Privacy Policy

Melon (“we,” “us”) helps you send invitations and collect RSVPs at melon.rsvp. We built Melon because we believe gathering people shouldn’t mean handing your guests’ contact details to advertisers. This policy explains what we collect, why, and the control you have. In plain terms: we take privacy seriously, we never sell your data, and you can delete everything at any time.

Our promises

• We do not sell or rent your information, your guests’ email addresses, or phone numbers — ever.
• We do not run third-party advertising or analytics trackers on Melon.
• We do not use your guests’ contacts for anything other than delivering the invitations you send.
• When you delete your account, your data is erased immediately — no waiting period, no retention.

Information we collect

• Your account: your name, email address, and a securely hashed password.
• Events you create: titles, dates, locations, messages, and design choices.
• Guests you add: the names, email addresses, and/or phone numbers you provide for the people you invite.
• RSVP responses: a guest’s reply (yes/no/maybe), party size, and any note they leave.
• Basic operational data: standard server logs (such as IP address and request time) needed to run the service securely. These are not used to profile or track you across the web.

How we use it

We use your information only to operate Melon: to create and display your invitations, deliver them to the guests you choose, collect RSVPs, let you message your guests, and keep your account secure. That’s it.

Email open indicator

So that a host can tell whether their invitation was opened, invitation emails include a small (1×1 pixel) image that loads when the email is viewed. This is a built-in feature of Melon — it is visible only to the host of that event, it is never shared or sold, and we do not use it to track anyone across other sites or services. Each guest also gets a private, unguessable link to view and update their own RSVP.

Who we share data with

We don’t share your data with anyone for their own purposes. To run the service we rely on a small number of trusted providers that process data only on our behalf:

• Heroku (Salesforce) — application hosting and database.
• Mailgun (Sinch) — delivery of invitation and notification emails.
• Cloudflare — DNS and network security.

We may disclose information if required by law, or to protect the safety, rights, or security of our users and the service.

Retention & deletion

You can delete your account at any time from your Account page. Deletion is immediate and permanent: it removes your account, all of your events, your entire guest list (including every email address and phone number), your messages, and all RSVP responses. We do not keep backups of deleted data beyond what may transiently exist in routine system backups, which age out on their own. Hosts can also remove individual guests at any time, and a guest may ask their host to be removed.

Security

All traffic is encrypted in transit (HTTPS). Passwords are stored only as salted hashes. Invitations and RSVP pages are reachable only via unguessable tokens, and each host can access only their own events.

Your rights

You can access, correct, export (by contacting us), or delete your information. Deleting your account accomplishes erasure instantly. If you’re in a region with specific privacy rights (such as the EEA, UK, or California), you may exercise those rights by reaching out.

Children

Melon isn’t directed to children under 13, and we don’t knowingly collect their personal information.

Changes

If we update this policy, we’ll revise the date above and, for material changes, make a reasonable effort to notify you.

Contact

Questions about privacy? Email privacy@melon.rsvp.