Privacy

Petalpost has no accounts and no cookies. This page lists every place your data goes.

Last updated: 14 November 2026.

What you type and upload

The editor runs in your browser. Your invite text stays there until you publish the invitation. Your photo is never sent to us.

Your photo is saved in your browser's local storage so it survives a reload. It stays on your device. Remove it with "Use the illustration instead" in the editor or by clearing site data in your browser.

A share link stores the invite text, template and color after the # in the link. Browsers do not send that part of a link to any server. Anyone who has the link can read the invite, so share it only with people you invite.

Published invitations and replies

When a host clicks "Publish", Petalpost stores the invitation text, the template and the accent color. The photo and its position stay in the host's browser.

When a guest replies, Petalpost stores the name the guest enters, the answer and the party size.

Petalpost also stores when each invitation and each reply was created and last changed.

Petalpost limits how many invitations one connection can publish per day. For that limit it stores a count with a hash of the IP address and a random value that Petalpost makes each day. During that day, someone with access to the database could find the address by hashing every possible address with the random value. Counts and random values from earlier days are deleted when the next invitation is published.

Private links

Publishing gives the host a management link. Anyone with it can see every reply and delete the invitation. Replying gives the guest an edit link. Anyone with it can see and change that one reply. Anyone with the invitation link can read the invitation and send a reply.

The secret part of a private link comes after the #. Browsers do not send that part of an address to any server. The page sends the secret in a request header to prove access, and Petalpost stores only a hash of it. Petalpost therefore cannot recover a lost link.

When the host clicks "Publish", the editor saves the management secret in the browser's local storage, so the editor can publish changes after a reload. Clearing site data in the browser removes it. The management link still works if the host saved it. The page saves nothing in a guest's browser, but the edit link stays in the address bar and in the browser history.

Deletion and retention

The host deletes the invitation from the management page. That removes the invitation and all its replies. Petalpost does not delete invitations or replies automatically, so they stay until the host deletes them. A guest can change a reply but cannot delete it, so ask the host to delete the invitation if you need your reply removed.

Storage

Published invitations, replies and the daily counts are stored in a Postgres database run by Neon, which Petalpost uses through Vercel's Neon integration. Only Petalpost's server code connects to it.

Hosting

Vercel Inc. hosts the site and runs the server code that stores published invitations and replies. When your browser requests a page, Vercel receives your IP address and browser details, because it needs them to deliver the page. Vercel keeps request logs for a short period for security and operation. Vercel acts as our processor under its data processing addendum. Vercel is in the United States and is certified under the EU-U.S. Data Privacy Framework.

Visitor statistics

We use Vercel Web Analytics to count page views. It sets no cookies and stores nothing on your device. Vercel identifies a visit with a hash of the request that resets every 24 hours and does not store your IP address. We see only totals, such as page views, referrers, countries and browser types. The page addresses sent to analytics leave out the part after the #, so private links never reach it.

The legal basis is our legitimate interest in knowing which pages people use (Article 6(1)(f) GDPR).

Links to other services

The "Open map" button on an invite opens Google Maps with the event address. Google receives the address and your request only if you click it, under Google's privacy policy.

Fonts and scripts are served from our own domain. No page loads anything from Google or another third party.