Privacy policy

What we process

• Accounts: your name, email address, account identifier and sign-in information. We store password hashes when password sign-in is used, and session information such as IP address and device/browser information for account access and security.
• Guestbooks: event titles, partner names, venue details, wedding ZIP code, optional venue coordinates, time zone and event times; guest names and phone numbers; permission confirmations, call and text delivery records, and guestbook activity.
• Media and files: photos, microphone recordings, uploaded audio and guest lists, file metadata, recorded guest messages, and the films and download archives made from that content.
• Optional location: when a guest chooses nearby discovery, the app sends the available approximate or precise location and accuracy to find callable weddings. These guest location fixes and name-search queries are processed for that search and are not saved to the guestbook database. A host can separately choose to save a venue location as part of the event.
• Billing and referrals, when enabled: billing name and address, payment-provider identifiers, card brand and last four digits, approved purchases and upgrades, discount and referral codes, partner profiles, commission records, and payout preferences. Square collects card details through its secure payment fields; we do not store card numbers or security codes. Bank or prepaid-card details submitted on Tremendous are handled by Tremendous.
• Account security: your verified mobile number, verification-attempt records, encrypted authenticator secrets, hashed recovery codes, and trusted-browser records. Twilio receives your number to check mobile line type and send security codes. Each number can belong to one account. Security codes are separate from event reminders and are not used for marketing.
• Experience measurement: our website counts sample plays, plan selections and similar steps using a random identifier scoped to your browser tab. Counts contain no contact details, recordings or photos. We record broad sources such as a partner invitation or a social clip. Do Not Track and Global Privacy Control signals disable this optional measurement.

Why we use this information

We use this information to sign you in, manage your guestbooks, find a selected wedding, provide its call-in number and QR code, deliver permitted service messages, process and deliver your keepsake media, provide support, and protect the service against abuse. Account features require sign-in; Guest discovery does not require an account. Location, microphone recording, uploads and guest-list features are optional.

When commercial features are enabled, we also use the information to process purchases you authorize, apply discounts, enforce purchased guest capacity, credit referrals, and issue eligible partner rewards.

Permissions and your choices

Location is requested for nearby wedding discovery and is not used in the background. Denying location leaves name search available. Microphone access is requested when you start recording a greeting. Files and photos are selected using the device’s system pickers. The app does not read your phone’s contacts, SMS messages or call history, and does not place a call automatically. Sharing a QR code opens your chosen app; you choose recipients and send from that app.

Who can receive information

Social clips start private. You can download a selected clip or explicitly enable a viewing link after confirming permission to share the voices and pictures it contains. Anyone with that link can view and save that clip. It does not open your full film, recordings or guest list. Turn sharing off to stop future access through the link; copies already saved by recipients cannot be recalled. Viewing links expire after 90 days or when the event media expires, whichever comes first. Sharing names in the clip is optional.

Event owners and authorized service administrators can access information needed to manage their guestbooks and provide support. Callable weddings’ event and partner names, town, wedding date and distance can appear in Guest discovery; the call-in number is supplied when a wedding is selected. Private guest lists and media are not published in those discovery results.

We use service providers for hosting, storage, calling, texting and email, including Amazon Web Services, Twilio and Resend. They receive the information necessary to provide those functions. Data is processed on our service infrastructure in the United States. Our web pages also request fonts from Google Fonts. The native iPhone and Android apps contain no advertising or analytics SDK.

When billing and partner rewards are enabled, Square receives the billing and card information needed to process approved purchases. Tremendous receives a partner’s name, verified email address, and reward amount to provide payout choices and redemption. Referral partners can see referral counts and their commission records; their portal does not disclose customers’ private guest lists or media. Partners can also see the progress of invitations they send. Referral, cancellation and commission emails include the associated event name.

If you save or share files, the apps, recipients and storage providers you choose receive those copies under their own practices. We may also disclose information when required by law or to protect the service and its users.

Storage, security and retention

The app communicates with the service over HTTPS. Account access controls protect private guestbooks and media. Native sign-in credentials are stored using Android Keystore encryption or the iPhone’s device-bound Keychain. Private temporary media is excluded from backups; Android app backup/device transfer and iPhone Keychain synchronization are disabled.

Media downloads are guaranteed for 90 days after an event ends; scheduled media cleanup occurs six months after the event ends. Account, event, guest contact, delivery and activity records can remain while your account is active, even after media expires. Routine database backups rotate on a seven-day cycle.

Optional website engagement counts are removed after 90 days. Security rate limits use a keyed hash of the requesting network address, separately from engagement measurement.

Free partner events have a one-time eligibility record, including a hashed email and mobile-number identities and the use history. Cancellation and media cleanup do not reset that record. We use it to prevent repeated claims through duplicate accounts or email aliases.

You can request deletion of your account and associated data at any time. In the iPhone app, the account menu lets you submit a confirmed deletion request without sending an email; support completes it within seven days and confirms completion. Minimal records needed to honor text-message opt-outs may remain until you opt back in or the record is no longer needed. Where specific information must be retained for a legal or security obligation, support will explain the applicable reason and retention period when responding to your request.

Access, correction and deletion

You can edit available event details and download available media in your account. To request access, correction, or deletion of your personal information, email support@retroguestbook.com. For account deletion, use the account and data deletion page; you do not need to reinstall the app. We verify ownership before acting on requests.

Children and policy updates

The service is intended for adult event hosts and their guests and is not directed to children under 13. If you believe a child has provided personal information without appropriate permission, contact support. If our practices change, we will update this page and its date.