Privacy Policy

Who we are and what this policy covers

This Privacy Policy explains how Upward collects, uses, discloses, protects, and retains personal information when people use heyupward.com, Upward accounts, celebration pages, invitations, RSVPs, gift registries, partner storefronts, bookings, payments, support channels, and related services.

Upward is built for parents, guardians, guests, gift givers, and family-focused partners. Children are not intended to create Upward accounts directly. Parents and guardians manage child-related information inside their own accounts and celebration experiences.

For privacy questions, access requests, correction requests, deletion requests, or consent withdrawal requests, contact Upward at hello@heyupward.com.

Information we collect

Account and authentication information may include name, email address, phone number, profile photo, account identifiers, sign-in method, verification status, session information, and security events. Upward uses Clerk to provide authentication and account management, and users may choose Google sign-in where it is available.

Family and child information may include parent or guardian details, child names, birthdays or age ranges, and details a parent or guardian chooses to add for planning, invitation, gifting, or booking purposes. Parents control what child-related information they provide.

Celebration, guest, and invitation information may include event details, host information, household and guest names, RSVP responses, dietary, allergy, or accessibility notes a host or guest chooses to provide, messages, recipient email addresses, delivery and reminder preferences, and venue or partner context connected to an event.

Gift registry information may include retailer and product links, family-provided gift names, notes, images, quantities, claim status, purchase status, and received status. Guests should not include payment card details in registry notes.

Partner and offering information may include business contact details, storefront content, offering details, schedules, pricing, booking context, media, policies, waiver text and acceptance records, venue instructions, operational notes, and communications between Upward, partners, hosts, and guests.

Payment and transaction information may include purchase amounts, order and refund history, payout information for partners, and Stripe payment identifiers. Upward uses Stripe for payment processing and does not store full payment card numbers.

Technical information may include IP address, device and browser details, referral URLs, log data, cookie and similar technology identifiers, page interactions, security signals, approximate location inferred from technical data, and diagnostic information used to operate, secure, and improve the service.

Affiliate interaction information may include the registry item clicked, retailer destination, affiliate program identifiers, and click time. Upward does not place a child’s identity, guest identity, or celebration identifier into an affiliate link.

Google sign-in and Google user data

If a user chooses to sign in with Google, Upward receives the basic account information authorized by the user for sign-in: the user’s Google account identifier, name, email address, email verification status, and profile image. Upward does not request access to Google Drive, Gmail, contacts, or other sensitive Google account data for sign-in.

Separately, a partner may choose to connect a Google Calendar to keep venue schedules in sync. When a partner connects a calendar, Upward accesses only the calendar data needed for that scheduling feature, at the partner’s direction, and the partner can disconnect it at any time.

Upward uses Google user data only to authenticate the user, create or connect the user’s Upward account, display account identity, provide the scheduling features a partner chooses to use, prevent account abuse, provide support, and operate the service. Upward does not sell Google user data, use it for advertising, or use it to train generalized artificial intelligence models.

Upward’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements where they apply.

How we use personal information

We use personal information to create and secure accounts, authenticate users, provide celebration pages, manage invitations, RSVPs, and gift registries, coordinate registry claims and purchase status, attribute eligible affiliate referrals, process purchases, support partner offerings, bookings, and quotes, communicate service updates, provide support, detect abuse, prevent fraud, and comply with legal obligations.

We use information to personalize and improve the service, maintain accurate records, troubleshoot errors, measure product performance, understand which features are useful, protect users and partners, enforce our Terms of Service, and develop new features consistent with this policy.

We may send transactional messages about accounts, invitations, RSVPs, purchases, gifts, bookings, partner actions, security, policy changes, and support. Marketing or partner follow-up messages are limited by the consent choices available in the relevant product flow and by applicable law, and users can manage notification preferences inside the product.

How we share information

We share personal information with service providers that help us operate Upward, including authentication providers such as Clerk, Google OAuth where users choose Google sign-in, payment processors such as Stripe, email providers such as Resend, hosting and infrastructure providers, database infrastructure such as Supabase Postgres, file and media storage such as Cloudflare R2, caching infrastructure such as Upstash, Google Maps and Places services used for venue addresses and photos, Google Calendar where a partner connects it, services that retrieve public product-page details for registry links, and analytics, logging, security, and customer support tools.

When a guest follows a retailer or affiliate link, the retailer receives ordinary web-request and referral information and may use cookies or similar technologies under its own privacy policy. Upward does not send the guest’s name, email, child information, or celebration identifier to the retailer as part of that link.

We share information between users only as needed for the service. Hosts see guest RSVP details; guests see event information shared by a host; gift recipients see gifting context. Partners receive the operational information needed to run a booking or a confirmed event — such as headcount and safety-relevant notes — not a family’s registry, gift, or guest contact details. Partner marketing reaches a guest only when that guest has separately consented, and consented leads do not include private contact details.

We may disclose information if required by law, court order, subpoena, regulatory request, safety concern, fraud investigation, rights enforcement, or business transfer such as a merger, acquisition, financing, reorganization, or sale of assets. We do not sell personal information.

Children and family information

Upward is intended for use by parents, guardians, adult guests, gift givers, and partners. Children should not create accounts or submit information directly. Parents and guardians are responsible for deciding what child-related information they add to Upward and for keeping that information accurate and appropriate.

We collect child-related information only as needed to provide the family, celebration, invitation, gifting, or booking features chosen by a parent or guardian. Parents and guardians may request access, correction, or deletion of child-related information by contacting hello@heyupward.com.

Because Upward handles family and child-related context, users should not add sensitive information that is not needed for the service. Allergy, dietary, accessibility, waiver, or safety notes should be limited to what is necessary for the relevant event or activity.

Cookies, analytics, and device data

Upward uses cookies and similar technologies to keep users signed in, secure sessions, remember preferences, support authentication, protect against abuse, understand service performance, and improve product reliability. Some cookies are essential for account security and cannot be disabled through Upward without affecting the service.

Browser settings may allow users to block or delete cookies. Blocking cookies may affect sign-in, celebration management, checkout, partner, or support features.

Retailers reached through registry or affiliate links may set their own cookies or use similar technologies after a guest leaves Upward. Those technologies are controlled by the retailer and described in the retailer’s privacy and cookie notices.

Retention and deletion

We keep personal information for as long as needed to provide the service, maintain accurate transaction and account records, support safety, resolve disputes, comply with legal, tax, accounting, fraud-prevention, and regulatory obligations, and enforce our agreements.

Retention periods vary by data type. Account records may remain while an account is active, payment and transaction records may be retained for legal and accounting reasons, support records may be retained to resolve issues, and event or invitation content may be retained until deleted by the relevant user or no longer needed for the service.

Users may request deletion by contacting hello@heyupward.com. Some information may be retained when required for legal compliance, fraud prevention, dispute resolution, security, backup integrity, or legitimate business records.

Security and international processing

Upward uses administrative, technical, and organizational safeguards designed to protect personal information, including access controls, authentication, encryption in transit, provider security controls, logging, and limited internal access based on operational need.

No online service can guarantee absolute security. Users should protect their own account credentials, use secure devices, and contact Upward promptly if they believe an account or invitation link has been misused.

Upward and its service providers may process and store information in Canada, the United States, and other jurisdictions where providers operate. Information may be subject to the laws and lawful access processes of those jurisdictions.

Access, correction, and deletion

Users may request access to personal information held by Upward, ask us to correct inaccurate information, request deletion where available, ask questions about our privacy practices, or withdraw consent for optional uses by contacting hello@heyupward.com.

We may need to verify identity before responding to a request. We may decline or limit a request where permitted or required by law, including when information must be retained for security, fraud prevention, legal, tax, accounting, dispute, or transactional record reasons.

Users may also update certain account, family, celebration, guest, and communication preferences directly inside the product when those controls are available.

Changes to this policy

We may update this Privacy Policy as Upward evolves or as legal, operational, security, or product requirements change. When we make material changes, we will update the effective date and provide additional notice when appropriate.

Using Upward after an updated Privacy Policy becomes effective means the updated policy applies to later use of the service.