Privacy Policy

Who we are and what this policy covers

This Privacy Policy explains how Upward collects, uses, discloses, protects, and retains personal information when people use heyupward.com, Upward accounts, celebration pages, invitations, activity gifts, partner storefronts, reservations, wallet and reimbursement features, support channels, and related services.

Upward is built for parents, guardians, guests, gift givers, children, and family-focused partners. Children are not intended to create Upward accounts directly. Parents and guardians manage child-related information inside their own accounts and celebration experiences.

For privacy questions, access requests, correction requests, deletion requests, or consent withdrawal requests, contact Upward at hello@heyupward.com.

Information we collect

Account and authentication information may include name, email address, phone number, profile photo, account identifiers, sign-in method, verification status, session information, and security events. Upward uses Clerk to provide authentication and account management, and users may choose Google sign-in where it is available.

Family and child information may include parent or guardian details, child names, birthdays or age ranges, interests, preferences, activity context, celebration details, family notes, and information a parent or guardian chooses to add for planning, gifting, RSVP, wallet, or reimbursement purposes.

Celebration, guest, and invitation information may include event details, host information, guest names, RSVP responses, dietary or allergy notes, waiver-related status, messages, memories, photos, contribution information, recipient email addresses, unsubscribe preferences, and venue or partner context connected to an event.

Partner and offering information may include business contact details, storefront content, offering details, schedules, pricing, reservation context, media, policies, venue instructions, operational notes, and communications between Upward, partners, hosts, and guests.

Payment and transaction information may include purchase amounts, activity gift balances, contribution history, refunds, payouts, reimbursement status, receipt images or documentation, and Stripe payment identifiers. Upward uses Stripe for payment processing and does not store full payment card numbers.

Technical information may include IP address, device and browser details, referral URLs, log data, cookie and similar technology identifiers, page interactions, security signals, approximate location inferred from technical data, and diagnostic information used to operate, secure, and improve the service.

Google sign-in and Google user data

If a user chooses to sign in with Google, Upward receives the basic account information authorized by the user for sign-in: the user's Google account identifier, name, email address, email verification status, and profile image. Upward does not request access to Google Drive, Gmail, Calendar, contacts, or other sensitive Google account data for Google sign-in.

Upward uses Google user data only to authenticate the user, create or connect the user's Upward account, display account identity, prevent account abuse, provide support, and operate the service features the user chooses to use. Upward does not sell Google user data, use it for advertising, or use it to train generalized artificial intelligence models.

Upward's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements where they apply.

AI-assisted partner tools

Authorized partners may choose to use AI-assisted tools to draft or review catalog, schedule, and operational information. When a partner uses one of these tools, Upward sends the partner's prompt and only the relevant, access-controlled business context needed for that request to models through OpenRouter. Suggestions are returned for review and are not automatically published or treated as the source of truth.

Partners should not submit unnecessary personal information, child information, payment details, credentials, or other sensitive information in an AI prompt. Google sign-in data is not included in AI prompts for the purpose of training generalized artificial intelligence models.

How we use personal information

We use personal information to create and secure accounts, authenticate users, provide celebration pages, manage invitations and RSVPs, process activity gifts and purchases, support partner offerings and reservations, operate wallet and reimbursement workflows, communicate service updates, provide support, detect abuse, prevent fraud, and comply with legal obligations.

We use information to personalize and improve the service, maintain accurate records, troubleshoot errors, measure product performance, understand which features are useful, protect users and partners, enforce our Terms of Service, and develop new features consistent with this policy.

We may send transactional messages about accounts, invitations, RSVPs, purchases, activity gifts, reimbursements, reservations, partner actions, security, policy changes, and support. Marketing or partner follow-up messages are limited by the choices available in the relevant product flow and by applicable law.

How we share information

We share personal information with service providers that help us operate Upward, including authentication providers such as Clerk, Google OAuth where users choose Google sign-in, payment processors such as Stripe, email providers such as Resend, hosting and infrastructure providers such as Vercel, database infrastructure such as Supabase Postgres, file and media storage such as Cloudflare R2, AI processing through OpenRouter when an authorized partner chooses an AI-assisted feature, and analytics, logging, security, and customer support tools.

We share information between users only as needed for the service. For example, hosts may see guest RSVP details, guests may see event information shared by a host, gift recipients may see contribution context, partners may receive operational information needed for a celebration, reservation, waiver workflow, or permitted follow-up, and admins may review information needed for support, safety, reimbursement, dispute, or compliance work.

We may disclose information if required by law, court order, subpoena, regulatory request, safety concern, fraud investigation, rights enforcement, or business transfer such as a merger, acquisition, financing, reorganization, or sale of assets. We do not sell personal information.

Children and family information

Upward is intended for use by parents, guardians, adult guests, gift givers, and partners. Children should not create accounts or submit information directly. Parents and guardians are responsible for deciding what child-related information they add to Upward and for keeping that information accurate and appropriate.

We collect child-related information only as needed to provide family, celebration, activity gift, wallet, reimbursement, invitation, or partner-service features chosen by a parent or guardian. Parents and guardians may request access, correction, or deletion of child-related information by contacting hello@heyupward.com.

Because Upward handles family and child-related context, users should not add sensitive information that is not needed for the service. Allergy, dietary, accessibility, waiver, or safety notes should be limited to what is necessary for the relevant event or activity.

Cookies, analytics, and device data

Upward uses cookies and similar technologies to keep users signed in, secure sessions, remember preferences, support authentication, protect against abuse, understand service performance, and improve product reliability. Some cookies are essential for account security and cannot be disabled through Upward without affecting the service.

Browser settings may allow users to block or delete cookies. Blocking cookies may affect sign-in, celebration management, checkout, wallet, partner, or support features.

Retention and deletion

We keep personal information for as long as needed to provide the service, maintain accurate transaction and account records, support safety, resolve disputes, comply with legal, tax, accounting, fraud-prevention, and regulatory obligations, and enforce our agreements.

Retention periods vary by data type. For example, account records may remain while an account is active, payment and transaction records may be retained for legal and accounting reasons, support records may be retained to resolve issues, and event or invitation content may be retained until deleted by the relevant user or no longer needed for the service.

Users may request deletion by contacting hello@heyupward.com. Some information may be retained when required for legal compliance, fraud prevention, dispute resolution, security, backup integrity, or legitimate business records.

Security and international processing

Upward uses administrative, technical, and organizational safeguards designed to protect personal information, including access controls, authentication, encryption in transit where appropriate, provider security controls, logging, and limited internal access based on operational need.

No online service can guarantee absolute security. Users should protect their own account credentials, use secure devices, and contact Upward promptly if they believe an account or invitation link has been misused.

Upward and its service providers may process and store information in Canada, the United States, and other jurisdictions where providers operate. Information may be subject to the laws and lawful access processes of those jurisdictions.

Access, correction, and deletion

Users may request access to personal information held by Upward, ask us to correct inaccurate information, request deletion where available, ask questions about our privacy practices, or withdraw consent for optional uses by contacting hello@heyupward.com.

We may need to verify identity before responding to a request. We may decline or limit a request where permitted or required by law, including when information must be retained for security, fraud prevention, legal, tax, accounting, dispute, or transactional record reasons.

Users may also update certain account, family, celebration, guest, wallet, reservation, and communication preferences directly inside the product when those controls are available.

Changes to this policy

We may update this Privacy Policy as Upward evolves or as legal, operational, security, or product requirements change. When we make material changes, we will update the effective date and provide additional notice when appropriate.

Using Upward after an updated Privacy Policy becomes effective means the updated policy applies to later use of the service.