Privacy policy

Who we are

HeadOnOver is a private event-invitation service operated by HeadOnOver. A host creates an event and chooses who to invite; HeadOnOver emails each invitation on the host’s behalf (or the host sends the private link from their own phone), collects RSVPs, and texts a guest only if that guest asks for texts on their invitation page. This policy explains what we collect, why, and the choices hosts and guests have. Contact us at support@headonover.com.

Information we collect

Hosts: your name, email address, workspace name, sign-in history (when a session was created and last used), and a record of the terms you accepted and when.

Guest contacts a host adds: names, households, mobile numbers, email addresses, and any optional address or private note the host enters. Hosts must only add people they know personally.

Events: the details a host writes (title, date, time zone, place, description, and an optional cover image).

RSVPs: each guest household’s response, head counts, and any dietary or other note the guest chooses to share with the host, plus a history of changes to that response.

Messages: delivery records for each invitation (for example queued, sent, delivered, or failed), replies to our texts such as STOP or HELP, and opt-out records.

Invitation activity: whether an invitation page was opened and when an RSVP was submitted, recorded by HeadOnOver itself. Private invitation pages do not load Google Analytics, and we do not use tracking pixels in email or advertising cookies.

Technical data: like most websites, our servers record IP addresses, browser type, and request times to keep the service secure, limit abuse, and fix problems. Rate-limit records store IP addresses only in hashed form.

How we use it

To run and improve the service: deliver the invitations a host requests, show the host who has responded, honor opt-outs, prevent abuse, keep the service secure, and account for message costs. We do not sell personal information and we do not use it for advertising.

Mobile numbers and text-message consent

Mobile numbers and text-message opt-in data are never shared with third parties or affiliates for their marketing or promotional purposes, and they are never sold or rented. HeadOnOver texts a guest only after the guest opts in on their own invitation page; a number a host enters is never texted by HeadOnOver on that basis. We use a guest’s number only to show the host who they are, to deliver the event messages the guest asked for, and to honor STOP and HELP requests. The only other parties that process a number are the text-messaging provider that carries the message and our hosting provider, solely to provide this service.

Who else processes information

We use a small number of service providers to host the application and deliver email and text messages. They receive only what they need to perform that service for us. We may disclose information if the law requires it or to protect guests, hosts, or the service from fraud or abuse.

We use Sentry to help diagnose server failures. Error reports contain the error type, its location in our application code, and the software version. We exclude request contents, cookies, private links, guest information, and the original error message from those reports. See Sentry’s privacy policy.

Cookies

We use essential cookies: a session cookie that keeps a host signed in (up to 30 days, or until they sign out) and a short-lived security cookie used while confirming a sign-in link (15 minutes). Private invitation pages do not load third-party analytics scripts. A preference cookie records an analytics opt-out. On public marketing pages, you can choose whether to allow Google Analytics cookies. We save that choice in your browser’s local storage and a preference cookie shared between our www and apex hostnames. Optional analytics is on by default unless you opt out; use “Analytics preferences” in the footer to change your choice. We do not load it when your browser sends Global Privacy Control or Do Not Track. Declining does not affect the service.

Optional site and product analytics

We use Sentry Session Replay on a sample of public-page and signed-in host visits to understand navigation, repeated clicks, and usability problems, including sessions where a browser error occurs. Replays mask text and input values and block images, media, message contents, and payment areas. We exclude sign-in, account, payment, guest invitation, RSVP, and administration pages. Public previews and public URLs with query strings or fragments are also excluded. Before upload, we remove private URLs, record identifiers, link destinations, form values, and other private attributes. Browser error reports contain a generic error type and application script location, not the original message. We do not record console messages or network request and response bodies. Sentry receives public-page interaction and device information and network information when your browser connects; a session identifier may be stored in your browser. The same analytics preference, Global Privacy Control, and Do Not Track settings apply. See Sentry’s privacy policy.

Cloudflare Web Analytics measures loading speed, responsiveness, and layout stability on eligible public pages. It receives public page and performance information, and network information when your browser connects. It does not use analytics cookies or persistent visitor identifiers. We exclude private pages, signed-in visits, unpublished previews, URLs containing query strings or fragments, and visits with potentially private referrers. The same analytics preference and browser privacy signals apply. See Cloudflare’s privacy policy.

Unless you opt out, Google Analytics processes browser and device information, public page views, navigation and contact-link clicks, scroll depth, active reading time, and FAQ interactions to help us improve the website. Google receives network information, including your IP address, when your browser connects. We disable advertising personalization and Google signals. We do not send guest names, contact details, event information, form contents, sign-in links, private invitation links, or RSVP responses to Google Analytics. Google’s script is excluded from private invitation, sign-in, and signed-in host pages, and from public requests containing unrecognized query parameters. Recognized campaign parameters are restricted to bounded source, medium, and campaign labels; free-text search terms are excluded.

Google processes public-site information as our analytics provider. See Google’s privacy policy. We also use PostHog, hosted in its US region, for public-site engagement and product usage. Our server sends limited events such as host sign-in, event creation, invitations queued, invitation opened, and RSVP submitted. These use pseudonymous identifiers and limited counts; they do not include names, email addresses, phone numbers, private URLs, event descriptions, or RSVP contents. PostHog session replay and automatic form capture are disabled. Public visits use a random browser identifier stored locally; private product identifiers are separate and are not joined to public browsing. Opting out stops future optional events from this browser, including server-side events initiated by it. Essential records needed to deliver invitations and manage RSVPs remain in HeadOnOver. See PostHog’s privacy policy.

Guests

Guests do not need an account. Each invitation uses a private link meant for one household; anyone with the link can view that invitation and change its RSVP, so please don’t share it. A host sees the responses for their own events only. The host decides whom to invite and provides guests’ contact details; HeadOnOver processes those details on the host’s behalf and for the limited purposes in this policy.

Images

Uploaded cover images are decoded and re-encoded before storage, and embedded metadata such as GPS location is removed. Images are shown only to the host and to invited guests.

Retention and deletion

We keep a workspace’s data while the account is open. A host can download an export of their contacts, events, invitations, and RSVP history, and can permanently delete their workspace from Account settings. Deletion removes the workspace’s contacts, events, invitations, RSVPs, messages, delivery records, and images. Encrypted backups are kept for up to 30 days before they expire, and server logs are kept for a limited period, generally no longer than 30 days.

We keep records of the terms a host accepted and of each confirmation a host made before sending invitations for up to 4 years after the workspace is deleted, without the workspace’s contacts or event details, so we can respond to complaints or legal claims about messages sent through HeadOnOver.

We keep a minimal record of phone numbers and email addresses that opted out or could not receive messages, even after a workspace is deleted, so that no host can message them again. Guests who want their information removed can ask the host or contact us.

Your choices

Reply STOP to any HeadOnOver text to stop all texts from us, or HELP for help. To access, correct, or delete information about you, email support@headonover.com.

Your privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia, and other US states), you may have the right to know what personal information we hold about you, to get a copy, to correct it, and to have it deleted, and not to be treated differently for using these rights. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.

To make a request, email support@headonover.com. We will confirm your request by checking it against information we already hold (for example, by replying to the email address or phone number on file), and we respond within 45 days. You may use an authorized agent; we may ask for proof of their authority. If we decline a request, you can reply to appeal and we will explain the outcome. Guests’ requests about an event’s guest list may also be passed to the host who added them.

Where information is processed

HeadOnOver is intended for people in the United States, and our application data is stored in the United States. Service providers may process technical information in other countries. Cloudflare processes public-page performance information at a nearby data center, which may be outside the United States.

Security

Sign-in links and invitation links are long random values that we store only in hashed form. Each workspace’s data is kept separate from every other workspace. Connections to HeadOnOver are encrypted, uploaded images are stripped of hidden metadata, and backups are encrypted. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

Children

HeadOnOver is for adult hosts and is not directed to children under 13. We do not knowingly collect personal information directly from children. A parent or host may add a child’s name to a household for an event head count; we never message a child and use the name only for that event. If you believe a child has given us personal information, email support@headonover.com and we will delete it.

Changes

If we change this policy we will update the date at the top of this page. For material changes we will also notify hosts by email or in the app before they take effect.