Privacy Policy

This policy explains how Wedlog handles personal data when you use the Wedlog mobile app, visit this website, create a wedding, join one with an invite code, submit an RSVP, or contact support.

Wedlog is published on Google Play; the iOS release is still pending. This policy describes the implemented service as of the date above.

1. Who is responsible for your data

The data controller is Marc Widmer, a natural person operating Wedlog from Spain.

For privacy questions or to exercise your rights, email support@wedlog.app. There is no appointed Data Protection Officer.

2. What Wedlog does not collect

Wedlog has no email-and-password accounts, public user profiles, advertising, tracking pixels, or advertising identifiers. Analytics and crash reporting are on by default at the Anonymous level and can be turned off in Settings; see the sections below. The public website does not set analytics or advertising cookies. Wedlog does not request device-location permission or collect precise GPS location, but Analytics derives approximate location from the network request as described below. Wedlog does not offer photo uploads.

3. Data we process and why

Installation identity and security

When the app starts, Firebase Authentication creates an anonymous installation identity. Wedlog and Firebase also process technical installation identifiers, authentication credentials, device and app information, and security logs. These let the app remember which weddings your installation can edit or has joined, enforce access rules and rate limits, and protect the backend.

To restore your weddings when you reinstall the app on a device where this identity survives, Wedlog also keeps a private server record of the weddings your installation has joined: the installation identifier, the wedding ID, when it joined, and a deletion date. After a reinstall, the app uses it, together with the weddings your installation owns or edits, to bring them back without the invite codes. Individual records are never shown to the couple, guests, or other installations: the wedding’s editors only see how many installations have joined it in total. The record does not grant access to any wedding and is not used for analytics. Leaving or removing a wedding in the app deletes its record.

So that you can get your weddings back after reinstalling the app on the same device even if the installation identity is lost, the app keeps a random recovery key on your device (in the Google Play services Block Store on Android, which survives a reinstall while Google backup is on, and in the iOS Keychain). Wedlog keeps only a one-way hash of that key with your installation identifier, when it was created and last used, and a deletion date. The app sends the key to the server at most once a day to keep it valid and, after a reinstall, to get the same installation identity back. The key is never shared with the couple, guests, or other installations, is not copied to other devices, and is not used for analytics.

If your installation can edit a wedding or asks to edit it, the app also stores your device’s model name (for example “Pixel 8 Pro” or “iPhone 16”) with that wedding, so its owners can tell those installations apart, decide on a request and remove editing access. Only the wedding’s owners see it; it is never collected from other guests and is not used for analytics.

The legal bases are providing the service you request and taking steps at your request (Article 6(1)(b) GDPR) and Wedlog’s legitimate interest in keeping the service secure and reliable (Article 6(1)(f)).

Wedding details

If you create or edit a wedding, Wedlog stores the couple’s names, date and time, time zone, venue name and address (as text; Wedlog does not store venue coordinates), Google place identifier when selected, up to two couple contact phone numbers, invite code, editor installation identifiers, acceptance time, and the accepted Terms version. Guests who know the invite code can see the active wedding details, including any contact phone numbers the couple chooses to share.

This processing is necessary to provide the wedding service (Article 6(1)(b)). Access controls, invite-code abuse prevention, and moderation also rely on Wedlog’s legitimate interests (Article 6(1)(f)).

Gift information

A couple can optionally add an IBAN, the account holder’s name, and a short gift message to their wedding, which are then shown to guests who know the invite code. Wedlog only stores and displays this text; it does not process any payment or transfer itself, and guests send gifts through their own bank outside the app.

This is a feature the couple actively chooses to use (Article 6(1)(b)). Because an IBAN and account holder name are financial information, only add them if you are comfortable sharing that information with everyone who has the invite code.

Venue search

When a wedding creator types a venue search, Wedlog sends the search text from a protected server function to Google Places and returns a small set of venue suggestions. Wedlog stores only the venue information the creator selects or enters; it does not store the unselected search results as wedding data. Google processes the request under its own service terms and privacy policy.

These requests provide features explicitly used by you (Article 6(1)(b)).

RSVP responses, including children’s names and dietary needs

The current app asks for the respondent’s name and attendance and lets the respondent optionally add one adult companion’s name and up to ten children’s names. If the couple enables the relevant questions, an RSVP can also contain dietary needs (including a free-text field used for allergies, intolerances, or other details) and a transport-mode choice. It also contains the respondent’s installation identifier and timestamps needed for ownership and deletion. Current wedding editors can see responses for wedding planning and can export the RSVP dashboard as a CSV file to a destination they choose through the device share sheet.

When the couple enables accommodation, current app and web forms ask attending guests to choose Yes or No for their whole party, including children. Older responses may have no answer. If the couple turns the question off, stored accommodation answers are hidden from them and may reappear if it is turned on again. Accommodation answers follow the same deletion and retention rules as the rest of the response.

The companion, children, transport, and dietary fields are optional as described above. A dietary-needs answer other than “none” may reveal a health condition or a religious or ethical choice, which can be a special category of data under EU law. Before it is saved, Wedlog requires the respondent to confirm a short, dietary-specific consent statement covering the adults and children in that response. The legal bases for dietary information are your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR), which is recorded as a timestamp and which you can withdraw by editing or deleting the response. Transport and accommodation information and the respondent’s, companion’s, and children’s names rely on the legitimate interest of the adult, the couple, and Wedlog in organizing attendance with strictly limited data and short retention (Article 6(1)(f)).

The compatible RSVP data model can still read earlier accessibility-accommodation details and an additional-message field. The current app does not ask either question and removes those values when it saves a current response. Any earlier accessibility detail may reveal health information and should be deleted if it is no longer needed.

An adult respondent supplies children’s names. Wedlog asks only for a name—no date of birth, contact detail, health information, or account is requested for a child. The adult must have authority to provide that information. The basis is the same legitimate interest described above (Article 6(1)(f)). Because children deserve specific protection, you may ask for a child’s name to be removed at any time.

Recovery codes for website RSVPs

An RSVP recovery code links one browser-submitted response to your current anonymous Wedlog app installation. The app only accepts the code; it does not generate recovery codes. Anyone with the current code can take control of that response. Linking consumes the code and does not issue a replacement. A new code requested from the controlling browser before linking invalidates the previous code. The code grants no account, wedding membership, ownership or editor rights. Wedlog stores only a keyed digest and technical response references. Unused codes expire with the response, 30 days after the wedding, and are invalidated on deletion. Wedlog cannot reveal or reset a lost code or recover the app installation’s response if that identity is lost after linking.

Optional recovery-code email

You may optionally provide an email address to receive the recovery code shown after your RSVP. The address is not part of your RSVP, is not shown to wedding editors and does not create an account or provide access by email. You can answer without email and save the code yourself. Wedlog sends the address and current code to Resend only for this requested transactional email, based on Article 6(1)(b) GDPR. Open and click tracking are disabled. Wedlog does not store the address or plaintext code in its database or application logs; it keeps keyed request fingerprints for 24 hours to prevent duplicate sends, and keyed daily rate-limit records until their expiry. Resend retains email content and delivery logs for 30 days; your email provider and mailbox retain the message under their own settings. Failed email delivery does not undo your RSVP.

Updates and push notifications, including broadcast messages

Wedlog processes Firebase installation and messaging identifiers and a wedding topic subscription to deliver wedding updates. In addition to structured updates (for example, a changed date or venue), an editor can send a free-text broadcast message of up to 280 characters, which current wedding editors and guests can read in the app; any current editor can retract a broadcast message at any time. A broadcast message’s text is never included in the push-notification payload itself—only a generic, translated notification is sent, and the message content is read in the app. The app does not use notifications for advertising. You can disable notification permission in your device settings and leave a wedding to stop its topic subscription.

The basis is providing the requested wedding service (Article 6(1)(b)) and the user-controlled device permission. Security and delivery reliability rely on legitimate interests (Article 6(1)(f)).

Crash diagnostics

Crash reporting is on by default (Settings → Data collection: Anonymous); the app does not ask on first run, and a line on the welcome screen says it can be turned off. While it is on, Google Firebase Crashlytics receives crash traces, installation identifiers, app version, operating-system and device details, technical state, and logged diagnostics. Wedlog’s logging rules prohibit intentionally sending invite codes, notification tokens, or personal form contents to Crashlytics.

The legal basis is Wedlog’s legitimate interest in keeping the app stable and fixing errors (Article 6(1)(f) GDPR). You can object at any time by setting Data collection to Off in Settings; crash reporting stops from the next app launch.

Product analytics

Wedlog collects Firebase Analytics data by default (Settings → Data collection: Anonymous). While it is on, the app sends five aggregate events — wedding_created, wedding_joined, rsvp_submitted, wedding_deleted, and wedding_reported — and screen_view events without personal content for navigation destinations. Those event payloads contain no wedding IDs, Firebase Authentication user IDs, names, invite codes, or RSVP content. The Firebase Analytics SDK automatically creates and uses an app-instance identifier and processes device/app information; Google also derives approximate location, such as country and city, from the request IP address and discards the raw IP address before logging it. The purpose is to understand aggregate product usage and improve Wedlog. The legal basis is Wedlog’s legitimate interest in understanding aggregate use to improve the app (Article 6(1)(f) GDPR); you can object at any time by setting Data collection to Off in Settings, which stops collection at once.

Safety reports, in-app feedback, and support messages

If you report a wedding or an individual broadcast message, Wedlog stores the selected reason, optional text of up to 500 characters, the wedding ID (and the message ID for a message report), your reporter installation identifier, status, and timestamps in a server-only collection. Reports are not shown to the couple or guests. Do not include unnecessary sensitive information in free text.

If you use the in-app feedback form, Wedlog stores the selected category, your message of up to 1,500 characters, your installation identifier, status, and submission time in a server-only collection. Do not include unnecessary sensitive information. This supports the request you choose to submit and Wedlog’s legitimate interest in improving and supporting the service (Article 6(1)(b) and Article 6(1)(f)).

If you email support, Wedlog processes your email address, message, wedding ID, installation ID, and any information you choose to include to answer the request. The in-app support contact can prefill the app version and build, device model, operating-system version, installation ID, and active wedding ID; you choose whether to send that draft and may add screenshots manually. The bases are handling your request (Article 6(1)(b)) and the legitimate interest in operating, supporting, and moderating the service (Article 6(1)(f)). Legal obligations may also apply (Article 6(1)(c)).

This website

Firebase Hosting processes request IP addresses and standard request information to deliver and protect this website. Invitation pages let you submit an RSVP using a Firebase anonymous browser identity stored for the current browser tab; if session storage is unavailable, the identity stays only in memory. Only authentication credentials and a technical submission marker without answers use session storage. Unsent answers, email addresses and displayed recovery codes stay in page memory and are cleared when you leave. There is no website analytics, advertising, persistent answer storage or offline submission queue. The browser form creates a response; editing and deletion take place in Wedlog after recovery, or you can contact support.

4. Who receives data

Wedlog uses these providers:

• Google LLC and its affiliates: Firebase Authentication, Firestore, Cloud Functions, Cloud Messaging, Crashlytics, Firebase Analytics/Google Analytics, and Hosting; and Google Places for venue search.
• Resend processes optional recovery-code emails and delivery logs in the United States. Its data-processing agreement includes Standard Contractual Clauses for applicable international transfers. Your mailbox provider also receives the email.
• Email providers involved in support: Proton handles email sent to support@wedlog.app; your own email provider processes the message as well.

Wedding details and RSVP responses are also disclosed to the current editors of that wedding as described above. Wedlog does not sell personal data and does not share it for behavioural advertising.

5. International transfers

Google may process data outside the European Economic Area. Its cloud data-processing terms provide transfer mechanisms including the European Commission’s Standard Contractual Clauses where required. Email may pass through infrastructure in other countries depending on the sender’s provider. Resend processes recovery-code email data in the United States under the Standard Contractual Clauses.

You can ask for more information about the applicable safeguards by contacting support.

6. How long data is kept

• Wedding data remains while the wedding exists. Its owner can permanently delete the wedding in the app; this cascades the wedding, invite-code reservation, updates (including broadcast messages), and RSVP responses. Wedlog may also delete illegal, abandoned, or suspended content when justified.
• RSVP responses become unreadable at the wedding date plus 30 days and are scheduled for automatic physical deletion by Firestore. The respondent can delete a response earlier.
• Wedding restore records are deleted when you leave or remove the wedding in the app or when the wedding is deleted, and are otherwise scheduled for automatic deletion by Firestore 30 days after the wedding date, following any date change. A technical sync counter without wedding data is kept as long as the anonymous installation identifiers.
• Recovery key records are refreshed at most once a day while the app is used and are scheduled for automatic deletion by Firestore 13 months after their last use.
• Device model names are deleted when a request to edit is cancelled or decided, when editing access ends, or when the wedding is deleted, and are otherwise scheduled for automatic deletion by Firestore 30 days after the wedding date. A denied request keeps only its count and the date from which a new request is allowed, without the device model.
• Recovery-code email request fingerprints are kept for 24 hours to prevent duplicate sends.
• Daily recovery-code email rate-limit records are kept until the limit window expires.
• Safety reports are kept for no more than 12 months, unless a longer period is necessary for an active legal claim or statutory duty.
• In-app feedback currently has no automatic expiry configured. It is kept until manually deleted when no longer needed for product support or improvement; you may request earlier deletion through support.
• Crashlytics data is retained by Firebase under its published retention schedule; Google currently states that crash traces and associated identifiers are kept for 90 days before deletion begins.
• Analytics data is retained according to the setting configured for Wedlog’s Google Analytics property. Google currently documents 2 or 14 months for user-level data and 2 or 14 months for event-level data in standard properties; aggregated reports are treated separately. See Google’s published Analytics retention terms.
• Firebase Hosting IP data is retained by Google for a few months under its published Firebase privacy information.
• Support correspondence is kept only as long as needed to resolve the request and document any resulting legal or security action.
• Anonymous installation and messaging identifiers remain while needed to operate the installation and its memberships, subject to provider deletion windows after a deletion request.

Backups and provider deletion queues can take additional time to expire securely.

7. Your choices and rights

You can edit or delete your RSVP in the app, leave a wedding, disable notifications at operating-system level, and set Data collection to Off or Anonymous in Settings. A wedding owner can delete the wedding in the app.

Under the GDPR, where applicable, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent where processing relies on consent; withdrawal does not affect earlier lawful processing. Some rights depend on the legal basis and circumstances.

Email support@wedlog.app and include the wedding ID and installation ID shown in the app’s Settings. Wedlog may ask for proportionate information to verify that the request concerns your installation or data. Requests are normally answered within one month.

You may complain to the Spanish Data Protection Agency (AEPD) or the supervisory authority where you live or work. For a complaint about an unanswered rights request, contact Wedlog first so the request and response can be evidenced.

8. Children

Wedlog is a wedding utility, not a service directed at children. A child should not independently create or administer a wedding. An adult may include a child’s name in an RSVP only when authorized to do so. The name is visible only to current wedding editors, is used for attendance planning, and follows the same 30-day post-wedding deletion rule as the rest of the response.

To remove a child’s name sooner, delete or edit the RSVP or contact support.

9. Security

Wedlog uses encrypted network connections, Firebase-managed encryption at rest, anonymous authentication, server-side access rules, rate limits, private RSVP documents, and server-only moderation reports. No online service can guarantee absolute security. If you believe data has been exposed, contact support promptly and do not include secrets in the initial message.

10. Changes to this policy

The current version is always published at this URL. Material changes will update the date and version and, when appropriate, will be communicated in the app. The version recorded when a wedding is created identifies the legal documents accepted at that time.