Privacy policy
Plain language. Last updated 2026-11-09.
What we keep
- Hosts: your name, email address, a scrambled form of your password (never readable), your events, their pictures and guest lists, and the messages you send to guests (only the subject, the time and how many guests, not the text).
- Guests: the name, email address, answer, number of guests and note you type when you answer an event.
- Pictures: a picture you upload is re-made on our server: it is shrunk, and hidden details such as where a photo was taken are removed.
- Page counts: for each event we count page views per day. The count has nothing about the visitor in it.
- Abuse limits: to stop spam we keep short-lived counters made from a scrambled form of your network address. We do not store the address itself.
- Our web host keeps ordinary server logs (network address, page, time) for security, as every website does.
Cookies
Only two kinds, both needed for the site to work: a sign-in and form-protection cookie, and a small cookie that remembers a guest’s own answer on that event. We use no advertising or tracking cookies and no tracking scripts.
Who sees it
A host sees the answers to their own events. Nobody else does. We can look at data only to run the service, deal with a report, or help you. We do not sell or rent information, and we do not share a guest list with anyone.
We email you to confirm an account, reset a password, confirm an answer, remind guests the day before an event (unless the host turned it off) and deliver a host’s messages about an event. Every guest email has a link to stop emails about that event.
How long we keep it
- Events and their guest lists are deleted automatically a year after the event.
- You can delete an event, or your whole account with all its events, at any time. Pictures go with them.
- Reports are kept for 12 months. Backups are kept for 14 days, so deleted data can remain in a backup for up to that long.
Your rights
You can ask to see, correct or delete your information at any time, as Canadian privacy law (PIPEDA) allows: write to hello@sonatina.ca. A guest can also ask the host, or use the link in any email to stop emails.
Children
Accounts are for adults. An invitation to a child’s party should be answered by a parent or guardian. Hosts must not put children’s names, photos or addresses on a public page.
Changes
If this policy changes, we update the date above, and tell hosts by email when the change matters.