Privacy Policy

shrtbrd (“we”, “us”, or “our”) provides a timeslot sign-up service. This policy explains what information we collect, how we use it, and your rights regarding it. If you have questions, email us at privacy@shrtbrd.com.

Information we collect

• Email address — collected when you sign in via magic link, or when you sign up for a timeslot as a guest.
• Display name — optionally provided in your account settings, or provided as a guest when signing up for a timeslot.
• Phone number — optionally provided in your account settings, or provided as a guest when signing up. Used only to send SMS reminders. Your mobile number is never shared with third parties for marketing purposes, sold, or transferred.
• Event and timeslot data — any events, timeslots, descriptions, and locations you create as an organiser.
• Sign-up records — your name, email, and (if provided) phone number are stored against any timeslot you sign up for.
• Custom field responses — organisers may add custom fields to their sign-up forms to collect additional information relevant to their event (for example, dietary requirements or skill level). Any values you submit are stored against your sign-up record and visible to the event organiser.
• Session data — when you sign in, we store a session token in a browser cookie to keep you logged in.

How we use your information

• To authenticate you via passwordless email sign-in.
• To send reminder emails and, if you have provided a phone number, SMS reminders 24 hours and 10 minutes before timeslots you have signed up for.
• To display your name to event organisers on their sign-up lists.
• To display your name to other participants if the event organiser has enabled public sign-up visibility for their event.
• To operate and improve the service.

We do not sell your personal information to third parties, and we do not use it for advertising. Mobile phone numbers are used solely to deliver SMS reminders via Twilio and are never shared with or sold to third parties or lead generators.

Legal basis (GDPR). Where EU/UK data protection law applies, we process your data on the basis of: (a) contract — to provide the sign-up and reminder service you have requested; (b) legitimate interests — to operate and improve the service; and (c) consent — where you have explicitly provided optional information such as a phone number.

Cookies

We use a single session cookie to keep you signed in. This cookie is strictly necessary for the service to function and is not used for tracking or advertising. It expires when your session ends or you sign out.

Third-party services

• Vercel — we host shrtbrd on Vercel. All web traffic and application data passes through Vercel's infrastructure. See vercel.com/legal/privacy-policy.
• Amazon Web Services (RDS) — your data is stored in a PostgreSQL database hosted on AWS. See aws.amazon.com/privacy.
• Email delivery — we use a transactional email provider to send sign-in links and reminders. Your email address is transmitted to this provider for this purpose.
• Twilio (SMS) — if you have provided a phone number, your number and reminder message are transmitted to Twilio to deliver SMS reminders. See twilio.com/en-us/legal/privacy.
• Stripe (payments) — for paid sign-ups and subscriptions, your payment is processed by Stripe. Your card details are entered on Stripe's secure checkout and are handled by Stripe; shrtbrd does not receive or store card numbers. See stripe.com/privacy.
• OpenStreetMap / Nominatim — if an organiser searches for a location, the query is sent to the Nominatim geocoding API. No personal data is included in these requests.

Data retention

Your account data is retained for as long as your account exists. Sign-up records — including any custom field responses — are retained for as long as the associated event exists. Organisers may choose to keep events indefinitely, which means your sign-up data may be retained for an extended period. You may request deletion of your data at any time by emailing privacy@shrtbrd.com.

Your rights

Depending on where you are located, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — request correction of inaccurate or incomplete data.
• Delete — request deletion of your personal data.
• Portability — request a machine-readable copy of your data.
• Restrict processing — request that we limit how we use your data in certain circumstances.
• Object — object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@shrtbrd.com. We will respond within 30 days.

Children

shrtbrd is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at privacy@shrtbrd.com and we will delete it promptly.

Changes to this policy

We may update this policy from time to time. When we do, we will update the date at the top of this page. Continued use of shrtbrd after changes are posted constitutes your acceptance of the updated policy.