Privacy Policy

Information provided by organizers and guests

Organizer accounts include sign-in email addresses, organization details, roles, event settings, and content you upload. Event information can include venue addresses, agendas, meals, session choices, and messages.

Invitations and responses can include names, email addresses, attendance decisions, additional guests, organization names, age-related information when configured, meal selections, allergies, dietary preferences, custom-question answers, and feedback. Only provide information relevant to your event. Organizers decide which questions and event features to use.

Tickets, devices, and account security

When check-in is enabled, we process ticket identifiers and scan records. Wallet updates can require pass identifiers, device registrations, and push tokens. Passkeys use your device’s authentication system; private passkey credentials and device biometrics are not provided to us. Account sessions, access checks, and security records help protect the Service.

How information is used

We use information to operate accounts, provide event workflows, deliver invitations and updates, recover invitation links, generate tickets, process organizer billing, support users, measure service usage, and address fraud or abuse. Guest information is shared with the event organizer and authorized team members or collaborators according to the event’s permissions. Contact your organizer about changes to your event response or event-specific questions.

Service providers and public sharing

We use service providers for hosting, database and authentication services, storage, email delivery, and payment processing. These include Cloudflare, Supabase, and Stripe. Apple and Google receive information needed for Wallet features you choose to use. Map providers receive requests when maps or map links are opened. Payment card details entered into Stripe’s payment flow are handled by Stripe.

Organizers can make event information public through registration links or public event listings. Private invitation and ticket links should be kept confidential. We may disclose information when required by law or reasonably necessary to protect people, investigate abuse, or secure the Service.

Website analytics and browser storage

Rybbit measures use of public marketing pages and selected activation actions, such as creating an event, submitting an RSVP, and synchronizing a successful scan. Public-page analytics can include page paths, referral or campaign information, browser/device details, and analytics identifiers. Product activation events use generic route names and do not include guest names, email addresses, or private invitation tokens.

The Service uses browser storage for account sessions, preferences, and offline check-in where applicable. Cookieless analytics does not mean the Service avoids all browser storage. Hosting and analytics systems may also process technical network information needed to receive requests.

Retention and your choices

Information is retained as needed to provide the Service and meet operational, security, billing, and legal needs. Retention depends on the type of information and the event or account context. You may ask for access, correction, deletion, or other applicable privacy rights by contacting support. We may need to verify your identity and coordinate with your event organizer. Some information may need to remain for legal or security reasons.

You can choose not to answer optional questions, contact the organizer about information collected for their event, cancel a subscription through Billing, and manage Wallet passes through your device. Where you have rights under applicable privacy law, those rights are not limited by this notice.

Children and information about guests

Organizer accounts are intended for people with authority to manage an event. Organizers are responsible for obtaining appropriate permission when providing information about children or other guests. Contact support if you believe information has been supplied without the required permission.

Security and international processing

We use access controls and other safeguards to protect information, but no system can guarantee absolute security. Service providers may process information in countries different from your own. Contact support with questions about the handling of your information.

Changes to this notice

We may update this notice as our services and practices change. The date above shows the current version. Material changes may be communicated through the Service or by email.