Privacy Policy

Service: Mommy's Little Party Planner Business: Protocol Media LLC Effective and last updated: July 17, 2026 Contact: zach@protocolmediallc.com

This Privacy Policy explains how Protocol Media LLC ("Protocol Media," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when you use the Mommy's Little Party Planner mobile app, websites, public guest pages, support channels, and related services (the "Service").

Host accounts, party-management tools, and purchases are intended for adults who reside in the United States, the District of Columbia, or Puerto Rico. Invited guests may use shared guest links from other locations where lawful.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. Optional in-app product analytics are off unless the account holder turns them on. The public website may use the cookie-free, anonymized website analytics described below.

1. Information we collect

Depending on how you use the Service, we collect:

Account and legal acceptance information: email address, optional display name, password hash or social sign-in identifier, session records, language, age and service-territory confirmations, and records showing when you accepted the Terms and Privacy Policy. Historical records may retain a previously selected U.S. or Puerto Rico market.
Party planning information: child first name or nickname, age, party date and time, theme, venue and address, budgets, checklists, itineraries, shopping lists, wishlists, invitation text, notes, and thank-you content.
Guest and contact information: guest and parent names, child and sibling first names, email addresses, phone numbers, RSVP status, headcounts, ages, gift information, notes, and other information a host, co-host, or guest chooses to provide.
Consumer health data: allergy and dietary information voluntarily entered for party planning. Our separate Consumer Health Data Privacy Notice describes this data and the related rights and choices.
Contacts you choose to import: the app reads device contacts only after permission is granted and only so you can select people to add. We do not upload the entire address book in the background or write changes back to device contacts.
Photos and uploaded files: party photos, invitation images, and related media that a host or guest chooses to upload.
Purchases and entitlements: product, subscription, Party Pass, transaction status, and entitlement information from Apple, RevenueCat, Stripe, or another applicable payment provider. We do not receive full payment-card numbers.
Optional address searches: venue or address text typed into address autocomplete is sent to Geoapify or the configured map provider to return suggestions. Precise device location is not required.
Support and communications: email address, message contents, and attachments provided to support.
Security and technical data: IP address, request time, route, user agent, app version, device type, locale, time zone, authentication status, logs, errors, and security events.
Public website analytics: when enabled, Vercel Web Analytics records anonymized page views, referring pages, approximate geography, browser, operating system, and device category without using cookies. We do not send party content, guest details, contact information, allergies, photos, or message text to website analytics.
Optional analytics: if the account holder opts in, a first-party random identifier and product-interaction events such as screens or features used. We instruct the app not to include party content, names, contacts, addresses, allergies, photos, or message text in analytics.

We collect information from account holders, guests, co-hosts, the devices they use, service providers involved in transactions or sign-in, and automatically from requests made to the Service.

2. How we use information

We use information to:

create and secure accounts;
provide party planning, syncing, invitations, RSVP, reminders, wishlists, photo, co-hosting, and related features;
display information to the host, authorized co-hosts, or guests as required by the feature they use;
process and restore purchases and entitlements;
provide optional address suggestions and deterministic planning suggestions;
send transactional emails or reminders requested or scheduled by a host;
answer support and privacy requests;
detect fraud, spam, abuse, security incidents, and service failures;
maintain, debug, and improve the Service; and
comply with law and enforce our Terms.

We do not use consumer health data for advertising, profiling, data brokerage, or unrelated product development.

3. Public and shared links

Hosts can create RSVP, wishlist, photo-upload, poll, private Highlight Reel, and shared-plan links. These links are designed to be difficult to guess, but anyone who receives or is forwarded a link may be able to access the information displayed through it. Hosts are responsible for sharing links only with intended recipients.

Public link previews use generic party language and do not intentionally display a child's name, age, venue, or custom invitation image. Published invite links expire after the party date plus approximately 30 days. A host may unpublish a link sooner.

4. How we disclose information

We disclose information only as needed to provide the Service, complete a transaction, follow a user's instruction, comply with law, or protect rights and safety.

Recipients may include:

hosts and authorized co-hosts managing the same party;
guests using a shared party feature;
Vercel and other hosting or security providers;
Supabase and cloud database or object-storage providers;
Resend and other transactional email providers;
Apple, RevenueCat, Stripe, and applicable payment providers;
Google or Apple for social sign-in;
Geoapify or the configured address-search provider;
professional advisers, regulators, courts, law enforcement, or other parties when legally required or reasonably necessary to protect the Service, users, or others; and
a successor involved in a merger, financing, reorganization, bankruptcy, or sale of all or part of the business, subject to applicable law.

We do not sell personal information or consumer health data. We do not share personal information for cross-context behavioral advertising.

5. Retention

We retain information only for as long as reasonably necessary for the purposes described above:

Account information is retained while the account is active and removed when the account is deleted, subject to limited legal and transaction-integrity records.
Active party records are retained while needed by the account holder. When a party is deleted, its substantive planning content is scrubbed from the active server record immediately; a minimal deletion tombstone may remain for up to 30 days so other devices and co-hosts can process the deletion.
Published invite data, guest RSVPs, allergy information, wishlist claims, and related public-link records expire and are deleted after the party date plus approximately 30 days, unless the host unpublishes sooner.
Optional first-party analytics events are retained for up to 90 days.
Sessions expire after approximately 60 days. Password-reset codes expire after 30 minutes.
Completed, cancelled, failed, or skipped reminder job records are generally removed after 30 days.
Managed uploaded files are deleted when the associated party, invite, or account is deleted. If immediate storage cleanup fails, access is revoked and deletion is retried.
Limited purchase, tax, accounting, fraud-prevention, security, dispute, and transaction-integrity records may be retained for the period reasonably required by law or legitimate business need.

Backups may take additional time to cycle out, but deleted information is not restored to active use except when necessary for disaster recovery, security, or legal compliance.

6. Your choices and privacy rights

All users may request access, correction, deletion, or a portable copy of eligible personal information by emailing zach@protocolmediallc.com. You may also:

edit or delete party and guest information in the app;
delete an account from the Account screen;
change contacts, camera, and photo permissions in device settings;
turn optional analytics on or off from the Account screen;
unpublish guest links;
withdraw consent for future collection or sharing of consumer health data and request deletion of that data; and
manage a subscription through the provider that processed the purchase.

State law may provide additional rights. See our Privacy Choices page and Consumer Health Data Privacy Notice. We will not discriminate against you for exercising a privacy right. We may need to verify your identity and authority before completing a request. If we deny a request, you may appeal by replying to our decision with the subject "Privacy Appeal."

7. Children and child-related information

The Service is directed to adults and is not intended for children under 13 to use independently. Only adults may create accounts. Children should not submit information through guest links without a parent or guardian's involvement.

Parents, guardians, and hosts may provide child-related party information. The person providing that information represents that they have authority to do so and is responsible for choosing what to share. If you believe a child submitted personal information without appropriate adult involvement, contact us and we will investigate and delete eligible information.

8. Security

We use administrative, technical, and organizational safeguards designed for the nature of the information we process, including encrypted network transport, salted password hashes, access controls, rate limits, expiring sessions and links, and restricted server-side database access. No system is perfectly secure, and we cannot guarantee absolute security.

9. U.S. processing and service territory

Protocol Media LLC is based in South Carolina. Information is processed in the United States and in other locations where our service providers operate. Host accounts, party-management tools, and purchases are currently offered only to residents of the United States, the District of Columbia, and Puerto Rico. Invited guests may use shared guest links from other locations where lawful.

10. Changes

We may update this Policy to reflect changes to the Service, our practices, or legal requirements. We will update the date above and provide additional notice when appropriate. If a change requires renewed consent, the app will ask for it before continued account use.

11. Contact

Email privacy questions, requests, or appeals to zach@protocolmediallc.com. Include the email associated with the account or enough information for us to identify the relevant guest submission. Do not send passwords or full payment-card numbers.