Privacy Policy
Last updated: November 1, 2026
This Privacy Policy explains how Vernans ("Vernans", "we", "us") collects, uses and protects personal data when you use the Vernans website and web app at vernans.app, the Vernans mobile apps for iOS and Android (listed in the stores as "Vernans: Wedding Guest List") and the RSVP pages that hosts share with their guests (together, the "Services").
1. Who we are
Vernans is operated by Emre BALLI, who is the data controller for the processing described in this policy, except where section 4 says otherwise.
- Address: İstanbul
- Privacy requests: privacy@vernans.app
- General support: info@vernans.app
If you are in Türkiye, our KVKK Information Notice supplements this policy.
2. Summary
- We collect only what we need to run the Services: your account, the events you plan and the guest lists you build.
- We do not sell personal data and we do not show ads.
- The guest data you add is yours. We process it on your behalf.
- You can delete your account and all of your data at any time.
3. Data we collect
3.1 Account data
When you create an account on the web app, we store your email address, name, profile photo (if you sign in with Google), preferred language, sign-in method and account dates (for example when you joined and last signed in). If you sign in with Google, Google shares your name, email address and profile photo with us. We do not use passwords: you sign in with a one-time code sent by email or with Google.
3.2 Event and planning content
Events (title, type, date, location and an optional photo), guests (name, phone number, email address, notes, dietary notes, party size, group, table, RSVP status and check-in status), groups, seating tables, tasks, budget items and the people you share an event with (their email address and role).
3.3 RSVP answers from guests
When a guest answers through an RSVP link, we store the answer, the party size, an optional message to the host and, only if the host asks for it, a dietary note. In open registration mode we also store the name and phone number the guest enters.
To help hosts notice several answers sent from the same device, we store a one-way fingerprint calculated from the IP address and the browser type. It cannot be turned back into an IP address and it is cleared after 90 days. When the host uses the "last four digits" check, failed attempts are kept for 1 day to prevent guessing.
3.4 Subscription and purchase data
Pro subscriptions are bought on the web or in the App Store or Google Play. For store purchases, we receive the subscription status (plan, store, start and expiry dates) through RevenueCat. Web purchases are processed by Paddle.com, our reseller and Merchant of Record: Paddle collects your payment and billing details under its own privacy notice and sends us the subscription status (plan, status, renewal date) and a Paddle customer ID. We never receive your card details.
3.5 Newsletter
If you subscribe to our newsletter, we keep your email address and language with our email provider until you unsubscribe.
3.6 Technical and security data
To keep the Services secure, we process your IP address and basic request information. Rate limits store only a one-way hash of an IP address or email address, and these records are deleted after 2 days. The sign-in and newsletter forms are protected by Cloudflare Turnstile, which evaluates signals from your browser to tell people from automated bots. Our hosting and database providers keep short technical logs, usually for a few hours to a few days.
3.7 Analytics
On the website and web app we use Vercel Web Analytics. It does not use cookies and only reports aggregated statistics. We remove RSVP and invitation links from the page addresses it receives.
In the mobile apps we use Firebase Analytics (Google) to understand which features are used and Firebase Crashlytics to receive crash reports. Expo services check for app updates and collect basic performance data. These tools use device information such as an app instance identifier, the device model and the operating system version.
3.8 Data on your device (mobile apps)
The mobile apps store your events, guest lists, groups and preferences on your device. If you allow it, the app reads your contacts only so that you can pick people to add as guests; only the contacts you pick are saved, as guests. Reminders are notifications scheduled locally on your device. Exports (PDF, Excel and CSV) are created on your device. If you sign in to a Vernans account in the app, your data is synchronised with our servers and handled as described in sections 3.1 and 3.2.
3.9 Cookies and local storage
We only use cookies that the Services need to work: your sign-in session (secure and inaccessible to scripts), your language choice and your choice in the cookie notice. Settings such as your theme are kept in your browser's local storage. We do not use advertising cookies or cookies that track you across other websites.
4. Guest data: who is responsible
When you add guests or collect RSVP answers, you decide which data to collect and why. For that data you are the data controller and Vernans acts as your data processor (service provider): we process it only to provide the Services to you, as set out in our Terms of Use.
You are responsible for having a legal basis to process your guests' data, for informing them and, where the law requires it, for obtaining their consent (for example for dietary notes that reveal health information). Guests who want to exercise their rights can contact the host directly. If they contact us, we will pass the request on to the host.
Guests who answer on an RSVP page share their answer with the host who sent them the link.
5. Why we use data and our legal bases
| Purpose | Legal basis |
|---|---|
| Providing your account, events, guest lists, sharing and RSVP pages | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Sending sign-in codes and service emails | Performance of a contract |
| Managing Pro subscriptions | Performance of a contract and legal obligations |
| Security, preventing fraud and abuse, rate limits and bot protection | Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Aggregated analytics and crash reports to improve the Services | Legitimate interests, or consent where the law requires it |
| Newsletter | Your consent, which you can withdraw at any time |
| Dietary notes that reveal health information | The guest's explicit consent, collected by the host (GDPR Art. 9(2)(a); KVKK Art. 6) |
| Meeting legal obligations and handling legal claims | Legal obligation and the establishment, exercise or defence of legal claims |
6. Who we share data with
We do not sell personal data. We share it only with service providers that help us run the Services and that are bound by contract to protect it:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | Servers in Ireland (EU) |
| Vercel | Hosting and web analytics | United States; servers in Ireland and a worldwide delivery network |
| Cloudflare | Domain name service, bot protection (Turnstile) and email forwarding | United States; worldwide network |
| Resend | Sending emails and keeping the newsletter list | United States |
| Brevo | Backup email sending | France (EU) |
| RevenueCat | Managing subscriptions | United States |
| Paddle | Web payments and subscriptions (our reseller and Merchant of Record) | United Kingdom |
| Google (Firebase Analytics, Firebase Crashlytics, Google sign-in) | Mobile analytics, crash reports and sign-in | United States and EU |
| Expo | App updates and performance data | United States |
| GitHub | Storing encrypted database backups | United States |
| Apple and Google | App stores and in-app purchases | Under their own privacy policies |
We also share data with the people you choose to share an event with, with the host of an event when you answer as a guest, with public authorities when the law requires it and, where needed to protect our rights (for example when investigating abuse), with our legal advisers or the competent authorities. If the Services are transferred to another person or company (for example if a company is set up to run them), the data is transferred to them with the protections in this policy continuing to apply; we will tell you in advance.
7. International transfers
Some of our providers are located, or process data, outside Türkiye and the European Economic Area, including in the United States. For these transfers we rely on appropriate safeguards, such as the standard contractual clauses approved by the European Commission, the standard contracts provided for in Article 9 of KVKK and our providers' data processing agreements.
8. How long we keep data
- Account and content: for as long as your account exists. Deleted events and guests are kept as deleted records for 90 days so that the change reaches your other devices and can be undone; after that they are permanently deleted, together with the event photos and the RSVP answers of deleted guests.
- Account deletion: your account, all events you own, their guests, RSVP answers and photos are deleted immediately. Events that other people own and shared with you stay with their owners.
- Unused accounts: we may delete Free accounts that have not been used for 24 months, after notifying you by email at least 30 days in advance.
- RSVP device fingerprints: 90 days. Rate limit records: 2 days. Failed verification attempts: 1 day.
- Newsletter: until you unsubscribe. Deleting your account does not unsubscribe you automatically.
- Backups: encrypted daily backups are kept for up to 90 days, so deleted data disappears from backups within 90 days.
- Technical logs: a few hours to a few days.
- Analytics: according to our providers' retention settings.
- Data on your device: until you delete it or uninstall the app.
- Legal obligations and disputes: data that the law requires us to keep, or that is needed for a dispute or an official request, may be kept beyond the periods above for the period required by law or until the dispute is resolved.
9. Security
We use encrypted connections (TLS), database rules that let each user reach only their own events, long random tokens for RSVP and invitation links (which you can replace at any time), one-way hashing for IP addresses and encrypted backups. Access to production systems is limited. No system is completely secure, so please keep your devices and email account safe as well. If there is a breach, such as personal data being obtained by unauthorised persons, we will inform the people concerned and the authorities as required by law.
10. Your rights
Depending on where you live (for example under the GDPR, KVKK or Brazil's LGPD), you have the right to:
- access your personal data and receive a copy;
- correct inaccurate data;
- have your data deleted;
- restrict or object to processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- know whether your data is transferred abroad and to whom;
- not be subject to decisions based solely on automated processing (we do not make such decisions).
You can update your profile, export guest lists and delete your account in the app, or email privacy@vernans.app. We answer within 30 days and may ask you to confirm your identity. We pass requests about guest data on to the host, who is responsible for that data. We may not be able to delete data that the law requires us to keep, and for manifestly unfounded or excessive requests we may, to the extent the law allows, refuse the request or charge a reasonable fee. You can also complain to a supervisory authority, such as the Turkish Personal Data Protection Authority (KVKK), the data protection authority in your EU country or Brazil's ANPD.
11. Children
The Services are not intended for children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. The date at the top of the page shows the latest version. If our service providers change, we update the list in section 6. If a change is significant, we will tell you in the Services or by email before it takes effect.
13. Contact
For any question about this policy or your personal data, write to privacy@vernans.app.