Privacy Policy

1. What we collect

Account information. When you create an optional account: email address, hashed password, account creation timestamp.

Event-participant information. When you join an event as a participant: the display name you choose, an optional password (hashed), and the per-event session cookie used to remember you for that event only.

Event content. What you create or contribute on the Service: events, availability slots, items added to bring-lists, role claims, votes, comments, location entries.

Billing information. If you subscribe to Pro: name, billing address, and last 4 digits of your card (full card data is held by Stripe, never by us).

Technical information. Standard server logs (IP address, user agent, request paths, timestamps) for ~30 days, retained for security and abuse detection.

Error tracking.If something breaks, our error tracker (Sentry) records the error message, stack trace, request URL, and user agent. We scrub email addresses + cookie values before sending. Retained per Sentry's free-tier default of 30 days.

Web analytics. We use Vercel Analytics, which records page views and seven custom events (sign-up, event creation, pricing-page view, upgrade click, checkout success, comment post, decision vote). Vercel Analytics is cookieless and does not track you across sites.

2. What we do with it

• Operate the Service (show your events to your group, store your availability).
• Process payments through Stripe.
• Send required emails: receipts, password reset, NY GBL § 527-a annual-renewal reminders. We do not send marketing email unless you explicitly opt in.
• Detect abuse: rate-limit excessive event creation, flag suspicious sign-ups.
• Comply with legal obligations.

We do not sell your information. We do not share it with advertisers.

3. Who we share it with

• Stripe: payment processing for paid subscribers. Stripe's privacy policy: https://stripe.com/privacy.
• Vercel: hosting + analytics. Vercel's privacy policy: https://vercel.com/legal/privacy-policy.
• Neon: database hosting. Neon's privacy policy: https://neon.tech/privacy-policy.
• Sentry: error tracking. Sentry's privacy policy: https://sentry.io/privacy/.
• Anthropic(Pro feature): if you use AI suggestions on a Pro plan, your event's anonymized availability data is sent to Anthropic to generate the suggestion. We strip participant names; Anthropic only sees aggregate counts. Anthropic's privacy policy: https://anthropic.com/privacy.
• Resend(when email features ship): transactional email delivery. Resend's privacy policy: https://resend.com/legal/privacy-policy.
• Upstash: rate-limit storage (IP addresses only, hashed, 1-hour TTL). Upstash's privacy policy: https://upstash.com/trust/privacy.
• Government: if compelled by law (warrant, subpoena, court order).

4. How long we keep it

• Active accounts: as long as the account exists.
• Inactive events: deleted automatically 6 months after the event's date range ends if no logins occurred in that window.
• Billing records: 7 years (IRS requirement).
• Server logs: 30 days.
• Sentry errors: 30 days.

5. Your rights

You can:

• See what we have on you. Email support@weville.app and we'll send you an export.
• Correct it. Edit your account profile, or email us.
• Delete it. Email us asking for account deletion. We process within 30 days. Billing records are retained per the 7-year IRS rule above; everything else is purged.
• Opt out of marketing email. We don't send marketing email today; if we start, you can opt out via the unsubscribe link.

EU/UK residents: GDPR Articles 15–22 give you the same rights plus data-portability + restriction of processing. Email us.

California residents: CCPA Sections 1798.105–1798.135 give you the same rights plus the right to know what categories of data we collect.

6. Security

• Passwords stored hashed with bcrypt (cost 12).
• All connections served over HTTPS.
• Database encrypted at rest (Neon + Vercel defaults).
• We follow the NY SHIELD Act's “reasonable safeguards” framework for small businesses.

If a breach exposing private information happens, we will notify affected users and the NY Attorney General within the timeframes required by NY GBL § 899-aa (without unreasonable delay).

7. Children

WeVille is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe a child has signed up, email us and we will delete the account.

8. International transfers

Our servers are in the United States. If you access WeVille from outside the US, your information will be transferred to and stored on US servers.

9. Changes to this policy

We will update this page if our practices change. Material changes will be emailed to all account holders 30 days before they take effect.

10. Contact