Privacy Policy

What we collect

• For the host: their first name and email address, used to send them the organizer link, the day-before reminder (the picture of their table), and a payment confirmation if applicable. Their first name appears on the event's public page.
• For guests who contribute: a first name, required, and an optional dish detail (“my Greek salad”). Both are public: they show on the event page, that's the whole point of a potluck, and the form says so before submitting. The email address is optional and is never displayed: it is only used to send the contribution recap, the cancellation link, and the day-before reminder.
• For the list: the things to bring, their categories, quantities, and notes, added by the host or proposed by guests. All of it shows on the event's public page.
• For sharing by email: addresses entered in the invitation form are used to relay the message, then forgotten. They are never stored and never added to any list.

Cookies

We use functional cookies that don't require consent: an httpOnly cookie recognizes the host (their organizer link), another remembers contributions made from this browser so they can be reviewed or cancelled. On the free version, Google AdSense advertising cookies may also be set, only with your consent (see “Advertising” below).

What we don't do

• We don't sell or rent your data to anyone.
• We don't send a newsletter.
• No account is required: access happens only through links (the event's public link, the secret organizer link, a contribution's personal link).
• Emails never leave the app: never displayed on a page, never passed to the host or anyone else, they are only read to send the emails described above.

Hosting and subprocessors

Your data is hosted on Vercel's servers and in a Neon (PostgreSQL) database, emails are delivered by ZeptoMail (Zoho Corporation, Canadian data centre), and payments are processed by Stripe, which never shares your card number with us. Each acts as a subprocessor, under its own security commitments.

Traffic measurement

We measure site traffic with Vercel Web Analytics, a cookieless tool: no advertising profile, only aggregate statistics (page views, referrers, device type). Before anything is sent, address segments carrying a secret link and all query strings are redacted: your secret links are never transmitted to this tool, and no request goes out without an actual visit.

Advertising

The free version of {appName} is funded by Google AdSense ads; unlocking an event removes them from its pages. In line with Québec's Law 25, a consent banner, separate from this policy, asks you to accept or decline advertising cookies before any ad loads. If you decline, non-personalized ads are shown instead; if you accept, ads may be personalized. You can withdraw your consent at any time by clearing this site's cookies in your browser, which brings the banner back.

Compliance

We apply the principles of Québec's Law 25: minimal collection, clear purposes, and your right to know what we hold about you or to have it deleted.

Who can see your event

The event page is visible to anyone holding its link: it's a public link, made to circulate in your group, and what it shows (title, list, guests' first names and dishes) is public by design. It is not indexed by search engines, and its address is not guessable. Only the person holding the organizer link can edit the event.

Deleting your data

To have your event, a contribution, or any of your data deleted, write to us at bonjour@quiapportequoi.ca and we'll take care of it promptly.