Privacy Policy
We know planning a child's birthday party is deeply personal. Here is our transparent commitment to safeguarding your family's data, guest RSVPs, medical allergy alerts, social logins, and browsing privacy.
Never Sold or Monetized
We never sell, rent, or trade your personal details, child names, or guest RSVP rosters to data brokers or third-party advertisers.
Allergies Kept Safe
Sensitive food allergy and anaphylaxis records submitted via RSVPs are used solely to protect kids at the party and shown only to authorized hosts.
Total Data Control
Delete your parties, guest entries, or entire host account at any time. We honor Facebook and Google account deletion requests promptly.
1. Overview & Aussie Privacy Framework
Welcome to PlanYourParty (accessible at PlanYourParty.com.au). PlanYourParty is an Australian web application designed to relieve parental stress by providing automated birthday party catering calculators, frictionless mobile RSVPs, allergy safety tracking, return gift planners, and day-of event schedules for Australian families.
We are committed to handling personal information with integrity and respect. This Privacy Policy sets out how we collect, use, store, and disclose personal and sensitive information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Where visitors access our platform from outside Australia (such as the European Union or California), we additionally observe recognized data protection standards including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).
2. Information We Collect
Depending on how you interact with PlanYourParty (as an account host, an invited co-host, a guest RSVPing to a party invitation, or a general website visitor), we may collect the following categories of information:
A. Host Account Information
When you create an account to organize parties, we collect your name, email address, profile picture, and authentication tokens provided through our secure identity partner (Clerk) or via Social Login (Google and Facebook).
B. Party & Celebration Details
When a host creates an event, we collect party attributes including the birthday child's name, age turning (0–18), party theme (e.g., Superhero, Dinosaur, Space), date, event start and finish times, venue location/address, emergency phone number, customized party timeline / run sheet tasks, gifting etiquette preferences (e.g. Fiver Party savings goals, Book Swap instructions, strictly no gifts, or wish list passion categories and target budget brackets), optional third-party venue waiver links (waiver_url) with custom host instructions (waiver_notes), optional invitation card styling choices (invitation_template), and optional host contact display details (host_contact_name, host_contact_phone, host_contact_email, and host_contact_public).
Third-Party Venue Waiver Links & External Portals
When a host attaches a third-party venue liability waiver link (e.g. for commercial activity centres like BOUNCE, Flip Out, or indoor play centres), PlanYourParty acts strictly as a logistical conduit to present this link and the host's instructions to invited parents. PlanYourParty does not collect, receive, process, or store signed waiver forms, parental releases, identification, or medical disclosures submitted on third-party venue websites. All interactions on external waiver portals are governed exclusively by the third-party venue's own privacy policy and terms.
Visual Invitation Cards & Host Contact Privacy
PlanYourParty provides a zero-setup Visual Invitation Card Studio that generates theme-matched digital invitation cards and printable home sheets.
- Private-by-Default Host Contact: When hosts choose to configure contact details for their party (
host_contact_name,host_contact_phone,host_contact_email), this information is private by default and strictly redacted from public APIs. It is displayed on cards and the RSVP page only when the host explicitly opts in via thehost_contact_publictoggle. - Web Crawler & Scraper Protection: Host contact details are strictly excluded from public Open Graph social preview metadata tags (
og:image), ensuring personal phone numbers and emails are never indexed by search engines or social media link scrapers. - Zero Cloud Storage Footprint: Visual invitation cards (including 1080×1920 portrait images and high-DPI A4/Letter print sheets) are rendered 100% client-side in the user's browser using HTML5 Canvas. Card images are never uploaded to, transmitted to, or stored on PlanYourParty cloud servers or third-party object storage.
- Personal Guest QR Tokens: When generating personalized invitation cards for individual guest families, the embedded QR code encodes their secure magic edit token (
?token=...) to enable frictionless 1-tap RSVPs. Hosts are warned within the sharing interface to transmit personalized cards directly to the invited family rather than in public group chats.
C. Guest & Attendee RSVP Information
On the day of the party, hosts may record whether each guest arrived (Attended or Absent), the time they were checked in, and whether they were a walk-in. This attendance information is visible only to the party's hosts, is never shown on the public RSVP page, and is deleted with the party.
When an invited family responds via a party's unique mobile RSVP link (/rsvp/[slug]), we collect the child guest's name, optional child age (0–25), attending parent/guardian or partner name, mobile phone number, attendance status (Attending, Pending, Declined), household named siblings and their respective dietary profiles, accompanying staying adult headcounts (up to 10 adults), and private magic edit tokens allowing parents to update their responses securely without logging in.
Optional App & Feature Updates Opt-In: During RSVP submission, invited guests can optionally tick an unchecked-by-default checkbox to receive periodic announcements regarding new PlanYourParty features and application status updates. This preference is recorded against the guest record and can be unsubscribed from at any time with a single click.
D. Sensitive Health Information (Food Allergies & Anaphylaxis)
Guests and hosts may provide dietary requirements, serious food allergies (e.g., nuts, eggs, dairy, shellfish, celiac/gluten), and medical or anaphylaxis safety notes. Under Australian privacy law, health information is classified as Sensitive Information. We collect this only with express consent solely for child safety during the event (see Section 6).
E. Technical, Log & Device Data
We collect device IP addresses, browser types and versions, operating system details, referring/exit URLs, date/time stamps, and on-site click paths via automated logging and Google Analytics.
F. Party Planning Guides & Newsletter Subscribers
When you voluntarily subscribe to our party planning guides, checklists, or download "The 4-Week Countdown & 'Zero-Tears' Modern Celebration Blueprint" via our blog or website forms, we collect your email address, optional first name, and subscription timestamp. This information is processed in accordance with the Spam Act 2003 (Cth) and you may opt out at any time with a single click.
4. Facebook Data Deletion Instructions
In compliance with Meta Platform Policies, PlanYourParty provides a transparent, guaranteed mechanism for users to delete their account data and revoke access granted via Facebook Login.
How to Remove PlanYourParty from Facebook & Request Complete Data Deletion:
- Log in to your Facebook account and navigate to Settings & Privacy > Settings.
- In the left navigation menu, click on Apps and Websites.
- Find PlanYourParty in your active apps list and click Remove.
- To delete all historical party, guest, and account records held on our servers, send an email to our official privacy channel: hi@planyourparty.com.au (or support@planyourparty.com.au) with the subject line "Facebook Data Deletion Request".
- Please provide the email address associated with your Facebook login. Our team will permanently erase your account profile, party databases, and guest records within 30 days and send you an email confirmation.
5. Google Analytics & Traffic Tracking
We have connected Google tools, including Google Analytics and Google Search Console, to measure website traffic, monitor application health, and understand how parents use our planning tools.
What Google Analytics Collects
Google Analytics uses cookies (such as _ga and _ga_*) placed on your device to transmit anonymous usage metrics to Google servers. These metrics include pages visited, time spent on pages, browser and device specifications, general geographic region (city/state level), and user interactions (such as opening the catering calculator or favors catalog).
No Sensitive RSVP or Medical Data Sent to Google Analytics
We strictly do not pass personal identification details (such as names, phone numbers, child birthdays, or food allergy notes) to Google Analytics event tags. Analytics data is aggregated and statistical in nature.
Your Right to Opt Out of Google Analytics
You can manage, restrict, or disable cookies in your browser settings at any time. Furthermore, you can prevent your data from being used by Google Analytics across the web by installing the official Google Analytics Opt-out Browser Add-on.
6. Children's Allergy & Safety Data (Sensitive Information)
In Australia, severe childhood allergies and anaphylaxis (such as peanut, tree nut, dairy, or egg allergies) require meticulous planning. PlanYourParty treats dietary and medical information as Sensitive Information under Australian Privacy Principle 3.
How We Handle Allergy Records:
- Purpose Limitation: Allergy data is collected solely to assist the host in providing safe catering and preparing emergency precautions during the party.
- Strict Access Control: Allergy alerts are displayed only to the authenticated party host(s) on their private dashboard and on the high-contrast Printable Fridge Run Sheet designed for party supervision.
- No Third-Party Commercialization: Allergy and health information is never sold, shared with pharmaceutical or food companies, or utilized for commercial behavioral advertising.
- Search Engine Exclusion: Private guest lists and RSVP submission portals are explicitly disallowed from public search engine indexation in our
robots.txtfile.
7. How We Use Your Information
We use the personal information we collect for the following core operational purposes:
Enabling hosts to create parties, select themes, organize schedules, and print kitchen fridge summary sheets.
Allowing invited guests to submit attendance responses, sibling headcounts, and emergency contact numbers.
Calculating accurate portions for kid snack packs, adult grazing platters, and birthday cake slices.
Allowing partners or co-parents to securely co-manage party timelines and guest lists via authenticated invites.
Delivering requested party checklists, milestone reminder sequences, and planning tips via email (in strict compliance with the Australian Spam Act 2003, featuring instant 1-click unsubscribe links).
Communicating host gifting etiquette preferences (e.g. Fiver Party savings goals, Book Swap instructions, clutter-free celebrations, or parent-approved interest ideas) to invited families to eliminate social friction.
Sending periodic product improvement notices, new party planning feature releases, and service status updates to guests and hosts who voluntarily opt in to communications (with 1-click unsubscribe).
Delivering critical transactional update notifications and proximity reminders to confirmed attending guests when celebration venue address, party dates, times, or venue waiver requirements are modified or dispatched by the host.
8. Amazon Australia Affiliate Disclosure & Operating Agreement Compliance
PlanYourParty is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.au.
When you click on recommended goodie bag fillers, keepsake return gifts, or curated birthday present ideas on our Favors directory (/favors) or our public Gift Recommendations guide (/gifts), you are directed to Amazon Australia via compliant links containing our official store tag (geekstradam0f-22).
Zero Direct Affiliate Links in Emails: In strict compliance with the Amazon Associates Program Operating Agreement, transactional emails (such as RSVP confirmations, schedule change alerts, and countdown reminders) sent to parents and hosts never contain direct Amazon affiliate links. All email recommendations guide parents exclusively to our compliant, publicly disclosed on-site web portals.
Amazon may use tracking cookies on your browser to verify qualifying purchases. Amazon's collection and use of your data is governed by the Amazon.com.au Privacy Notice.
9. Third-Party Subprocessors
To provide a fast, secure, and resilient cloud service, we work with industry-leading technology providers. All subprocessors are vetted for security and data privacy standards:
| Provider | Purpose | Data Handled | Location / Standards |
|---|---|---|---|
| Clerk Inc. | User Authentication & Sessions | Host email, name, encrypted tokens, OAuth credentials | SOC 2 Type II, Global Edge |
| Google LLC | Google Sign-In & Traffic Analytics | Google profile data, web traffic telemetry, cookies | ISO 27001, Privacy Shield / DPA |
| Meta Platforms, Inc. | Facebook Login SSO | Facebook user ID, name, email, profile photo | Meta Platform Terms & DPA |
| Supabase Inc. | Cloud Database (PostgreSQL) | Encrypted party records, guest lists, allergies (Row-Level Security) | SOC 2 Type II, Encrypted at Rest, Primary Australian Data Residency (AWS Sydney ap-southeast-2) |
| Amazon Web Services, Inc. (AWS SES) | Transactional Email Delivery & App Status Notifications | Recipient email address, name, transactional event details, delivery telemetry | ISO 27001, SOC 1/2/3, Primary Dispatch Infrastructure in Australia (AWS Sydney ap-southeast-2) |
| Cloudflare, Inc. | Serverless Edge Compute, DNS, CDN & Security Perimeter | Encrypted network transit, serverless API execution, edge caching, DDoS mitigation | SOC 2 Type II, ISO 27001, Global Edge Network |
| ConvertKit LLC (Kit) | Email Marketing Automation, App Feature Updates & Guide Delivery | Subscriber email address, first name, opt-in timestamp, engagement telemetry | SOC 2 Type II, US / Global Edge (Spam Act 2003 & CAN-SPAM Compliant, 1-Click Unsubscribe) |
| Sanity AS (Sanity.io) | Headless Content Management & Image CDN | Editorial party guide articles, media assets, author profiles | SOC 2 Type II, ISO 27001, Global Edge CDN (cdn.sanity.io) |
10. Security & Data Retention
We apply technical and organizational safeguards designed to protect personal and sensitive information against loss, unauthorized access, destruction, or misuse:
- Australian Data Residency: Production party records, guest rosters, and medical allergy alerts are hosted and processed directly within Australia (AWS Sydney Region
ap-southeast-2and Supabase Sydney PostgreSQL infrastructure) to uphold data sovereignty and compliance under the Australian Privacy Principles. - Encryption in Transit: All communications between your browser and PlanYourParty servers are encrypted with HTTPS / TLS 1.3.
- Database Row-Level Security (RLS): Our database isolates party records so that only the authenticated creator and explicitly invited co-hosts have permission to query or modify party data.
- Cryptographic Slugs & Shared Magic Edit Tokens: Public RSVP links utilize non-guessable, cryptographically generated slugs. Furthermore, household family submissions share a cryptographically random edit token (
edit_token) allowing parents to view and update their children's RSVPs securely without account passwords or risking unauthorized access to other party guests. - Client-Side QR Code & Invitation Card Processing: Vector QR codes and theme-styled digital invitation cards (both 1080×1920 mobile cards and high-DPI A4/Letter print sheets) are rendered into binary PNG blobs locally on your device via the HTML5 Canvas and Clipboard APIs (
ClipboardItem). Generated invitation cards and QR code images are synthesized entirely in browser memory and are never uploaded to, logged on, or retained by third-party tracking servers or cloud storage. - Data Retention: We keep party details for as long as your account remains active so you can review past celebrations. You may delete any party, guest, or your entire host profile at any time directly through the dashboard.
11. Your Rights & Access Requests
Under the Australian Privacy Principles (and international privacy frameworks), you have the right to:
12. Privacy Contact & Complaints
If you have questions about this Privacy Policy, wish to exercise your access or deletion rights, or wish to make a complaint regarding how your personal information has been handled, please contact our designated Privacy Officer:
PlanYourParty Privacy Team
PlanYourParty.com.au • Australia
Official Privacy Inquiries & Deletion Channel: hi@planyourparty.com.au
Alternate mailbox: support@planyourparty.com.au
Response Timeframe: We aim to acknowledge and respond to all privacy and data deletion inquiries within 3 business days.
Australian Privacy Regulator: If you are not satisfied with our response to a privacy complaint, you have the right to contact the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
3. Social Login via Google and Facebook (Meta)
To make account creation effortless for busy parents, PlanYourParty permits users to register and sign in using third-party Single Sign-On (SSO) credentials through Google and Facebook (powered by Clerk authentication).
Google Sign-In
When logging in with Google, we access your Google public profile information (name, primary email address, profile picture avatar, and Google user ID).
Facebook (Meta) Login
When logging in with Facebook, we request permission to access your basic public profile information (name, verified primary email address, profile picture, and Facebook user identifier).