BashPal Privacy Policy

Last updated: October 1, 2026 (v6)

This Privacy Policy explains how AAAHAR Software Services Inc. ("AAAHAR", "we", "us") collects, uses, and shares information when you use the BashPal mobile application (the "App"). BashPal helps people plan a celebration, invite guests, collect RSVPs, and coordinate gifts, food, and messages. BashPal is the product name; AAAHAR Software Services Inc. is the company that operates BashPal.

Quick summary

• We collect the minimum data needed to run the App: a host account, the event details a host enters, and the name and contact detail a guest chooses to share when joining a party.
• Hosts must provide a backup phone number to finish host setup so BashPal can text a recovery code if they cannot use email sign-in. Twilio delivers those SMS recovery codes. Account settings let a host save or replace that number; the App does not offer a clear/remove control for it.
• Guests do not need an account. A guest joins with a party code, a name, and one phone number or email address.
• We do not sell personal information.
• We do not use data for cross-app advertising "tracking" (as defined by Apple), and the App contains no advertising, analytics, or crash-reporting SDKs.

Who this applies to

Information we collect

1) Host account information

To host a party you sign in with your email address. We send a one-time sign-in code to that address and store your email and an optional display name to manage your account. We do not store passwords.

Completing host setup also requires a backup phone number for SMS account recovery. We store that number on the host profile so we can look up the account when the host requests a recovery code. The number is used only for sending BashPal recovery codes (not for marketing). Twilio sends those SMS messages. Recovery codes expire shortly after they are issued. In Account settings a host can save or replace the backup phone number; the App does not provide a way to clear it while the account remains active. The backup phone number is removed when the host deletes the account.

2) Party content entered by the host

Party title, date and time, location, honoree name, host name, notes, budget and expense entries, menu and shopping list, schedule, games, gift registry items, potluck dish slots, and invitation settings. AI-generated plan suggestions are stored with the party so the host can edit them.

3) Guest information

When a guest joins a party they provide a display name and one contact detail (a phone number or an email address). We store this on the host's guest list together with anything the guest chooses to add: RSVP status and headcount, dietary notes, messages posted to the party, potluck dish claims, and gift registry reservations. Guest contact details are visible to the party's organizers and are not verified identities.

4) Push notifications

If you allow notifications, we store a device push token so we can deliver party updates (for example, a new message or RSVP change). Notification content may include a sender's name and a short excerpt of a message. You can turn notifications off in your device settings at any time.

5) Local device storage

The App stores a small amount of data on your device to keep you signed in and to remember which parties you have joined: your host session, a guest access token for each party you joined as a guest, and in-progress plan drafts. Guest access tokens are kept in the device’s secure storage (for example Apple’s Keychain / Android Keystore via Expo SecureStore). How long that secure storage survives an uninstall or OS reset depends on the operating system and device settings — uninstalling the App does not always wipe every secure item. On the browser Guest Hub (bashpal.aaahar.ca/join), invitation session data is stored in the browser’s local storage for that site. Use Forget this invitation on the Guest Hub (or leave/forget the party in the App) to remove a saved invitation from that device or browser.

6) Purchases

The first hosted party is free. Additional parties require a one-time party credit or an active BashPal monthly subscription. Purchases are processed by Apple (App Store) or, when enabled, Google (Google Play). We receive purchase and entitlement status (for example, "credit available" or "subscription active") to unlock hosting. We do not receive your payment card details.

7) What we do not collect

• No advertising tracking, no advertising identifier (IDFA), no third-party advertising SDKs.
• No analytics or crash-reporting SDK data in the App unless we explicitly add it and update this policy.
• No precise location, and no access to your contacts, photos, camera, or microphone.
• Hosting logs for this web page: this policy page may include basic traffic logging from our hosting provider. This is separate from the App.

AI-generated suggestions

When a host asks BashPal to generate a party plan, we send planning information such as party type, guest count, event duration, serving time, vibe, budget, cuisine preferences, whether children are attending, alcohol preferences, potluck preferences, and event date to OpenAI to produce suggestions. We do not send names, email addresses, phone numbers, guest lists, or messages to OpenAI. Suggestions are ideas only; hosts must review food suggestions for allergies, health, cultural, and religious needs.

How we use information

• Provide and operate the App (sign-in, party creation, invitations, RSVPs, messages, coordination features).
• Send invitation and sign-in emails, SMS recovery codes when a host uses backup-phone recovery, and party notifications you opt into.
• Operate hosting entitlements: one free Baby Shower, then unlock additional hosting after a verified store purchase or restore.
• Maintain security, prevent abuse (including short-lived rate limiting that stores hashed request identifiers rather than raw email or phone where practical), and enforce our terms.
• Provide customer support and comply with legal obligations.

How we share information

We share information only in these cases:

• Within a party. A host sees their guest list, including guest names, contact details, RSVPs, and dietary notes. Guests of the same party see each other's names on messages, potluck claims, and similar shared features, but not other guests' contact details.
• Service providers who process data for us under contract and only to operate the App: Supabase (hosting, database, authentication), Postmark (sending invitation and sign-in emails), Twilio (sending host SMS recovery codes to the backup phone number a host saved), OpenAI (plan suggestions, planning parameters only), Expo (push notification delivery), and Apple / Google (in-app purchase verification).
• Platform providers (Apple App Store / Google Play) for purchase processing and compliance.
• Legal and safety when required by law or to protect users, AAAHAR, or the public.

We require our service providers to protect personal information in a manner consistent with this Privacy Policy and applicable privacy law.

We do not sell your personal information.

Data retention

• Party data (including guest information) is kept while the party exists. When a host deletes a party, its guest list, RSVPs, messages, claims, and reservations are deleted with it.
• Host account data (including the backup phone number required for host setup) is kept while your account is active and removed when you delete your account (see below). Account settings allow saving or replacing the backup phone number, not clearing it.
• Sign-in and recovery codes (email or SMS) expire shortly after they are issued and are not retained as reusable credentials.
• Local device data remains on your device until you sign out, clear app data, use Forget this invitation / leave the party, or uninstall the App. Secure-storage guest tokens may persist according to the operating system’s secure-storage behavior. Browser Guest Hub sessions remain in that browser’s local storage until forgotten or cleared.

Your choices

• Guests: you can update your RSVP, notes, claims, and reservations in the App or Guest Hub. Use Forget this invitation on the Guest Hub (or leave/forget the party in the App) to remove the saved invitation from that browser or device. To be removed from a party’s guest list, ask the host — hosts can remove any guest from the guest list. You can also contact us (below) to request removal.
• Hosts: you can edit or delete any party you own. You can delete your account from Settings after transferring or deleting the parties you host; this removes your account and its memberships. You can also request account deletion at bashpal.aaahar.ca/delete-account or by emailing privacy@aaahar.ca.
• Notifications: manage in your device settings.
• Access or deletion requests: email privacy@aaahar.ca from the email address on your account (hosts) or with the party code and the name you joined with (guests). We typically respond within 30 days.
• Correction: if personal information we hold about you is inaccurate or incomplete, you can ask us to correct it by emailing privacy@aaahar.ca.
• Complaints: if you have a concern about how we handle your personal information, contact our Privacy Officer at privacy@aaahar.ca. We will investigate and respond. If you are not satisfied with our response, you may also contact the Office of the Information and Privacy Commissioner for British Columbia.

Security

We use reasonable administrative, technical, and organizational safeguards to protect information, including encrypted connections and access controls on our database. No method of transmission or storage is 100% secure.

Children's privacy

BashPal is not directed to children under 13. You must be at least 13 to use BashPal. If you believe a child under 13 has provided personal information, contact us and we will take steps to delete it.

International users

AAAHAR is based in British Columbia, Canada. Information is processed in Canada and in the countries where our service providers operate (including the United States). By using the App you consent to this processing.

Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "Last updated" date above.

Contact us

Privacy Officer
AAAHAR Software Services Inc.
Email: privacy@aaahar.ca
Website: https://aaahar.ca