Privacy policy

1. About this policy

Invited is the invitation-only dinner and introduction service available at invited.host. This policy applies to our website, member accounts, host tools, and Google integrations. Invited can be contacted at tyler@inceptiv.co.

2. Information we collect

• Account and profile information: sign-in email, account identifier, name, and any profile photo, biography, location, interests, or contact details you choose to provide.
• Dinner and relationship records: invitations, series membership, RSVPs, host-verified attendance, introduction requests and consent, and the photos, captions, or private passport notes you save.
• Host and contact information: contact names, email addresses, phone numbers, and any notes or other details a host or member provides. Dietary information is optional and is used to help hosts plan the relevant dinner.
• Operational information: authentication cookies and session records, security and delivery events, and technical information such as request times, browser information, and IP addresses processed by our hosting and authentication providers.

You should provide information about other people only when you have permission or another appropriate basis to do so. Do not place sensitive personal information in introduction or nomination notes unnecessarily.

3. Google account data and permissions

Optional Google sign-in

If you choose Google sign-in, we receive the Google account identity information needed to authenticate you, including your account identifier, verified email address, name, and available profile photo. We use that information to sign you into your existing invitation-backed account. A Google account alone does not grant access to Invited. Google sign-in requests basic identity permissions and does not request contact-book permission.

Optional Google Contacts import

When a host chooses to connect Google Contacts, we request the read-only contacts.readonly permission through Google. The picker reads names, email addresses, and phone numbers from that Google contact book into the host’s browser so the host can search and choose people. We do not request permission to edit or delete Google contacts, or access Gmail messages, Google Drive files, or calendar events.

Only contacts the host explicitly selects and imports are sent to the Invited server and saved in that series’ host contact book. Those imported names, emails, and phone numbers become visible to the other hosts of the selected series. Unselected contact entries and the contact-picker access token remain in browser memory and are cleared when the picker is closed or the page is left. We do not store a contact-picker refresh token or run background contact synchronization.

Imported contacts are used to curate a series and prepare invitations. Importing does not create a member account, send an invitation, or grant access. A separate host action is required to invite someone. Disconnecting Google stops the contact connection; it does not delete contact records already imported.

Google Limited Use commitments

Invited’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only for the disclosed, user-facing sign-in and contact-import features. We do not sell it, use it for advertising or credit decisions, or use it to train generalized AI or machine-learning models. Human access is limited to your authorized sharing, support you request and authorize, security or abuse investigations, and applicable legal requirements.

4. How we use information

We use information to authenticate invited people, maintain account and series access, manage invitations and RSVPs, support dinner planning, preserve private dinner history, and facilitate introductions with the required recipient consent. We also use relevant records to deliver transactional emails, respond to support requests, diagnose failures, and protect the service from abuse. We do not use imported Google contact data for unrelated marketing.

5. Sharing and service providers

Within Invited: hosts can manage their series’ guests, invitations, tables, and shared contact book. Members see information permitted by their invitations, verified shared attendance, explicit profile-sharing choices, and introduction consent. Specific introduction requests are visible only to their author and selected recipients; series requests are visible within their selected series. A limited preview is different from a full member profile. Your private passport notes remain owner-only. Member contact details shared through an introduction require the relevant consent and introduction conditions.

Service providers: Supabase provides authentication and data/file storage; Netlify hosts the website and server functions; Resend processes transactional emails. Google handles Google identity authorization and Google Contacts API requests. These providers process the information needed to perform their respective services, which may involve processing in countries where they operate. Selected contact data is sent to our hosting and storage providers when you import; it is sent to the email provider if a host later sends an invitation. The unselected address book is not uploaded to our hosting or storage providers.

We may disclose information when necessary to comply with applicable law, address fraud or abuse, or protect people and the service. Google data transfers remain subject to the Limited Use commitments above. We do not sell or rent personal contact lists.

6. Storage, cookies, and protection

We use HTTPS for the live service, authenticated sessions, series-scoped permissions, database row-level access controls, and private file storage with time-limited access URLs. Google OAuth client secrets are configured in the authentication service and are not included in the public website. Contact-picker tokens are short-lived and kept in browser memory.

Cookies and browser storage needed for authentication maintain your session and support secure sign-in. Google may use its own cookies when you choose a Google integration. Hosts and members should protect their accounts and share only information appropriate for their series.

7. Retention, revocation, and deletion

Account, contact, and dinner records are retained for as long as needed to operate the account and series, maintain the requested private dinner history, respond to support or security issues, and meet applicable legal obligations. Imported contacts remain saved until deleted through an authorized request or removal of the associated series. Removing someone from a series can preserve historical dinner records; it does not publish those records.

To request access to, correction of, or deletion of account information or imported Google contact records, email tyler@inceptiv.co with the email address and series involved. We may verify your identity and authority over the records before processing the request. Some records may need to be retained for legitimate security or legal purposes, or because they also belong to other participants’ dinner history.

Use Disconnect in the contact picker or your Google account connections to revoke Google access. Revocation prevents future authorized Google access but does not automatically delete records you previously chose to import. Request deletion separately if you also want those saved copies removed.

8. Your choices, changes, and questions

You can use email sign-in instead of Google, decline Google Contacts access, select only specific contacts, and manage your profile and sharing preferences in the app. Questions and privacy requests can be sent to tyler@inceptiv.co.

We will update this page when our practices change and show the revision date above. If a change materially expands how Google user data is accessed or used, we will provide the relevant notice and obtain any additional consent before that new use.