Privacy

Last updated 30 October 2026

Hither is paid for by the people who upgrade, not by advertisers. We don’t sell personal data, we don’t show ads, and we don’t let suppliers target hosts or guests. This page explains what we hold, why, who helps us run the service, and your rights.

Who is responsible

For your account and billing, Hither App is the controller. For guest lists and replies, the host who created the event is the controller and we process that data for them, only to run their site, RSVPs and messages. Guests with questions about their details should contact the host first; we’ll help either of you.

What we hold

• Hosts: name, email, a hashed password (never the password itself), the events you create, and payment records (Stripe holds your card details, we never see them).
• Guests: what the host adds (names, email, phone, postal address, tags) and what guests tell us when they reply: attendance, meal choices, dietary needs, arrival details, song requests, messages and any photos they upload.
• Technical: the minimum to keep the service working and safe, such as IP addresses in server logs and short-lived rate-limit counters that stop people guessing invitation codes.
• Email: a copy of each email we send for hosts, with whether it was delivered. If an address bounces or reports an email as spam, or a guest unsubscribes from an event, we keep the address on a short list so we don’t email it again. Every guest email has an unsubscribe link.
• Visit counts: totals of how often our pages and each guest site are opened. See below.

How we count visits

We count visits ourselves, without cookies and without any third-party analytics. When a page opens, your browser tells us which page it was, the site that linked to it and any campaign tags in the address. From that we keep totals only:

• views per page per hour, the referring website (its domain, never the full address), campaign tags, and whether the device is a phone, tablet or computer;
• an approximate place (country, region and city) worked out by our host, Vercel, from the network address. We never store the address itself;
• unique visitors per day, counted with a one-way code made from the network address and browser type mixed with a secret that changes daily. It can’t be turned back into either, it can’t link one day to the next, and the codes are deleted once the day’s totals are written;
• for about a minute while a page is open, which page it is and its approximate place, so we can see how many people are on the site right now.

On guest sites, personal invitation links are counted as a single “guest pages” total, never per guest. Hosts can see how often their own site was opened, nothing more. We don’t count you at all if your browser sends Global Privacy Control or Do Not Track, or while you’re signed in. Totals are deleted after 400 days. We use them, under legitimate interests, to understand which pages help people and to fix broken links.

Why, and our lawful basis

• To provide the service you asked for (contract): sites, RSVPs, messages, seating, photos.
• To keep it secure and prevent abuse (legitimate interests): sign-in protection, rate limits, fraud checks on payments.
• To meet legal duties (legal obligation): keeping payment records for tax.

Dietary needs can reveal health or religious information. Guests choose whether to share them, and they’re only used to plan food at that event.

Who helps us run it

• Vercel (hosting) and Turso (database), where the service runs. Vercel also tells us the approximate place a visit comes from.
• Resend, to deliver email. It tells us whether each email was delivered, bounced or marked as spam, and we keep that with the email.
• Stripe, to take payments.
• Cloudflare R2, to store uploaded photos.
• Upstash, for rate-limit counters (IP-based, kept for minutes).
• Google Fonts, which serves the typefaces on guest sites and emails (your browser connects to Google to load them).
• OpenStreetMap and Open-Meteo, for maps, place search and typical weather. We send place names, not personal data.

Some of these providers are outside the UK and EU. Where they are, transfers are covered by the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

How long we keep it

Events stay until the host deletes them, so sites can be kept as a keepsake. Deleting an event removes its guests, replies, messages and photos. Deleting your account removes the events you own. Payment records are kept for six years for tax. Server logs are kept for up to 30 days. Visit totals are kept for 400 days, and the daily visitor codes for a day at most.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and move it elsewhere. Hosts can export guest lists at any time from the workspace. Email us and we’ll reply within a month. If you’re unhappy with our answer you can complain to the Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

Cookies

We only use cookies the service needs to work, such as keeping you signed in. No analytics or advertising cookies: visit counting works without them. The full list is on the cookies page.

Questions? Email hello@hitherapp.com.