Legal

Privacy Policy

Effective October 5, 2026 · Lire en français

Kidful helps grown-ups invite families to children’s birthdays and family gatherings, and collect their replies. Doing that means handling information about real families, including children, so we keep it small and careful. This policy explains what we collect, why, who we share it with, and the choices you have.

Kidful is operated by an individual based in Ontario, Canada (“Kidful”, “we”, “us”). We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector (Law 25).

1. Who this policy covers

• Hosts: people who create a Kidful account to plan a gathering.
• Guests: parents, guardians and other adults who receive an invitation and reply to it.
• Children: children who are named in an invitation or a reply. They do not use Kidful themselves.
• Visitors: anyone browsing kidful.ca.

2. Information we collect

From hosts

• Account details: your name, email address and password. We store only a scrambled (hashed) version of your password, never the password itself.
• If you sign in with Google: your Google account ID, name and email address. We do not get access to your Google contacts, files or password.
• Gathering details you enter, such as the title, date, time, location, description, the celebrant’s name and the age they are turning, and any files you upload (for example, a blank waiver form).
• Information about the families you invite: household names, guests’ and guardians’ names, email addresses and mobile numbers, and the first names of invited children.

From guests

• Your reply: whether you are coming, which children are attending, how many adults are staying, and whether children are being dropped off.
• Pick-up details, if you give them: the name of the person picking up, a time, and a contact detail.
• A private note to the host. You can use this for allergies, accessibility needs or other details. This is optional. Health details are sensitive, so please share only what the host needs to know.
• Messages and reactions you post on a gathering’s message board, and any corrections you make to your name, email or phone number.
• Waivers: a signed waiver file you upload (PDF or image), or your confirmation that you have completed one.
• Reminder preferences, including when you agreed to receive reminders and by which channel (email, text message or browser notification).

Collected automatically

• Invitation activity: when an invitation was first and last viewed, how many times it was viewed, and whether the envelope was opened, so the host can see who has seen their invitation. We do not record your IP address or device with this.
• Browser notifications: if you turn them on, the technical address your browser’s push service gives us to deliver notifications.
• Technical information: like any website, our servers and hosting providers receive your IP address and basic browser information when you connect. We use it briefly to keep the service secure and to limit abuse. Our application does not keep a log of visitors’ IP addresses.
• Analytics, only with your consent: see Cookies and similar technologies.

3. Children’s information

Kidful is made for adults. Children cannot create accounts or use Kidful themselves, and we do not knowingly collect information directly from children.

Hosts and parents may enter children’s first names, which children are attending, and the age a birthday child is turning. We use this only to organize the gathering. We ask hosts and guests to include only what is needed: a first name is usually enough. Kidful does not ask for children’s birth dates, photos or medical records. A parent or guardian can ask us to remove their child’s information at any time by writing to hello@kidful.ca.

4. How we use information

• To run Kidful: create gatherings, deliver invitations, collect replies and show them to the host.
• To send messages you expect: invitations and updates from a host, reminders a guest has asked for, and account emails such as sign-in, verification and password-reset messages.
• To keep Kidful safe: preventing spam, fraud and abuse, and protecting accounts.
• To improve Kidful, using analytics only when you allow it. These analytics are about how pages are used, not about who you are.
• To meet legal obligations and respond to lawful requests.

We do not sell or rent personal information. We do not show ads or build advertising profiles. We do not send marketing emails unless you separately agree to them.

Information from Google sign-in

If you choose “Continue with Google”, Kidful asks Google only for your basic profile: your Google account ID, name and email address. We do not request access to your Gmail, contacts, calendar, Drive files or any other Google data, and we never see your Google password.

• How we use it: only to create your Kidful host account, sign you in, and send you account emails. Your name is shown on invitations you send as the host.
• Sharing: we do not sell it, use it for advertising, or share it with anyone except the service providers listed below that run Kidful.
• Storage and deletion: it is stored with your Kidful account until you ask us to delete the account. You can also remove Kidful’s access at any time in your Google Account under Security → Your connections to third-party apps & services.

Kidful’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who can see what

• The host sees their guest list, replies, pick-up details, private notes, waivers and invitation activity for their own gatherings.
• Guests see the gathering details and their own reply. Depending on the host’s privacy settings, guests may also see which other families are coming or how many, and the gathering’s message board.
• Each invitation has a personal link. Anyone who has that link can open that invitation, so please don’t share it.

6. Service providers

We use trusted companies to run parts of Kidful. They may only use personal information to provide their service to us.

If a host uses a venue’s own online waiver, you will be sent to the venue’s website, and the venue’s privacy policy applies there. We may also share information if the law requires it, to protect someone’s safety, or as part of a sale or transfer of Kidful. In a sale or transfer, the new owner must protect the information as this policy describes.

7. Where information is stored

Our providers operate servers in Canada, the United States and other countries, so your information may be stored or processed outside your province or outside Canada. While it is there, it may be accessible to courts, law enforcement and national security authorities under the laws of those countries. We choose providers that protect information to a standard comparable to Canadian law.

8. How long we keep it

• Gatherings: kept until the host deletes the gathering or their account. Deleting a gathering removes its guest list, invitations, replies, messages, waivers and files from our active systems.
• Accounts: kept until you ask us to delete your account.
• Delivery records (whether an email or text was sent): deleted after 90 days.
• Sign-in sessions expire after 14 days. Email verification links expire after 24 hours, and password-reset links expire after 1 hour.
• Backups: may keep deleted information for a limited time until they are replaced.

9. Security

We protect information with encrypted connections (HTTPS), hashed passwords, and sign-in and invitation tokens that are stored only in hashed form. We also use signed invitation links, limits on repeated attempts, and restricted access to our servers. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner of Canada, and the Commission d’accès à l’information du Québec where required, as the law requires.

10. Your choices and rights

• Access and correction: you can ask for a copy of the personal information we hold about you, and ask us to correct it. Guests can also update their own name and contact details from their invitation.
• Deletion: hosts can delete a gathering at any time. To delete your account, or to remove a guest’s or child’s information, email us. We will confirm your request and complete it within 30 days.
• Withdrawing consent: you can turn off reminders and browser notifications, or change your analytics choice at any time with the “Cookie settings” link at the bottom of our pages. If you withdraw consent, some features may not work.
• Guests: your host controls their gathering. For changes to a guest list, you can contact the host or us.

We will reply to requests within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d’accès à l’information.

11. Cookies and similar technologies

Kidful uses the cookies and browser storage it needs to work. We use analytics cookies only if you choose “Allow analytics” in the cookie banner. They are off until you do. If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a “no” and never ask.

Our analytics see only the type of page you are on, such as “an invitation” or “the event editor”. They never see the private link, the names on it, or your reply. Google signals and ad personalization are turned off.

12. Changes to this policy

We may update this policy as Kidful changes. We will change the date at the top. If a change is significant, we will tell hosts by email or in the app before it takes effect.

13. Contact us

The person responsible for privacy at Kidful is its operator. For questions, requests or complaints, email hello@kidful.ca.