Privacy Policy

Tov.events collects the following data:

• Organizer account: name, email, password (hashed, never readable), profile photo if you sign in with Google, language, time zone and username (shown in the address of your invitations).
• Sign-in sessions: IP address and browser of each open session, shown in your settings so that you can revoke them.
• Passkeys: if you add one, the public key created by your device, its identifier, its type and the device name (for example “iPhone”). Your face, fingerprint and phone code stay on the device: Tov never receives them. A passkey is erased when you remove it, when you reset your password and with your account.
• Events: title, date, place, description, ceremonies, uploaded photos and, if you fill them in, your family memory (relatives, yahrzeit dates).
• Guests: name, Hebrew name, phone, email, notes and language, entered by the organizer (by hand, as a pasted list, from a file or from their contacts).
• Guest replies: attendance, number of people, children, companions (their names and the children’s names, if the guest gives them), message and answers to custom questions. If the form asks for them, the guest can also indicate a kosher diet and food allergies: these are sensitive data (religious beliefs, health), entered voluntarily by the guest to plan the meal. They are visible to the organizer and to their editors (including in the replies export and the caterer page); a viewer only sees the numbers (how many glatt, how many allergies), unless the organizer opens the details to them. When a reply is changed, the previous one is kept in an archive. Tov does not record guests’ IP addresses with their reply.
• Imported Google contacts: if you import your Google contacts, they are copied to a temporary area, erased as soon as you see them to make your choice; only the contacts you choose become guests. Tov keeps no Google access token. Details in section 9.
• Address book: every household invited to one of your celebrations enters your address book (“My contacts”), visible only to you: household name, Hebrew name, the people in the household (first name, last name, phone, email), groups you create and a private note (we advise you not to write any health information there). Contacts read from your phone or a contacts file (.vcf) are read in your browser: only the ones you tick are sent to Tov. Guests a co-organizer adds to your celebration enter your address book, that of the celebration’s owner. The names you write in “Who is coming” in the seating plan, including those a guest gave in their reply and that you save, are added to the people in the household.
• Seating plan: to seat your guests, you can put labels (“Rabbanim”, “Youth”…) on people and on tables, make groups within a family and, if the room is separated (mehitsa), set each person’s men’s or women’s side. Tov suggests this side from a clear first name or a written title (“Rav”, “Mrs”), without artificial intelligence; a suggestion is only saved if you confirm it, and a name used by both is left to check. This information is visible only to the organiser and their editors, never to a viewer or to guests, and is deleted with the celebration. A guest only sees their table number.
• Gifts: if the organiser adds them, their ways to receive a gift (Bit or Wero number, Bit QR code link — read from a screenshot that never leaves the organiser’s device —, PayBox, PayPal, Revolut, money-pot or registry link, IBAN and account holder name), shown to their guests; every addition or change is kept (before and after) for the security e-mail and the “It wasn’t me” button. When a guest taps one of these options in their invitation, Tov records it on the organiser’s Gifts page with the option chosen, the date, the message of their reply and, if they write one, an amount. That gift is visible only to the organiser and their editors, never to a viewer, and is never published. Tov never receives, passes on or sees the money: payment happens in the guest’s own app (Bit, PayBox, their bank…). The order in which the invitation shows these options follows the guest’s country: that of their phone number if the organiser noted it, otherwise the connection country given by Cloudflare; this country is never stored.
• Vendors: if the organizer records them, each vendor’s name (venue, caterer…), their phone number if given, the price, each payment (amount, date, which side of the family paid) and, if one is taken, a photo of the receipt (cleaned in the browser before upload, like other photos). This data is visible to the organizer and their editors; a viewer sees the expenses only if the organizer ticks “See the expenses” for them, and never a vendor’s phone number or a receipt. It is erased with the event; deleting a payment or a vendor removes its receipt photo. If a wedding organizer shares the expenses with the other family, it is through a link they can stop at any time: the page shows the expenses and which side paid them, never gifts, guests or a vendor’s phone number; the reply written from that link (“Agreed”, “An expense is missing” and its note) is kept with the event, without a name or number, and is never measured.
• Invitation opens: Tov records internally when an invitation is opened (so the organizer knows who has read it), without cookies and without consent, using a pseudonymous identifier; this data is sent to no third party. The organizer, and co-organizers who see the reply details (editors, or viewers the organizer has allowed), see which household opened its personal link and when (the first opening). A co-organizer who sees numbers only sees just how many households opened it, never which ones, and this total is shown only when it cannot point to a household. A personal link forwarded to someone else counts as an opening by that household; an opening may, rarely, not be recorded.
• Logs and forms: log of the emails sent (recipient’s domain only), feedback messages (kept without your identity after account deletion) and the waiting list (email, country, browser).
• Audience measurement and error reports: only with your consent for the browser; see section 6.

Photos. Before upload, each photo is redrawn in your browser: the GPS position, the device and the time of capture it contains are removed. A photo that still carries them is refused. Only the date of capture (the day, never the time) is read before this clean-up and kept with your album photo: you can correct or clear it in the photo workshop; it may appear on your invitation (Éphéméride design).

If you are a guest. When you reply to an invitation, your reply (attendance, number of people, message and, if you provide them, kosher diet and allergies) is recorded for the organizer of the celebration, who decides how it is used. Only the organizer and their co-organizers see it; it is never published. To have it changed or erased, ask the organizer, or write to contact@tov.events. If the host removes you from their list, your reply is erased along with your record.

The data is used to:

• Provide the online invitation service.
• Manage RSVPs and track confirmations.
• Let the organizer know that an invitation has been opened.
• Send service-related notifications to the organizer and their collaborators (confirmations, reminders, security alerts). Tov does not write to guests, with one exception: if the organizer chooses it, on the morning of the celebration each family that is coming receives its table (number, table name, time and place) at the e-mail address given by the organizer or by the guest; one link at the bottom of that e-mail is enough to stop receiving it.
• Send the organizer, at most once every 3 days (except the alert about a change not yet announced to guests), tips written in advance when their celebration seems stuck (no celebration created, invitation never sent, sending started then stopped, duplicate celebrations, a change of day, time or place not yet announced to guests). These e-mails contain only numbers, never a guest’s name or message. The time of your recent visits helps us write to you at a convenient moment; no pixel measures whether they are opened, and one link at the bottom of each is enough to stop receiving them.
• Keep accounts secure and fix errors in the service.
• With your consent, measure traffic on the public website.

Processing is based on the performance of the service contract (account creation, acceptance of the Terms of Use), on the legitimate interest of keeping the service secure and of helping you see your celebration through (tips by e-mail, which you can stop with one click), and on your consent for audience measurement and browser error reports. Guest data is entered by the organizer, who decides whom to invite, or by the guest themselves when replying.

Your celebrations are kept until you delete them. A celebration and its data (guests, replies, messages, gifts…) are kept until its owner deletes it; the owner can do so at any time: the celebration then spends 30 days in a bin, closed to guests and restorable by its owner, and is then erased. Invitation open counts are kept for one year. The temporary copy of imported Google contacts is erased as soon as it is displayed or, if it is never opened, by the next cleanup once an hour has passed (section 9); sign-in sessions last 30 days, then expired sessions are erased; daily usage counters (AI-written texts, co-organizer invitations), used for limits, are erased after 30 days. Sign-in and password-reset links are erased one day after they expire. The count of passkey sign-in attempts, used to block repeated attempts, is erased at the next successful sign-in, otherwise one day after its 15-minute window ends. Old replies, kept when a guest changes their mind, are erased after 180 days; notifications, the email log (domain only), the record of tips sent by e-mail and the waiting list, after one year; feedback messages, after two years. The log of the Tov team’s actions on an account or a celebration (support, deletion, restoration), kept for security, holds only identifiers, the browser type and the country; it is erased after two years. When an organizer changes their invitations’ address (@name) or deletes their account, the former address is kept as a fingerprint (never in plain text), with no time limit, so that no other account can take it and links already sent never lead to someone else.

Your address book is kept until you empty it. Deleting a celebration does not erase households from your address book. Deleting a contact removes it from the address book; celebrations keep their guests, unless you tick “Also delete from all my celebrations” (an erasure request: the household and its replies then disappear from all your celebrations). Deleting your account erases your address book.

Deleting a celebration erases its page, its moments, its guests and their replies; the celebration’s photos are erased from storage at the same time. Its owner can do so at any time. Deleting a guest also erases their reply and their old replies.

The recap after the celebration is private by default. For celebrations created since October 1, 2026, the memory page is visible only if the organizer publishes it; it then shows the summary and approved photos; guests’ messages are not shown there. It is never indexed by search engines. The organizer can hide it again at any time.

Deleting your account (Settings, Privacy) requires confirmation by email, valid for one hour, then immediately erases the account, its celebrations, its guests and their replies. What remains: feedback messages (without your identity, two years at most), open counts (pseudonymous), the email log (domain only, one year at most), the waiting list (one year at most) and the database’s technical history, which makes it possible to restore the last six hours. Photo files are erased with the celebration; after an account deletion, within 24 hours at the latest.

Tov never sells your data: it is used only for your celebration and to run the service. It is entrusted to the following providers, each for its own function only:

• Cloudflare: hosting and running the website (global network), photo storage, and Turnstile bot protection on sign-up, password reset and the guest reply form.
• Neon: database (European Union, Frankfurt).
• Resend: sending service emails to the organizer and their collaborators and, if the organizer chooses it, the “Your table” e-mail to guests on the morning of the celebration.
• Inngest: scheduled tasks (reminders, digests, thank-you notes).
• Google: Sign in with Google, importing your contacts at your request, address entry (Google Maps) and, with your consent, Google Analytics.
• Google (Gemini): writing help, only when you ask for it (“Write with Tov” or assistant button), and translation of your texts, on request and then automatically when your invitation is read in another language; Tov sends only the texts needed and the type of celebration, never first names (replaced before sending) nor your guests’ contact details. Only exception: when you give an instruction or ask a question to the seating plan assistant (Tovy), Google receives, to understand it, your instruction, the last lines of the current conversation (six at most) and the names of the families of that moment, their side, their labels and the tables — never a diet, an allergy, a message, a private note, a phone number or an email. Tov does not keep this conversation: it is erased when you leave the plan. What the assistant does applies to the plan right away and can be undone in one tap.
• PostHog (European servers): with your consent, measuring site usage.
• Sentry: technical error reports from the server and, with your consent, from the browser.
• Your browser’s notification services: if you turn on notifications.
• UptimeRobot: monitoring the website’s availability (public address only).
• Hostinger: the contact@tov.events mailbox.

Some of these providers may process data outside the European Union (Google Analytics, in particular, in the United States, under the EU–U.S. Data Privacy Framework; Google’s (Gemini) processing of your texts may also take place outside the European Union). We also disclose data to the competent authorities when legally required. Finally, the Tov team can temporarily open (for two hours) an organizer’s space for technical support.

Essential cookies (no consent needed): session cookie (30 days, inaccessible to JavaScript), session cache (1 hour), two technical cookies while adding or using a passkey (10 minutes at most) and, for the Tov team during support, a temporary cookie (2 hours).

Browser local storage (no consent needed): these are not cookies. Tov keeps there your cookie choice, the language of the organizer space, the “signed in” state, the state of the sidebar, the opened envelope of an invitation, your music preference, and whether this device already has a passkey for Tov (and whether one was already offered to you). None of it leaves your device.

Audience measurement (with your consent): the “Audience measurement” category of the banner covers three tools:

• Google Analytics: page views of the public website, with Google’s cookies. Google may process this data in the United States. Google signals and ad personalization are turned off.
• PostHog: use of the website and its flows (European servers), with PostHog’s own storage in your browser.
• Sentry: browser error reports, loaded at the first error, with a screen replay (all text masked, media blocked) for some sessions and for every session with an error.

These three tools never run on invitations, in the organizer space, on sign-in, drafts or collaboration pages, nor on any address containing a personal link. No advertising cookie is used. You can withdraw your consent at any time from the settings of your space or by clearing the site’s data in your browser; the “Cookie settings” banner then appears again.

Under the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data.
• Right to rectification: correct inaccurate data.
• Right to erasure: delete a celebration or your account from your settings (see section 4).
• Right to data portability: receive your data in a structured, machine-readable format (JSON export of the celebrations you own, without the photo files, from your settings; CSV export of replies).
• Right to object: object to the processing of your data.

If you are a guest, you can contact the organizer of the celebration or us. To exercise these rights, contact us at contact@tov.events.

We apply technical and organizational measures to protect your data: password hashing, signed sessions in a cookie inaccessible to JavaScript, CSRF protection, systematic input validation, rate limiting and the Cloudflare Turnstile bot challenge on sign-up, password recovery and the guest reply form. Guest replies are visible according to the role (owner, editor, viewer) that the organizer gives their collaborators.

Tov.events offers two features that go through your Google account. They are used only if you choose them.

• Sign in with Google: Tov asks Google for your basic identity only (the “openid,” “email” and “profile” permissions): your name, your email address, your profile photo and your Google account identifier. They are used only to create your Tov account and sign you in. Tov stores no Google access token: the tokens Google sends at sign-in are discarded before anything is saved.
• Importing your Google contacts (a celebration’s “Invite” page, or “Import contacts” in My contacts, only if you click that button): Tov asks for read-only access to your contacts (the “contacts.readonly” permission) and reads, for each contact, their name, primary phone number and primary email address, nothing else, up to 2,000 contacts. Tov never changes or deletes your contacts at Google. The access token is used only for the duration of this reading: it is never saved, and Tov asks for no lasting access.

Use and storage: your contacts are used only to let you choose whom to invite or whom to add to your contacts book. The list read from Google is copied to a temporary area of our database, tied to your account (and to your celebration, when the import starts from a celebration). It is erased as soon as the selection list is displayed to you, right after you come back from Google; a list that was never opened is erased by the next cleanup once an hour has passed. Only the contacts you check become guests of your celebration or cards in your contacts book; the others are not kept. Those guests and cards are then handled like the ones entered by hand (sections 1 and 4).

Transfer to third parties: data received from Google is never sold, never used for advertising (no targeting, retargeting or personalized ads), never used to assess creditworthiness, and never passed on to advertising platforms or data brokers. It is not used to train any artificial intelligence model. It is transferred to no one, except to the technical providers that run the service (Cloudflare for hosting, Neon for the database; see section 5), when necessary for the security of the service, or when the law requires it.

Human access: no one at Tov reads your Google contacts. The guests you chose are viewed by the Tov team only if you ask the support team for help (section 5), for the security of the service, or to comply with the law.

Revoking access and erasing this data: you can remove Tov.events’ access to your Google account at any time at myaccount.google.com/permissions. Removing access does not erase what you have already chosen in Tov: delete the guests concerned or the celebration in your space, or delete your account (Settings, Privacy) to erase the name, email and photo received from Google (section 4). You can also write to us at contact@tov.events.

Limited Use commitment: Tov.events’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.