Privacy policy

1. Who we are

Shareish is run by a small team in Melbourne, Australia. We follow the Australian Privacy Principles in the Privacy Act 1988. This page explains how. Ask the person who sent you the invitation and they will pass it on to us.

2. What we collect

We collect only what we need, and it depends on who you are.

Guests

• Your name, email and mobile number, so we can send your receipt, text you a code to confirm your reply, and let you back into it.
• Your reply (coming, can't come, or can't come but would like to give), your child's first name if you bring one, and any food notes you add.
• What you gave and how you split it, and a reference for the payment. Not your card details. Those go to Stripe and never reach us.
• Your message for the card, and a picture of a drawing if you add one.
• Whether you ticked the box to hear from us again.

Parents

• Your mobile number, which is how you sign in, and your name if you give it.
• Your child's first name and age, the date, time and place of the party, and the street address.
• The gift options you chose and what guests gave to them.
• A reference to your Stripe account. Stripe collects your identity and bank details itself. We don't keep them.
• If you buy a 12-month pass, Stripe takes the card payment, and we keep a reference to it.
• Top-up notes you write, such as "chores", for money added outside the app. They are stored apart from payments and only you can see them.
• A private link to your child's kids' page. It shows first names only and no amounts. Anyone with the link can read it, so share it with care.

Organisations

• The organisation's name, type, charity number or ABN, state and website.
• A contact person's name, mobile number and email.
• How you plan to share your link, and your agreement to be listed.
• Counts of visits and parties started through your links. We never show or collect the names of the people who gave.

Everyone who visits

• Basic technical information our host keeps in its logs, such as the page requested and the time. We use it to keep the site working and safe.
• We don't use advertising trackers or third-party analytics.
• If you use the optional Feedback button, when it is shown, we record the page address, what was pressed and your device. We never record what you type in the boxes.

3. Children's information

We keep this as small as we can. For a child we hold a first name and an age. We never ask for a surname or a date of birth. Children don't use the service. Only adults sign in or reply.

Party pages are hidden from search engines and open only to people with the link. The street address appears only after a guest replies. We never use a child's name or photo in our marketing. We assume Australia's Children's Online Privacy Code applies to us once it is in force, and we are building to it.

Drawings and photos a guest adds to a card are deleted 30 days after the card is printed or the party is closed, whichever is later.

4. How we use it

• To run the invitation, take and record gifts, make the group card, and let the parent say thank you.
• To send you messages about your own party: receipts, replies, reminders and thank-yous.
• To check messages and pictures before a parent or child sees them.
• To keep accurate records of payments and refunds, and to spot mistakes and misuse.
• To understand, in total, how the service is used, so we can improve it. We look at counts, not at individual people.

We don't sell personal information and we don't show ads. Other guests never see what anyone gave.

5. Who helps us hold it

We use these services to run Shareish. Each one handles only what it needs to do its job.

• Stripe collects payments and pays parents. It sees your card and, for parents, your identity and bank details.
• Postmark sends our emails.
• Twilio texts the sign-in code to a parent and the confirmation code to a guest.
• Neon holds our database. Ours is in Sydney.
• Vercel hosts the site and stores uploaded pictures.
• Sentry tells us when something breaks. We remove personal details from its reports before they are sent.

Some of these companies may handle information outside Australia, mostly in the United States. We choose services that protect it, and we don't let them use it for their own purposes. We may also share information when the law requires it, or to protect someone's safety.

6. How long we keep it

• Drawings and photos of children: 30 days after the card is printed or the party is closed, whichever is later.
• Payment records (amounts, dates, references): seven years, because the law expects businesses to keep their financial records. After you ask us to delete your information, these records stay but no longer carry your name or contact details.
• Guest and party details: until the party is done and any thanks and refunds are finished, then until you ask us to delete them.
• Logs and short-term records: about 30 days.

7. Cookies

We use only the cookies the site needs, so there is no cookie banner.

• Sign-in. A parent's sign-in cookie keeps them signed in. Guests don't have one.
• Partner link. If you tap "plan a party" from a partner organisation's link, a small cookie remembers which organisation sent you for 30 days, so it can appear as a choice on your first party. It is used once, and it doesn't follow you around the web.
• Stripe. When you pay, Stripe may set its own cookies or similar storage to prevent fraud. That is covered by Stripe's privacy policy.

8. Emails and texts

We send you messages about your own party because you took part in it. We only send you anything else, such as news about Shareish, if you ticked the box to say yes. Every one of those emails has a link to stop them, and you can use it at any time.

9. Your choices: a copy, a fix or deletion

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Ask the person who sent you the invitation and they will pass it on to us. Tell us which party it relates to. We'll check it's really you, and we aim to reply within 30 days.

When we delete, we remove your name, email and notes, remove files you uploaded, and keep only the payment records described above. A parent can't be deleted while a party is still open. We'll explain what to do.

10. Keeping it safe

Connections are encrypted. Access to our systems is limited to the people who need it. Uploaded pictures are private and are served only with a signed, time-limited link. If we find out that your information has been lost or accessed in a way that could cause serious harm, we will tell you and the Office of the Australian Information Commissioner, as the law requires.

11. Complaints

If you're unhappy with how we've handled your information, tell us first and we'll try to put it right. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

12. Changes

We may update this page. If a change matters to you, we'll tell you before it applies. The date at the top shows when it last changed.