Privacy

It helps to separate them, because the site treats them differently:

• Shown publicly — visible to anyone who opens the site.
• Kept for us to run the site — visible only to the two of us and anyone we've given an admin account.
• Sent for us to consider publishing — guestbook messages and photographs, which we read first and which appear only if we approve them.

The RSVP page is reached through a personal link in your invitation. What you send us: who in your household is coming to which events, an email address and phone number if you give them, any dietary notes, the names of any plus-ones, and a message to us if you write one.

None of this is shown on the site. It is ours to plan with. We also hold, from our own records rather than from you, the address we posted your invitation to and our own notes about your household.

You send a first name, a last name, a message, and an email address if you choose to. We read every entry before it appears.

If we publish it, the site shows your first name and last initial — “Ada D.” — and your message. Your full surname and your email address are never shown.

You send your name, the photographs, an email address if you choose to, and a note if you write one. Every photograph is looked at before it appears anywhere.

If we publish one, the site shows the photograph only. Your name and email are not shown beside it — we ask for your name so we know who to thank and who sent what, not to publish it.

Photos uploaded through this site are resized into website copies, and embedded camera metadata, including location information, is removed. Keep your originals separately if you want full-resolution keepsakes. Please only send photographs that are yours to share.

To keep the upload form from being abused we store a one-way fingerprint of the network address the upload came from. It cannot be turned back into an address, and we do not store the address itself. Signing the guestbook stores nothing of the kind at all.

The RSVP link in your invitation is signed by us and expires. It is not a password: anyone holding your link can see and change your household's reply, so treat it the way you'd treat the invitation itself. The short-lived links your browser uses to send a photograph work the same way.

We send two kinds of email: invitations to guests, and sign-in links to ourselves — the site has no passwords, so signing in means clicking a link we email. Email is delivered through Resend, an email service. We keep a record of what we sent and to whom, with the sign-in link itself removed from that record.

Photographs are stored in a private Vercel Blob store. Nothing in it can be browsed or listed from outside, and the storage address never appears in your browser: the site serves each photograph through its own address and re-checks every time that the photograph is still one we're showing. The site and its database run on hosted services, which means the companies providing them can technically reach what is stored there.

Every change made in the admin area is written to a log we can read later: who did it, what changed, and when. For something you sent us, that log records your name and the shape of what arrived — how long a message was, how many photographs — rather than a second copy of your words or your photographs. Sign-in links, upload links and email addresses are kept out of it.

There are none. This site sets no cookies for visitors, runs no analytics, and loads no third-party scripts or tracking pixels. The only cookie it ever sets is for the two of us when we sign in to manage it.

Ask us and we'll take it down. When we remove a photograph it stops appearing on the site and stops being served, immediately.

We want to be straight about the limit of that: removing something takes it off the site, and the stored website copy is kept. This site is also meant to become a lasting record of our family, so we have not set a date on which things are deleted, and we are not going to promise one we couldn't keep. If you need something genuinely erased rather than taken down, tell us and we will deal with it ourselves.

Ask either of us directly — however you normally reach us, or by replying to the email your invitation came from. It is our wedding site; there is no help desk behind it.