Privacy policy

BeeDay is a private, invite-only photo-sharing tool for kids' birthday parties. The people who use BeeDay are the parents who host an event and the guests they approve. Children do not have accounts and do not use the app.

Because parties for young children are involved, we treat photos and details about children as sensitive and apply children's-privacy protections (such as COPPA in the United States).

• Photos and captions that approved guests upload, which may include images of children.
• A child's first name (the birthday child's name, and any child first names a guest adds), used only to personalise the album.
• Host account details: email address and an 18-or-older confirmation.
• Guest details: the name and contact a guest provides when asking to join an event.
• Photo-task activity: which photo tasks a guest completes at an event, and the photos they add to them — which other guests at the same party can see (see “What other guests can see” below).

We strip location (GPS/EXIF) data from every uploaded photo on our server before it is stored. We do not collect a child's date of birth, home address, school, or precise location. How long an event's album stays available depends on the host's plan — see “How long we keep information” below.

To run the event album: storing and showing approved photos, letting the host moderate uploads, personalising the album, and (only if the host turns it on) automatically checking photos for inappropriate content. We do not use any of this information for advertising, and we do not sell it.

A party album is shared, so the guests at that party see each other's approved photos — that's the whole point of it. Photo tasks work the same way: once a few guests have completed the same task, their approved photos appear together on that task, so everyone can see the party from more than one angle.

Names are not shown on those photos. Guests never see anything from any other party, and nobody outside the party sees the album at all.

Two small things about an event can be seen without an invite:

• When someone shares an invite link in a message or on social media, the little preview card shows the event's name.
• The keepsake badge a guest can save and share shows the event's name and, if the host wrote one, their thank-you note.

That's all. No photos, no guest details, and never the birthday child's name. Everything else needs an invite.

We use a small number of service providers to operate BeeDay:

• Supabase — database and photo storage.
• Vercel — application hosting.
• Resend — sending event emails (join requests, approvals, links).
• Stripe — processing plan payments (no photos are shared).
• OpenAI — optional AI safety scanning of photos and captions, only for events where the host has turned it on. OpenAI does not use data sent through its API to train its models, and deletes it within 30 days.
• Sentry — error monitoring, so we find out when something breaks on our side. It receives the technical details of the failure. It is set up not to receive photos, cookies, IP addresses, or the private links that open an event.

These six are the complete list. If we ever add another company that handles your information, we'll update this page before we do it.

We do not share photos or children's information with anyone else, and never for advertising.

Hosting requires confirming you are 18 or older. Sending photos to the optional AI safety scanner (OpenAI) requires a separate, explicit opt-in that the host makes per event. Our consent process is still being strengthened as we add formal verifiable-parental-consent steps.

You can, at any time:

• Ask what information we hold and request a copy.
• Ask us to correct it.
• Delete it. A host can permanently delete an entire event — including every photo, caption, guest, and the stored image files — from the event's Share tab. You can also email us to request deletion.
• Withdraw consent (for example, turn off AI scanning for an event).

To make any of these requests, email privacy@getbeeday.com. We'll respond to deletion requests as quickly as we can.

We keep an event's photos and details for as long as the album is active, and then delete them. How long an album stays active depends on the host's plan:

• Free plan: about 12 months after the party.
• Paid plans: a longer active period — the higher the plan, the longer the album stays available. Current plan durations are shown on our pricing page before you pay.
• Unlimited plan: the album stays available until the host deletes it.

We keep this information only to run and keep available the private event album the host created. We do not keep it for advertising and we do not sell it.

A host can permanently delete an entire event — including every photo, caption, guest record, and the stored image files — at any time from the event's Share tab, and anyone can email us to request deletion earlier than the periods above. Your plan sets the longest an album stays available; it never prevents earlier deletion on request.

Albums are now removed automatically on the schedule above — nobody has to ask. We keep a short audit record of deletions (what was deleted, and when) as required for compliance.

We email the host before an album closes — once about 30 days ahead, and again about a week before — so there is time to download the photos or extend the album.

BeeDay uses a small number of cookies and stores a few things in your browser. All of them are ours — none are advertising, none are shared with anyone, and there is no third-party tracker anywhere on BeeDay.

• Staying signed in — if you host, a cookie keeps you signed in to your account.
• Your party pass — when you join a party, we keep that party's pass in your browser so you don't need the invite link every time.
• Where you came from — if you tap through to BeeDay from a party's album, we remember which party sent you, for 30 days. It's an id for the party, not anything about you, and we use it to see which parties bring us new hosts.
• Small preferences — whether you've seen the intro, how you like the gallery laid out, and the emoji you've used recently.
• Counting visits — a random id made up in your browser, so we can count things like how many people opened a page without knowing who you are.

You can clear all of it any time by clearing your browser data for getbeeday.com. If you do, you'll be signed out and you'll need your invite link again.

“Do Not Track” signals. Some browsers can send a “Do Not Track” signal to the websites you visit. There is no agreed standard for what a site should do when it gets one, so BeeDay doesn't respond to it — and there's nothing it would switch off if we did. We don't follow you around other websites, and no other company collects information about what you do on BeeDay, here or anywhere else. There are no advertising trackers on BeeDay at all.

BeeDay is run from Ontario, Canada, and Canadian federal privacy law (PIPEDA) applies to us.

Your information is stored by the providers listed above, on servers that may be outside Canada, including in the United States. While it's there, it can be subject to the laws of that country, including lawful access requests by its authorities.

Under Canadian law you can ask us what personal information we hold about you, ask for a copy, ask us to correct it, and ask us to delete it — email privacy@getbeeday.com. If you're unhappy with how we've handled a privacy request, please tell us first so we can put it right. If we can't, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

We do not sell or share personal information as those terms are defined under California law. There is nothing to opt out of, but you can still contact us with any privacy request.

BeeDay is operated by adults for adults; children do not create accounts or use the app directly. We do not knowingly collect personal information directly from a child. Where we hold information about a child (such as a photo a guest uploaded), a parent can contact us to access or delete it.

Questions or requests: privacy@getbeeday.com. We'll respond to any privacy request as quickly as we can.

If we change this policy we will update the effective date above and, for significant changes, let hosts know by email.