Privacy Policy
EventETA lets a guest share their location with the host of an event they joined, starting one hour before it begins. This policy explains exactly what we collect, why, how long we keep it, and what you can ask us to do about it. It covers the EventETA website and the EventETA iPhone and Android apps.
Two things worth stating up front: we run no advertising trackers and no ad networks, and we never sell or share your personal information.
We do count things, and we would rather say so here than bury it. The app uses Firebase Analytics to record which steps of a flow people reach: for example that a location request was shown, and whether it was accepted or declined, so we can find the places the app is confusing. The website uses Google Analytics to count visits. Neither is used to build a profile of you, target advertising, or identify you personally, and neither records where you are.
Information we collect
- Account info: your name, and an email address or phone number. We sign you in with a one-time code, or with Sign in with Google or Apple. We never ask for or store a password.
- Event data: event names, dates, locations, guest lists, RSVP answers, and any note you send the host.
- Location data: GPS positions from your device, only if you opt in as a guest, and only in the window from one hour before the event.
- Messages: event group chat and direct messages between guests, where the host has enabled them.
- Photos: a cover image, if a host uploads one.
- Push tokens: an anonymous device identifier so we can send notifications. It identifies a device, not you.
- Technical data: IP address and timestamps in server logs, used to prevent abuse and to record consent.
Your phone contacts stay on your phone
If you use the app to pick guests from your contacts, that list is read on your device and never uploaded. We receive only the specific people you choose to invite. We do not store, scan, or index your address book.
Location data
Location sharing is opt-in and activates one hour before your event. While it is active we store the positions your device reports, so the host can see your progress and estimated arrival. Every stored position is deleted automatically within 12 hours of the event's start time. We keep one thing after the event: the time you arrived (or were checked in at the door), not where you were. It stays with your RSVP so the host can see who came and who was on time. You can turn sharing off at any moment from the app, and we never track you outside an event you joined.
Text messages
We send text messages in only two situations: the sign-in code you request when you choose to sign in with a phone number, and, if a host invited you and you have not replied, a single reminder asking you to RSVP. We do not text confirmations, event reminders, time-to-leave alerts or updates; those arrive as app notifications instead.
Reply STOP to any message to stop them permanently, or HELP for help. Message and data rates may apply. Where we have a record of consent you gave us, we keep it (when you gave it and the exact wording you agreed to) because the law requires us to be able to show it.
We email event confirmations, reminders, and invitations. Every one carries an unsubscribe link that works without signing in.
If you chose to hear from a host, their newsletters and invitations come from hosts@news.eventeta.com with the host's name on them, and replies go to the host. In these emails only, we count whether the email was opened and whether a link was clicked, so the host can see how their email did. We don't do this in any other email we send.
How we use your information, and why we are allowed to
- To run the event you joined: show your location and ETA to the host and guests, send confirmations and reminders. This is necessary to provide the service you asked for (GDPR Art. 6(1)(b)).
- To send you texts, where you have ticked the consent box (GDPR Art. 6(1)(a): consent, which you may withdraw at any time).
- To send you a host's newsletters and event invites, only where you ticked "Get news & invites from this host" (GDPR Art. 6(1)(a): consent; unsubscribe any time).
- To detect and prevent fraud, spam, and abuse, and to keep the service secure (GDPR Art. 6(1)(f): our legitimate interest in a service that is not overrun by abuse).
- To respond when you contact support (GDPR Art. 6(1)(b) and (f)).
Israeli law works differently, and we would rather be explicit than assume the paragraph above covers it. Israel's Protection of Privacy Law recognises no “legitimate interests” basis; consent is the anchor. If you are in Israel, treat everything above as done with your consent, given when you replied to an invitation and, for location, again when you chose to share your ETA. You may withdraw either at any time: see Your rights.
What you have to give us, and what happens if you don't
No law requires you to give us anything. All of it is voluntary, and here is exactly what each piece costs you if you withhold it.
- Your name: required to reply to an invitation, because the host's guest list would otherwise have an unnamed row on it. Without it you cannot RSVP.
- An email address or phone number: required to reply, so we can send your confirmation and your ticket. Without it you cannot RSVP.
- Your location : entirely optional. Decline it and you are still going to the event, still on the guest list, and still get your ticket and reminders. The only thing you lose is the host seeing your ETA, and the reminder telling you when to leave.
- Anything a host asks for in their own questions: a host may mark a question required, and that is their requirement, not ours. Answers go to that host.
- A photo, a bio, your interests: optional everywhere. Leaving them out changes nothing except how you appear to other guests.
Who we share it with
We do not sell your personal information, and we do not share it for advertising. We share it only with:
- The host and guests of your event: your name, RSVP, and (if you opted in) your live location and ETA.
- A host's contacts: only if you tick "Get news & invites" from that host when you RSVP. That adds you to that host's contacts, so they can send you newsletters and event invitations through EventETA. The host sees your name, your email, which of their own events you came to and when you arrived (never anything from another host's events), and hosts on the paid Plus plan can download your name and email. Once downloaded, what the host does with them is up to that host, not us. People who opted in before September 29, 2026 were told hosts could not download their details, so they are never included in a download. A host can also bring your email from their own list: then we email you once to ask, you're added only if you say yes, and if you don't answer nothing else is sent. From that email you can also ask that no host may add you again. It's entirely optional, and every message has a one-click unsubscribe.
- Twilio: to deliver text messages.
- SendGrid (Twilio): to deliver email.
- Google: Maps for geocoding and map display; Firebase for push notifications and chat delivery; Firebase Analytics for counting which steps of a flow people reach in the app; Google Analytics for counting visits to eventeta.com, as described under Cookies below.
- Apple: if you use Sign in with Apple, and to deliver push notifications to iPhones.
- Cloudflare: the "are you human" check on the sign-in and create-an-event pages, which sees your IP address.
- Anthropic: only when a host asks EventETA to draft an event description. See Where we use AI below.
- GoDaddy: our hosting provider, which stores the database and the website on our behalf.
- Law enforcement: only where we are legally required to, and we will tell you unless we are legally barred from doing so.
Each of these acts as our processor under contract and may use your data only to provide that service to us.
Where we use AI
One feature uses AI: when a host is creating an event, they can ask EventETA to draft a description for them. If they do, the few details they have typed (the event name, the venue, the date) are sent to Anthropic's Claude, which writes a suggestion the host is free to edit, replace or ignore. Nothing is sent unless the host presses that button.
That is the whole of it. We do not use AI to read your messages, to analyse your location, to decide anything about you, or to build a profile of you, and we do not use anything you give EventETA to train an AI model. There is no chatbot in EventETA, so there is nothing here to talk to.
How long we keep it
- Location positions: deleted automatically within 12 hours of the event's start time. The time you arrived is kept with your RSVP, as part of the event record below.
- Event and guest records, kept while your account exists, so you and your hosts can see your history. Deleted when you delete your account.
- Interests: the interests you pick when RSVPing are saved to your EventETA profile, so you don't have to pick them again at your next event. A host can see the interests you chose at their own events, which is how they decide who to invite next time; they never see interests you gave to a different host. You can change or clear them at any time under Edit profile, and they are deleted with your account.
- Networking with other guests: when a host turns on networking, guests at that event who picked interests can see the interests you picked there (not if you hide your profile for that event), and EventETA may tell them when you arrive. Other guests can ask to meet you; you choose yes or not now, and private messages open only after a yes. After the event you can choose to stay in touch with people you met. Your email (or the phone number you RSVP'd with) is shown to someone only when you both chose to stay in touch.
- Messages, kept for the life of the event.
- Being in a host's contacts, kept until you unsubscribe from that host or delete your account. Unsubscribing stops all further messages from that host.
- Consent records and abuse logs, kept up to 4 years, because we may need them to demonstrate we had permission to contact you.
Deleting your account
You can delete your account and everything in it from the app, under Profile, or on the web at eventeta.com/delete-data.php. Deletion is permanent and immediate: we do not keep a shadow copy.
Your rights
Wherever you live, you may ask us to give you a copy of your data, correct it, or delete it. Email support@eventeta.com and we will respond within 30 days. We will never charge you or degrade your service for exercising a right.
If you are in the EU or UK, you also have the right to object to or restrict processing, to data portability, to withdraw consent at any time, and to complain to your national data protection authority.
If you are in California, you have the right to know what we collect, to delete it, to correct it, and to be free from discrimination for asking. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the past 12 months, so there is no "Do Not Sell or Share My Personal Information" action for you to take.
Where your data is held
Our servers are in the United States. If you use EventETA from outside the US, your information is transferred there. For transfers from the EU, UK, or Switzerland we rely on the European Commission's Standard Contractual Clauses.
Children
EventETA is not directed to children. You must be at least 13 to use it, and at least 16 in countries where that is the minimum age for consent to online services. We do not knowingly collect information from anyone below that age. If you believe a child has given us their information, email support@eventeta.com and we will delete it.
Security
Traffic is encrypted in transit with TLS. Access to the database is limited to the people who operate the service. No system is perfectly secure, but if a breach ever affects your personal data we will notify you and the relevant regulator as required by law: within 72 hours where GDPR applies.
Cookies
We set two cookies, and both are ones the site cannot work without: one so it remembers you are signed in, and one so it remembers whether you chose English or Hebrew. Nothing on this site asks you to accept cookies, because there is nothing to accept.
We use Google Analytics to count visits and see which pages people use, but we run it in its cookieless mode: it writes no cookie, reads nothing already on your device, and is given no identifier that would let it recognise you on a second visit. It tells us how many people came and what they looked at. It cannot tell us that you came back. We run no advertising cookies and no ad networks, and we have never sold or shared this data with anyone.
This used to work differently. Until September 2026 Analytics set two cookies of its own (_ga and _ga_JZ25D0HVSJ) and we pointed you at Google's opt-out add-on if you did not want them. Asking people to opt out was the wrong way round, so we stopped setting them instead.
How to reach us
EventETA is the controller of the information described here. For any privacy question, or to exercise any right above:
Email support@eventeta.com. We are based in the United States and will respond within 30 days.
We may update this policy. If a change materially affects your rights we will email you before it takes effect. The date at the top always reflects the current version.