Privacy

Two kinds of people use Tenawar

Hosts create an account and build an invitation. Guests never create an account — they open a link someone sent them and, if they choose, reply.

We hold different information about each, so the rest of this page is split accordingly.

If you create an invitation

We store the email address you sign up with, and a display name and phone number if you choose to add them. Sign-in is handled by Supabase, which stores your password in hashed form. We never see it.

We store the invitation you build: the names, dates, wording, schedule, venue and any photographs you upload.

If you pay for an event, the payment is processed by Paymob. Your card details are entered on Paymob’s systems and never reach ours. We keep a record that the event was paid for.

When you first arrive at this site we note the address of the site that sent you, if any, and any campaign tags in the link you followed (the utm_ ones). If you later create an account we keep that alongside it, so we can tell which places people find us from. It is the sending site’s address only, never the page, and it is recorded once — on your first visit, not on later ones.

If someone invited you

When you reply to an invitation we store the name or names you typed, how many people are attending, and your message if you wrote one. The host of that invitation can see all of it. That is the entire purpose of sending a reply.

We do not ask for your email address or phone number, and we have no way to contact you afterwards.

We also store a one-way hash of your IP address, calculated per invitation, which we use to recognise repeat replies from the same device and to limit abuse. Because the invitation’s own identifier is mixed into the hash before it is stored, it cannot be turned back into your address, and the same person replying to two different invitations produces two unrelated values.

When you open an invitation we record that it was opened: which invitation, when, the country your connection appears to come from, the site or app you came from — its address only, never the page — and whether you are on a phone, tablet or computer. Your browser also keeps a random identifier so that opening the same invitation twice counts as one person rather than two. We do not store your IP address for this and we do not know who you are. The host is shown counts, never names.

That identifier is not shared with anyone and is not used to follow you to other websites. You can remove it at any time by clearing this site’s data in your browser, and the invitation will work exactly as before.

What other companies see

Supabase stores our database, files and sign-in system. Cloudflare serves this site and runs our API, and sees the usual request information any web host does.

Paymob processes payments for hosts who buy a paid plan.

Google serves the map when an invitation shows a venue, and receives the IP address of whoever opens that invitation, including guests, because the browser loads the map directly from them. We do not send them anything else about you. When a host pastes a Google Maps link for their venue, our server asks Google once where that place is; that request carries the place, not the host. The typefaces the invitations are designed in are served from this site, so no other company sees you for them.

We do not use advertising trackers, and we do not sell anything to anyone.

How long we keep things

Invitations and replies are kept while the event exists. Deleting an event marks it deleted and removes it from your dashboard; it stays recoverable for a period so an accidental deletion is not final, and is then removed.

If you want your account and everything in it erased, write to us and we will do it.

Asking us about your information

Write to [email protected] and we will tell you what we hold about you, correct it, or delete it.

If you replied to someone’s invitation and want that reply removed, contact us or ask the host — they can remove it themselves.

Children

Tenawar is meant for adults arranging events. A child’s name may well appear in an invitation or a reply — a birthday invitation is usually about one — but we do not knowingly let children create accounts.

Changes

If this page changes in a way that affects what we do with your information, we will update the date above and, for anything significant, tell account holders directly.