Nothing about your invitation leaves your device

01The short version

Venvia Invites runs on your own device — in your browser on the web, and inside the app on Android, iPhone and iPad. Your invitation, the words on it and any photo you add are handled there. Nothing is uploaded and we keep no copy. The single exception is the preview a chat shows for a premium invitation link, which needs two names and a date to be readable by the chat app; section 04 and section 07 say exactly how that works and what stays private.

There is no account to create, so there is nothing for us to hold. We do not run analytics, and we do not sell anything about you to anybody.

The app asks for very little, and only when you reach for the thing that needs it: your photo library or your camera at the moment you add a picture, and — on an iPhone or iPad — permission to save a finished invitation to your photos if you pick that from the share sheet. Section 02 says what each is for. There are no others: no contacts, no location, no microphone, no files beyond the one you point at.

The Android app additionally declares two permissions that never produce a prompt, because Android does not ask about them: access to the internet, and access to the advertising ID. Both belong to the advertising, and section 05 is about exactly what that involves.

Venvia Invites is paid for by advertising, and that is the one part of it that involves another company. Google serves those adverts and, in doing so, sees things about your device that we never do. Section 05 sets out exactly what, and how to turn the personalised kind off. Nothing you type into an invitation is part of it.

02What stays on your device

The editor keeps your work in your browser's own storage (IndexedDB), under the name of the site. That covers designs you save deliberately and the automatic draft that lets you pick up where you left off.

Two consequences are worth knowing, because they are the trade for not having an account:

• Your designs are tied to the browser or the app you made them in, on that device. They will not appear on your phone if you made them on a laptop, and the app and the website keep separate copies even on the same phone — the app carries its own storage rather than reading your browser's.
• Clearing your browsing data, or using a private window, removes them. Nobody can restore them for you, because nobody else ever had a copy.
• A photo you add is read from the file you pick and drawn straight onto the canvas. It is kept in the same browser storage as your designs — a premium invitation keeps its photos in a separate part of it, so that a photo can never be mistaken for a damaged design — and it is never uploaded.
• The app asks for two permissions to make that possible, and for nothing else. Your photo library, when you choose a picture to put on a card. Your camera, when you choose Take a photo instead — the picture goes straight onto the canvas the same way, and we never open the camera on our own or read a frame you have not taken deliberately. Say no to either and every other part of the app works; you simply cannot add that picture. Both are switched off again in your device's own settings whenever you like.
• On an iPhone or iPad there is a third, and it is the mildest of the three: saving a finished invitation to Photos. We never do it ourselves — the file is handed to your device's share sheet, and Save Image is one of the choices in it — but iOS asks for the permission at the moment you pick that choice.

03What we do not collect

To be specific rather than reassuring, this site does not do any of the following:

• No account, sign-in, email capture or newsletter.
• No analytics, page-view counters, heatmaps, session recording or A/B testing.
• No data brokers, and nothing about you sold to anyone.
• No payment of any kind, so no card or billing details exist.
• No reading of what you write. The wording of your invitation, the names on it and any photo you add never reach us, and are never passed to an advertiser.
• No fonts or images loaded from third-party services — the typefaces are served from this site itself. Google's advertising code is the only third-party script, and section 05 is about it.

04What our host can see

The site is delivered by Hostinger, our hosting provider. Like every web server, theirs records the ordinary technical details of each request — your IP address, the time, the page requested and your browser's user-agent string — because a server cannot send a page back without them, and because those records are how abuse and outages are investigated.

We do not use those logs to build a profile of you. For everything made in the editor they hold nothing you typed, because that wording never reaches a server at all. A premium invitation link is the one exception, and a partial one: it carries the two first names and the date in the readable part of the address, so that a chat can show a preview of it, and those two things therefore appear in the request log like any other address. The rest of that invitation — the venue, the families, the running order, what to wear — travels after the # in the link, which browsers never send to a server and no log can contain.

The Android and iOS apps use that same server. Almost everything they draw with is inside the install and works with no connection at all, but two things are fetched from this site when you reach for them: the element library, which is far too much artwork to put in a download, and the mark at the head of a premium invitation. Those requests appear in the same log as any other and carry nothing about the invitation you are making.

Hostinger keeps those logs for a limited period under its own privacy terms and acts as our data processor for that purpose.

No content delivery network and no analytics service sit between you and the site. Google's advertising servers are the one other party your device contacts, and only to fetch and measure the adverts themselves.

05Advertising

Venvia Invites is free, has no subscription and puts no watermark on your work. Advertising is what pays for it. Google is our advertising partner — AdMob in the Android, iPhone and iPad apps, AdSense on the website — and this section is what that means for you, written as plainly as the rest of this page.

To choose which advert to show and to count it honestly, Google receives four things from the app, and this is the full list rather than a summary of it. Your device's IP address, from which an approximate location — a city, not a street — can be worked out. An advertising identifier: the Android advertising ID, the Identifier for Advertisers on an iPhone or iPad, or a cookie on the website. Your interactions with the adverts and with the app around them: that an advert was shown, that it was tapped, that a screen was opened. And diagnostic information: crashes, and how quickly things ran.

That information is shared with Google rather than merely seen by us — Google is a separate company receiving it as it happens, and it may combine it with what it already knows about the device from other apps and sites, which is how a personalised advert becomes personalised. All of it travels encrypted, over HTTPS. Nothing in the list identifies you by name, because we never learn your name.

What Google never receives from us is the content of your work. The words on your invitation, the names of the couple, the date, the venue and any photo you add are drawn on your own device and are not sent to us, to Google, or to anyone else. There is no route in this code by which they could be: the advert is fetched separately and knows nothing about the card on the screen.

Google is an independent controller of what it collects here, not our processor, and it handles that information under its own privacy policy at policies.google.com/privacy and its advertising terms at policies.google.com/technologies/ads.

• You can turn off personalised advertising without losing the app, on any of the three. On Android, Settings › Google › Ads deletes or resets the advertising ID. On an iPhone or iPad, Settings › Privacy & Security › Tracking governs it, and the app asks you the first time it is about to show an advert — which is after your first download, not on the way in — answering Ask App Not to Track is honoured and nothing further is requested. On the web, adssettings.google.com does the same for the browser. You will still see adverts; they simply stop being tailored.
• Adverts are never placed so that a tap meant for Download or Save lands on one instead, and no advert interrupts an export that is already running.
• We are paid by the advert, not by anything about you. No list of users, no profile and no invitation content is passed to Google or to anyone else, because none of it exists.

06Your choice in the UK, Europe and India

If you are in the United Kingdom or the European Economic Area, the law requires your consent before an advertising identifier is read from your device. You will be asked through a consent platform Google certifies for this purpose — on the website when you arrive, and in the app when it is first about to show you an advert — and nothing beyond what is strictly needed to show you the page is read until you answer.

Saying no is a real option and costs you nothing: every template, every edit and every download works the same way, and you will see adverts chosen without any knowledge of your device.

You can change that answer whenever you like, and it is the same control in both places: on the website it sits in the footer of every page, and in the app it is on the More screen, in each case under Advert settings. Clearing your browsing data for this site resets it entirely on the web; uninstalling the app does the same on a phone.

If you are in India, the Digital Personal Data Protection Act gives you a comparable say. We hold no personal data about you to correct or erase — the sections above explain why — and the advertising identifier sits with Google, so adssettings.google.com and your device's own advertising settings are where it is reset.

07What the app stores tell us

Google Play and the App Store sit between you and the app, and both hand us numbers we never asked for and cannot switch off. It is a short list and it is worth naming, because it is the one place information about you exists that this page has not otherwise accounted for.

• Counts. How many people installed the app, in which country, on which sort of device, and how many uninstalled it. Totals, never a list of people.
• Crash reports. If the app stops unexpectedly, the store may send us the technical trace of where it happened. Apple asks you whether to share these when you set your device up, and your answer is honoured; Google reports them for Android. No invitation content is in them.
• Ratings and reviews, under whatever name you chose to leave them under. If you write to us through a store review, that conversation is public and lives with the store.
• Nothing that identifies you personally comes to us from either store, and neither gives us your email address, your Apple Account or your Google Account.

08When you share an invitation

Sharing is the one place information leaves your device, and only when you choose it:

• Download saves the finished picture, or the whole invitation as a PDF, to your device. Nothing is sent anywhere.
• Record the video, on a premium invitation, makes an MP4 of it. Making a video normally means a server doing the work; this one is drawn and encoded by your own browser, on your own device, while you watch. Nothing is uploaded and we never see it — which is also why the tab has to stay in front while it runs.
• Share, on a phone that supports it, hands the picture to your own device's share sheet. Whatever app you then pick receives it, under that app's terms — and if you pick Save Image, it goes to your own photo library and nowhere else. Closing the sheet without choosing anything sends it nowhere at all; the file simply stays in the app's own temporary storage until your device clears it.
• Open WhatsApp opens WhatsApp with your wording ready to send, so the text you wrote goes to WhatsApp when you send it. The picture is not attached automatically — no website can do that — so you attach it yourself.
• Copy details puts the wording on your clipboard.
• A map link, if you add one to a premium invitation, is an ordinary link to Google Maps. Nothing is requested from Google until a guest taps it, and what they do there is between them and Google.
• Send the link, on a premium invitation, makes a web address that contains the invitation itself. It is not uploaded and we do not store it: the whole invitation is encoded into the address, and your guest's browser decodes it again. We never receive a copy and could not show you one.

One part of that link deserves saying plainly, because it is the only place any of your wording is readable by a server.

A chat app shows a small preview card when you paste a link. It builds that card by fetching the address itself, and what it fetches never includes the part after the # — that is a rule of the web, not a choice of ours. So the invitation encoded there is invisible to it, and to us.

To stop every invitation previewing identically, the link carries two first names and the date as written in the ordinary, readable part of the address. Those two things are visible to the chat app, to our host's request log, and to anyone who is sent the link. Nothing else is: the venue, the address, the families, the schedule and the dress code stay after the # and reach nobody.

If you would rather share nothing readable at all, delete everything from the ? up to the # before sending. The invitation still opens correctly; only the preview card becomes generic.

09Children

Venvia Invites is a design tool for the adult planning an event. Some of what you can make with it — a first birthday, a naming day, a baby shower — is about a child, but the person choosing the template, typing the names and sending the card is a grown-up. The app is not directed at children, is not listed in any children's category, and is not enrolled in Google Play's Designed for Families programme.

That distinction matters for advertising, so we have made it deliberately rather than by omission. Because the audience is adults, adverts here are not restricted to the child-directed kind. If you are handing your phone to a child, use your device's own supervision controls; we cannot tell who is holding it.

We still collect nothing and hold no accounts, so using Venvia Invites does not put a child's information in our hands. The names on an invitation — including a child's — stay on your device.

10Your rights over your information

Data protection law gives you rights to see, correct, export and delete the personal information an organisation holds about you. In our case the honest answer is that we hold none: there is no account, no mailing list and no database of users to search.

The information from your designs sits on your own device, under your control, and can be removed at any time by deleting a design in My Designs, by clearing your browsing data for this site, or by uninstalling the app.

The one identifier connected to you is the advertising ID, and it is not ours to hand over: it belongs to your device and is read by Google. You can reset or delete it yourself at any moment — section 06 says where — and withdrawing the consent you gave stops it being read at all. Neither costs you any part of the app.

If you would like to ask about any of this, or believe we hold something about you, write to infotech@hexavo.co.uk and we will answer. If you are in the UK and are not satisfied with our reply, you can complain to the Information Commissioner's Office (ico.org.uk).

11Changes to this page

If this page changes in a way that affects you, the date at the top changes with it. HEXAVO runs the site and is responsible for what it says.