Privacy Policy

1. Information we collect

When you create an account

• Name and email address.
• Password. We never store your password itself, only a salted, one-way hash of it.

What you add to S’more Plans

• Plans: titles, dates, locations, descriptions and helpful links.
• Calendars you create, and who you approve to see them.
• RSVPs: your reply, number of extra guests, and what you’re bringing.
• Messages you post on a plan.
• Photos you upload. Photos are stored as uploaded, so any information embedded in the file by your camera or phone (such as the date or location it was taken) stays with it.
• Reports you send us about content or behavior.
• Email addresses you enter to email an invitation to someone. We use them only to send that invitation, and we show them to you in the plan’s invite list.
• S’mores recipes you share publicly, any photo you add to them, and which recipes you “love”. Before saving a recipe photo, we remove the hidden details cameras and phones embed in photos, such as the location and camera model.
• Your S’more Me picture: the face parts you pick, and a photo if you upload one. Photos are shrunk on your device before they upload, and we remove hidden location and camera details before saving them.
• Memories you share publicly on the Memories page, any photo you add, and which memories you heart. We remove the same hidden photo details before saving.

When you reply to an invite without an account

• The name you enter, your reply, number of extra guests and what you’re bringing.
• A random identifier stored in a cookie on your browser, so you can change your reply later. We keep only a one-way hash of it.

Technical information

• To stop password guessing and spam, we count recent attempts per IP address. We store only a one-way hash of the IP address combined with the action, and these counters are deleted automatically, generally within a day.
• Our hosting provider, Cloudflare, processes standard request information (such as IP address, browser type and the pages requested) to deliver the site, keep it secure, and produce error and performance logs.

How you found us

If you arrive from a link that carries a campaign tag (for example, one of our posts) or from another website, your browser remembers that source for up to 30 days (in browser storage, not a cookie), and we save it with your account if you sign up, so we can tell which of our posts are useful. We count visits from each source as daily totals only.

We do not use advertising or analytics cookies, and we don’t track you across other websites.

2. Cookies

S’more Plans uses only the cookies it needs to work:

• Sign-in cookie: keeps you signed in for up to 30 days, or until you sign out.
• Guest reply cookie: lets someone who replied to an invite without an account update their reply from the same browser. It lasts up to one year.

3. How we use information

• To run S’more Plans: show your calendars and plans, deliver invitations, and record RSVPs, messages and photos.
• To send service emails: confirming your email address, password resets, join requests and approvals, RSVP notices for plans you host, and invitations a host asks us to email. Invitation emails come from a no-reply address, name the host, and include a one-click unsubscribe.
• To help you invite people: if you import a contacts file or pick from your phone’s contacts, it is read on your device and we never receive your address book. Only the addresses you choose and send an invitation to are stored, and we show you the people you’ve invited before so you can invite them again.
• To send plan updates: when a host changes or cancels a plan, or photos are added, we email people on that plan who have an account and replied Going or Maybe (you can turn these off in account settings). People who were invited by email only hear about date, time or place changes and cancellations, with a one-click unsubscribe. We keep a small record of when we last sent a photo notice so we don’t send too many. We don’t send marketing email.
• To keep your calendar app up to date: if you add S’more Plans to your phone or computer calendar, your calendar app (for example Apple, Google or Outlook) fetches a private link with your plans’ names, dates, times, places, descriptions and hosts. Anyone with an invitation link can also add that one plan to their calendar. Your calendar app’s maker receives that information under its own privacy policy. You can turn your link off or replace it in account settings, and turning off an invitation link removes the plan from calendars that added it.
• To keep S’more Plans safe: preventing abuse, reviewing reports, and enforcing our Terms of Service.
• To comply with the law.

We do not sell your personal information, share it for targeted advertising, or show ads.

4. Who can see your information

• Private by default. A plan you make is visible only to you until you share it or put it on a shared calendar.
• Shared calendars: people you approve can see the calendar and the plans on it.
• Invite links: anyone who has a plan’s invite link can see that plan’s details (title, date, location, description and links), the host’s name, and the names, replies, guest counts and “bringing” notes of people who have replied. Share invite links only with people you want to see them. You can turn a link off at any time.
• Photos and messages on a plan are visible only to signed-in people with access to that plan, not to people viewing through an invite link.
• Your name appears to people you share plans or calendars with, and to hosts of plans you join.
• Community recipes are public. Anyone, with or without an account, can see a recipe you share, its photo, and your first name and last initial. How many people loved a recipe is public; who loved it is not.
• Your picture: a built S’more Me face can appear anywhere your name does, including public recipes, memories and invitation pages. A photo avatar is shown only to you, to people who share a plan or calendar with you, and to our team when reviewing a report; everywhere else shows your built face or your initial.
• Memories are public. Anyone can see a memory you share, its photo, where and when you say it happened, and your first name and last initial. How many hearts it has is public; who hearted it is not.
• Your chosen look: invitation pages you send show the look you picked for your account.
• Emailed invitations: when you email an invitation, the recipient sees your name, the plan details and your optional note. Your own email address is not shared with them.

5. Service providers and other sites

• Cloudflare hosts S’more Plans and stores our database, photos and outgoing email on our behalf.
• Google. When a plan has a location, your browser loads a Google map of it, and pages load fonts from Google Fonts. Google receives standard request information (such as your IP address) when this happens and handles it under its own privacy policy.
• Links you follow: links in plans and the “explore nearby” shortcuts open other websites (such as Google Maps) that have their own privacy practices.

We may also disclose information if required by law, to protect the safety or rights of our users or others, or as part of a merger or sale of the service (in which case this policy would continue to apply to your information).

6. Keeping and deleting information

• We keep your information while your account is open.
• Download: in account settings, “Download my data” gives you a copy of your account, plans, calendars, RSVPs, messages and photo list.
• Delete: in account settings, you can permanently delete your account. This deletes your account, every plan and calendar you host (with their photos and messages), and your photos, RSVPs and messages elsewhere.
• Hosts can delete plans, photos and messages on their plans, and remove guests. Guest replies are deleted when the plan is deleted.
• You can delete a recipe you shared at any time, and deleting your account deletes all your recipes, their photos and your loves.
• You can change or remove your avatar photo at any time on the S’more Me page, and deleting your account deletes it. We may remove an avatar photo that breaks our Terms.
• You can delete a memory you shared at any time, and deleting your account deletes your memories, their photos and your hearts. We may hide a memory that breaks our Terms.
• Addresses you emailed invitations to are deleted with the plan or your account. If someone unsubscribes from invitation emails, we keep only a one-way scrambled code (a hash) of their address, so we can honor that choice without keeping the address itself.
• Deleted information may remain in encrypted backups for up to 30 days before it is gone for good. Reports you’ve sent may be kept for safety records, without your account attached.

7. Your rights and choices

You can view, download and delete your information yourself as described above, or email hello@smoreplans.com to ask us to access, correct or delete it. We’ll respond within a reasonable time and won’t treat you differently for asking. Depending on where you live, including California, you may have additional rights under local law, and we will honor them as required.

Do Not Track: because we don’t track you across websites or use advertising cookies, S’more Plans works the same whether or not your browser sends a Do Not Track signal.

8. Children

You must be at least 13 to create an account. We don’t knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, email hello@smoreplans.com and we will delete it.

9. Security

Passwords are stored as salted one-way hashes, all traffic is encrypted with HTTPS, sign-in cookies can’t be read by page scripts, plan photos are served only to people with access to the plan, and public photos (like recipes and memories) have hidden location and camera details removed. No system is perfectly secure, so please use a strong password you don’t use elsewhere.

Found a security problem? Please email abuse@smoreplans.com. Our contact details for security researchers are also published at /.well-known/security.txt.

10. Changes to this policy

If we change this policy, we’ll update the effective date above. If a change is significant, we’ll also let you know by email or with a notice in S’more Plans before it takes effect.

11. Contact

Fatt Corporation · S’more Plans · hello@smoreplans.com