organizers can delete individual guest parties or an entire event at any time from their dashboard, which permanently removes that event’s data, including its guest list and guest names, categories, RSVPs, answers, unsubscribe choices, email log, and cover image. Stored cover image files are normally removed at the same time; if that removal fails, the file is removed within 30 days. Resend keeps copies of sent email for up to 30 days. Attend does not currently offer self-serve deletion of an organizer’s account itself; to close an account or request deletion of any data, contact hello@rsvp.abdxl.com and I will act on the request.

This service relies on infrastructure-level protections: connections are encrypted in transit (TLS), and data at rest is encrypted by the database provider, Supabase. Access to an event’s data is restricted to its owning organizer, enforced both in the application and at the database layer. No system is perfectly secure, and I don’t claim otherwise.

Under Alberta’s Personal Information Protection Act and, where it applies, Canada’s federal privacy law (PIPEDA), you can ask for access to your personal information and ask for it to be corrected, subject to certain exceptions. You can also ask me to delete it. To make a request, contact hello@rsvp.abdxl.com. I will respond within 45 days. If your information was provided by an event organizer, I may also refer your request to them, since they decide what was collected and why. If you are not satisfied with my response, you can contact the Office of the Information and Privacy Commissioner of Alberta.

I may update this policy as this service changes. If I make a change, I will update the “Last updated” date above. I will not use information already collected for a new purpose without consent.

Questions about this policy or your information: Abdul Rahman, hello@rsvp.abdxl.com.