Privacy policy

Potluck (potluck.group) is operated from California, United States. For guest data that a host collects on their event page, the host is the one deciding what to ask for and we process it on their behalf; for host accounts and billing, we are the business responsible for the data.

Your email and name, the events you create, and — if you upgrade — a billing record from Stripe showing what you paid and when. We never receive your card number.

Only what the host asked for on their form: name, email, phone if required, dietary notes, +1s, dish sign-ups, and answers to the host's own custom questions. Guests don't need an account, and we don't build a profile of them across events.

The host and any co-hosts, always. Other guests see the list only if the host turns that on, and even then contact details are never shown — just names. When a host hides the list, our servers leave those details out of the page entirely rather than hiding them in the browser.

We use a cookie to keep you signed in, and we count page views per event so hosts can see how their invite is travelling. That counter stores a rough visitor key and referrer, not a name.

We also use Google Analytics to understand how visitors move through our own site — for example, which pages are visited, which buttons are clicked, and whether someone signs up or upgrades. Google may set cookies or store identifiers on your device. You can opt out of Google Analytics via Google's browser add-on or your browser's cookie settings.

Analytics and advertising cookies are off until you turn them on in our cookie banner, and you can change your mind at any time:

We may run paid ads on platforms like Google Ads, Reddit, Facebook, and X. To measure whether those ads lead to sign-ups or upgrades, those platforms may place their own tracking scripts or pixels on our site. These scripts can record when you visit, sign up, or purchase — and may use cookies or device identifiers to attribute that action back to an ad. We only receive aggregated or attributed conversion data; we do not receive the underlying guest lists or event details from your Potluck page.

Only the services that make the site run or help us market it responsibly: our hosting and database provider, Stripe for payments, our email sender, and the analytics or advertising platforms described above. They process data on our instructions. We do not sell or rent personal data, and we never sell your guests' data or any event data, ever.

Guest contact information — email addresses, phone numbers, dietary notes, RSVP messages, answers to custom questions and any imported invite lists — is deleted automatically once an event is over:

• Free accounts: 90 days after the event ends.
• Premium accounts: 12 months after the event ends.

What stays afterwards is the non-contact record of the party: guest names, RSVP status, party size and headcount, what each person brought, and chip-in totals. Hosts see this schedule on their dashboard and can export or print a list before it runs. Everything else stays until the host deletes the event or their account; deleted events are purged within 30 days. Billing records are kept longer where tax law requires it.

Hosts can export or delete a guest list at any time from the dashboard, and delete their account from the account page. Guests who want their RSVP removed can ask the host, or contact us and we'll take care of it. Where the GDPR or CCPA applies, that includes the right to access, correct, export or erase your data.

Potluck isn't for children under 13, and we don't knowingly collect their information. If a child's details have ended up on a page, tell us and we'll remove them.

If you live in California, you have the right to know what personal information we collect and why, to request a copy of it, to correct it, to delete it, and to limit the use of sensitive personal information. We don't use or disclose sensitive personal information beyond what's needed to run the service.

In the last 12 months we collected identifiers (name, email, phone), commercial information (subscription and payment records held by Stripe), and internet activity (page views, analytics events). We collect it to run event pages, process payments, provide support, measure our own marketing, and keep the service secure. Sources are you, your guests, and our analytics and payment providers.

We do not sell your personal information, and we do not sell or share the personal information of your guests. Advertising platforms may set cookies on our marketing pages to measure conversions; under California law that kind of cross-context behavioral advertising can count as "sharing," so you can opt out at any time using your browser's Global Privacy Control signal, which we honor, or by contacting us. We never place ad or analytics scripts driven by an advertiser on a private event page.

We will never discriminate against you for exercising these rights. To make a request, or to have an authorized agent make one for you, contact us. We'll verify it against the email on the account or RSVP and respond within 45 days.

The categories above are collected at the moment you create an account, submit an RSVP, or browse the site, and are retained for the periods described in "How long we keep it." We collect no more than we need for those purposes and won't use it for anything materially different without telling you first.