Privacy Policy

Thrown is a party-planning tool and a local vendor marketplace. To do that job we hold real information: your account, the parties you plan (including their street addresses), the guest lists you build, and the listings and reviews you publish.

Three things worth knowing before anything else:

• We do not sell your information, we do not run ads, and there is no third-party analytics or tracking pixel anywhere on Thrown. The only analytics are our own.
• Guest lists are information about people who may have never heard of Thrown. If someone put you in ours and you want out, email us and we will remove you. See “People who never signed up.”
• Uploaded images and videos are served from links that work for anyone who has them, and we do not reliably strip camera metadata (including GPS tags). Treat anything you upload as effectively public, and strip metadata yourself if it matters. See “Photos, videos, and what is inside them.”

Thrown is operated by Thrown LLC, based in New Jersey, USA. You can reach us about anything in this policy at hello@thrown.party, and you can reach a person through our About page.

This policy covers thrown.party and everything served under it, including the Thrown app. It describes what the product does today. A couple of features exist in the code but are switched off (for example, a party photo album); this policy does not describe them, and we will update it before turning any of them on.

Signing in. Thrown is passwordless: there is no password anywhere in the product, ever. You sign in with a one-time link or six-digit code we email you, with Google, or, in the Thrown app, with Apple. When you request a code we record the email you typed, the IP address the request came from, and, if a Google or Apple sign-in was waiting in your browser to be connected, which provider it was and a scrambled fingerprint of it that only tells us whether it is the same sign-in later; all of it is deleted automatically when the code expires, at most 15 minutes later. If you use Google sign-in, Google tells us your name, email address, whether that email is verified, your Google account ID and, for a Google Workspace account, the organization's domain (read only to decide whether that address can be trusted to match an existing account, and not stored). Nothing else, and not your profile picture. If you use Apple, Apple tells us your Apple account ID, your email (or a Hide My Email relay address, in which case mail we send you passes through Apple's relay), whether it is verified, and, the first time only, your name. When a Google or Apple sign-in matches no Thrown account, we ask whether you are new before making one; if you already have an account, you sign in to it another way (the emailed code, say) and can connect Google or Apple to it, and we then store that account ID on your Thrown account, noting that you connected it yourself. Creating an account asks you to tick a box agreeing to this policy and the Terms, and the date your account did so is recorded on it.

Your profile. Name, email, and optionally a phone number, location, bio, avatar, and social handles. You can also fill out an optional taste profile — vibes, palette, hosting energy, and a free-text note — which we use to personalize AI suggestions. You can delete your taste profile on its own, instantly, from your profile page, and you can delete the whole account from the same page (see “Deleting your data”).

Push notifications, in the Thrown app. If you allow notifications when the app asks (once, the first time you open the app signed in), Apple gives the app a device token, an identifier for that installation on that phone, and the app stores it with your account so we can notify you about things like a new RSVP. We keep the token, which phone platform it is, the app's version, and when that phone registered and last opened the app signed in; nothing else about the phone. Each kind of notification has its own switch on your profile page, and turning one off is honored before anything is sent. The app removes the phone's token when you sign out, and, if you were signed out while the app was closed, the next time it opens; deleting your account removes them all; and a token Apple reports as no longer valid is removed the first time we try it. A notification carries a title (the party's name), a short body and where in the app to open: for an answer, the guest's name and their answer; for a post on a party's wall, the author's name and the first line of the post; and never an address, a phone number or an email. Notifications about a party that is busy are grouped into one message with a count, and the bookkeeping for that (how many things you have not been told about yet, the newest one as a line, and who did it) is kept on your account until the notification goes out, then cleared; it is deleted with your account and with the party.

Your parties. Everything you type when planning: the party's name, description, date, street address, cover image, the planning intake (occasion, guest count, age mix, honoree, budget, free-text notes), planning notes, bring-board items, and the wall. Cover images on the manage page autosave — an upload can happen without you pressing Save.

Marketplace activity. Vendor listings (business name, contact details, street address, bio, gallery), rental listings and rental requests, reviews and comments (published under your real name), seller applications, purchases, and inquiries you send to vendors.

Your pack brainstorms. When you talk a party pack through with the planner, the conversation is saved with the pack — your messages, its replies, and which of its suggestions you applied — so the thread is still there when you come back. It is private to whoever owns the pack, and it travels with the pack if the pack ever changes hands.

Links you hand to vendor onboarding. If you build a business listing from a link, our servers fetch that page once and read it to fill in the draft. Before fetching anything we read the site's robots.txt, the file a site uses to say what automated visitors may look at, and if it says no then we do not fetch the page. We only ever request the address you typed, and what we extract is sent to OpenAI once to write the draft. Nothing is published until you have looked at it.

Instagram and Facebook are not read at all, here or anywhere else in Thrown. Both tell automated visitors to stay out, so we make no request to either: paste a profile and we keep the handle, which is sitting in the link itself, and nothing else. We built a reader for those profiles in September 2026 and removed it once we looked properly at what they ask for.

Feedback. The feedback box works even when you are signed out. It stores your message, an email address only if you choose to give one, a screenshot if you attach one, and the page you were on, your browser and your device — those last three go with every note, so that a report like “the button does not work” is something we can actually chase. It deliberately records the path only, never the address bar's query string, because query strings on Thrown can carry invite and sign-in links. A screenshot is readable only by an administrator, is not reachable by link the way a listing photo is, and is deleted outright if you delete your account.

This section exists because it is the biggest thing a policy like this usually buries. When you build a guest list, you are giving us names, phone numbers, and email addresses of people who have no Thrown account, got no notice, and may not know we hold anything about them. We think you should know exactly what happens to that information, and the people on those lists should have a way out.

• How guest details arrive: hosts paste them, import them from a file, pick them from their phone's address book, or type them. Guests can add plus-ones by name. Someone with a shareable party link can RSVP as a walk-up by typing their own name and a phone number or email.
• When you import a contacts file, the file is read inside your browser and never uploaded. In the Thrown app you can pick people out of your phone's address book instead: the app asks your phone for permission first, and the address book is listed and searched entirely on the device. Whichever way you import, only the rows you tick are sent to us — nothing else about your contacts leaves your phone or your browser.
• We use guest details for exactly one thing: running the party. Invites, RSVPs, headcounts. Guest names are never included in anything we send to AI providers — we checked.
• If a host sends invites through Thrown, we email the guests via our email provider, from Thrown's address, with replies going to the host, or text them through our messaging provider, from Thrown's number (see “Text messages”). We record when an invite link is first opened, and which send channel the host tapped on their own phone (text, email, share sheet, or copying the link) — for those we record the tap, not delivery.
• Hosts can export their own guest list as a CSV, including each invite's opened status.
• If you are on a guest list and want off: ask the host to remove you (they can, per person), or email hello@thrown.party and we will remove your details from the guest-list rows we hold. We will also tell you what we have if you ask. You should not need an account to get out of our database.

Thrown can text party invitations. A host can invite their guests by text, and a guest who adds themselves on a party's RSVP page can check a box asking to be texted. Our SMS Terms, at thrown.party/sms, describe that program in full, including exactly how people opt in. This is what it means for your information.

• What we hold: the mobile number on the guest list (the host typed it, or you did) and, if you checked “Text me about this party” yourself, when you did. When we text a number we record when, the message ID our messaging provider gives back, and the delivery status the carrier reports (sent, delivered, or failed). We also keep, for each number we have texted, the date of the last text that says how to opt out and reached it, so that a later text can go without that line and without “Thrown:” in front; it is the number and that date, it is kept apart from any guest list, and it deletes itself 30 days after that date. We do not keep a copy of each message: every invitation is the same few words with your own link in it.
• Who else handles it: Twilio, our messaging provider, delivers each text, so it receives the number and the message, as do the mobile carriers the text passes through.
• What we use it for: sending the invitation texts the SMS Terms describe, and nothing else. We never send marketing by text.
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text message opt-in data and consent are never shared with any third party.
• Message frequency varies, and it is usually one text per party. Message and data rates may apply. Reply STOP to any text to stop them, or HELP for help.
• Replying STOP puts your number on our do-not-text list, so no host on Thrown can text you through us again, and replying START takes it off. If you ask us to delete your details, we delete the date described above along with them, and we keep that one do-not-text entry (the number and when it opted out), because deleting it is the one thing that would let texts start again. If you want it gone anyway, say so and we will remove it.

Thrown connects people, so some sharing is the product working — but you should never be surprised by it.

The same principle applies wherever you appear in someone else's records on Thrown: reviews name the person or business they are about, vendor inquiries carry the host's details to the vendor, and rental requests go to the listing's owner. The email address in this policy is your route to us about any of it.

• When you send an inquiry to a vendor, the inquiry carries your name and your account email, and in most cases your account phone number, so the vendor can reply. If the vendor takes bookings by text or call, the form asks you for a number directly. Vendors can export their inquiries, and can keep private notes about them.
• When you request a Thrown coordinator (white glove), we attach your name, email, phone, and a snapshot of the party, and email it to our coordinators.
• When you send a rental request, your contact details and message go to the listing's owner.
• Reviews and comments are public, indexable, and carry your real profile name and avatar. If you report a review or comment, we record that you were the reporter.
• Vendors control whether their listing shows the business email, phone, and street address. Hiding a field removes it from what we send to the browser, not just from the page. Fields are visible unless the vendor hides them.
• Party pages are not public. A party is visible to its host, cohosts, guest list, and people holding a valid invite link — everyone else, including search engines, gets a page that does not reveal the party exists. Publishing a party pack strips the private half: no guest list, no address, no invoice amounts.
• A published party pack is credited to you by name: public packs carry a “Coordinated by” line with your profile name and a link to your profile. If you would rather publish without that, the pack's settings have a “Publish anonymously” switch, which keeps your name off every public surface the pack appears on.

Two different things happen with location on Thrown, and they are not the same.

City-level location. Most “use my location” buttons, and the marketplace, work at city scale. Coordinates are rounded to roughly a kilometer before we store or send them, and your chosen area is kept in a thrown_location cookie for up to a year so we can default your searches. That cookie is readable by scripts on the page. If you have previously granted location permission, parts of the app may read your (rounded) position without a fresh prompt; the location picker's Reset button turns that off.

The party address. When you use your device's location to fill in a party's street address, we ask the operating system for a real GPS fix — precise, not the cached city-level one — and send the unrounded coordinates to our mapping provider (Mapbox) to resolve them into an address. Under California law that momentary fix is “precise geolocation,” which is treated as sensitive information, so we want to be exact about it: the coordinates themselves are not stored — the resolved street address is, on the party, and it is printed on the invite. If you would rather not use a GPS fix at all, type the address instead.

Be careful with uploads. Here is exactly why.

• Files you upload — avatars, party covers, vendor galleries, pack images — are served from URLs that require no sign-in. Anyone holding a file's URL can open it, and copies may be cached for up to a year. Party pages themselves are private; the image URLs on them are not. Treat anything you upload as effectively public.
• We do not reliably remove camera metadata. Larger photos get re-encoded on the way in, which drops metadata as a side effect — but smaller files (roughly under 0.6–1.2 MB depending on the upload) are stored byte-for-byte as your camera produced them, GPS tags and all. Images a vendor imports from a web URL are never re-encoded.
• Videos are never re-encoded at all. A clip from a phone camera typically carries the GPS coordinates of where it was filmed inside the file, and it will still carry them on Thrown.
• If where a photo or video was taken is sensitive — and for pictures taken at your home, it usually is — strip the metadata on your device before uploading. Most phones offer “remove location” when sharing.

The planner and the writing tools run on outside AI services, and it matters what reaches them.

• What we send to OpenAI: your planning intake (occasion, guest count, age mix, venue type, budget, food plan), your free text (descriptions, themes, notes, cover briefs), the party's date and location text — which for a party can be its street address — the honoree's name where you gave one, and any inspiration photos you attach, at full resolution. Inspiration photo bytes are sent for reading and not stored by us. If you type a party description on our landing page and continue into the pack builder, that sentence is sent when the builder loads.
• What we send to OpenAI from the marketplace: if you draft a vendor listing from a link, the text we pulled off that page; if you describe your business in your own words instead, that description. Either way it is one call, to write a draft you then edit.
• What we send to OpenAI when you brainstorm a pack: your messages in that conversation, the pack's own text, and the brief it was planned from, which for a party can include its location text. The conversation is saved with the pack, as the section above says.
• What never goes to AI providers: your guest list. Guest names do not appear in any prompt.
• Saving your taste profile sends its vibes, palette, and note to Voyage AI to compute the vectors that personalize your results; deleting your taste profile deletes the vectors. Separately, our database's search feature sends the public text of listings and packs (titles, taglines, descriptions) to Voyage to make search work — that path carries catalog text, not your personal details.
• How long OpenAI keeps it: under their API terms, what we send is not used to train their models, and they hold it for up to 30 days for abuse monitoring before deleting it. We ask them not to store our requests beyond that, and we have not arranged zero retention, which removes the 30-day copy as well and has to be granted by OpenAI rather than switched on by us. If we get it, this paragraph will say so.
• You can opt your taste profile out of AI personalization from your profile page.

There is no Google Analytics, no Meta pixel, no session recording, and no third-party tracker on Thrown. What exists is our own, and here is all of it.

• Page views on public things (vendor listings, packs, rentals) and paywall impressions are counted once per viewer per day. We never store coordinates in analytics.
• If you are signed in, your views and your marketplace searches — including the raw text you typed into search — are stored linked to your account. Analytics rows are deleted automatically after about thirteen months.
• The address of the page that referred you is stored as-is.
• Signed-out visitors are counted under a random ID (thrown_aid) kept in your browser's localStorage. It never expires on its own and, because it is not a cookie, it survives clearing cookies; clearing the site's data in your browser removes it. There is currently no in-app control to reset it.
• We drop the event entirely when you are viewing your own listing, and the endpoint answers identically whether or not a page exists, so it cannot be used to probe for private parties.

The complete list: ten cookies, plus what lives in your browser's local storage and session storage.

• session — keeps you signed in; 7 days in a browser and 30 days in the Thrown app, extended each day you keep using Thrown; not readable by scripts.
• guest_pass — lets invited guests view and RSVP without an account; 30 days; not readable by scripts. This one is minted for people with no account.
• thrown_location — your chosen search area (label plus city-rounded coordinates); 1 year; readable by scripts on the page.
• email_signin, google_oauth, apple_signin, and google_native: short-lived sign-in plumbing (15, 10, 10, and 10 minutes; the last two exist only in the Thrown app).
• held_signin: when a Google or Apple sign-in matches no Thrown account, holds what that provider told us (your account ID with it, your email, whether it is verified, and your name) while you choose between a new account and the one you have; 15 minutes after your last step (that sign-in, asking for a code, or signing in another way), and never more than 40 minutes after that sign-in; signed, and not readable by scripts. It is deleted as soon as you choose.
• thrown_opened_packs — remembers which packs you have already “unboxed” so the animation does not replay; expires with your session.
• thrown_app_card — remembers that you closed the “Get the Thrown app” card on a party page, so it stays closed; 1 year; readable by scripts on the page. It is only ever set on an iPhone or iPad.
• localStorage holds your theme choice, the thrown_aid analytics ID described above, unsaved drafts, and, in the Thrown app only, thrown_push_token, the phone's own push notification token, kept so the app can remove it from our servers when it finds itself signed out. A party draft can contain the whole party — including its street address — and although drafts expire after 24 hours when the app next reads them, an abandoned draft sits in your browser until then or until you clear site data. Drafts live in your browser, not on our servers.
• sessionStorage (cleared when the tab closes) holds small flow state: the sentence you typed on the landing page, a location opt-out flag, and per-party panel positions.

Twelve outside services process data to make Thrown work. All are US companies. We do not sell or rent data to any of them or anyone else.

One thing that is not on this list, because none of it is a processor: three places in Thrown fetch a page or a file from whoever hosts it, on your behalf. Giving vendor onboarding a link fetches that page to draft your listing. Pinning a link to a pack fetches it for the picture that goes on the card. Adding a photo to a listing by pasting its address fetches that file so we can host our own copy rather than hotlinking yours. In all three the host sees a request coming from Thrown, and we tell them nothing about you beyond the request itself.

All three ask permission first. Before fetching we read the site's robots.txt, the file a site uses to say what automated visitors may look at, and if it says no then we do not fetch. That is why we never fetch an Instagram or Facebook page ourselves: both refuse automated visitors, including the servers that hold their images, so a link to either is kept as text and a picture on one of them cannot be imported. The only way Thrown ever reads either is the Meta connection described above, which happens through Meta's own API and only if you choose to connect the account.

• MongoDB Atlas — the database. Everything described in this policy lives there.
• Vercel — hosting, and the storage behind uploaded files (see the photos section for how those are served).
• OpenAI — the AI planner and writing tools (see the AI section for exactly what is sent).
• Voyage AI — the embeddings behind personalization and search.
• Mapbox — turns typed locations and device fixes into places, including the precise party-address path described above.
• Stripe — all payments. Card numbers are entered on Stripe's pages and seller identity and banking checks happen on Stripe's onboarding; none of that ever reaches Thrown. We store transaction IDs, amounts, and payout status only.
• Resend — sends every email we send: sign-in codes, invite blasts, coordinator notifications, the mail a business gets about its own listing (approved, rejected, an owner invite), and the alerts you can switch on and off in your profile: a host inquiring, a rental request and the answer to one you sent, and a new review. Sign-in and account mail always come through.
• Twilio — sends the party invitations Thrown texts, so it receives each guest's number and the text of the message, and tells us whether the carrier delivered it. Only when a host invites by text; see “Text messages”.
• Google — only if you choose Google sign-in.
• Apple — if you choose to sign in with Apple in the Thrown app, and, if you allow notifications there, to deliver them: a push goes from our servers to Apple's notification service and from there to your phone, so Apple sees the device token and the text of each notification.
• Meta (Instagram and Facebook) — only if you choose to connect an account while building a business profile. With your permission we read that account's profile, bio, links and recent photos once, through Meta's own API, keep what we read for thirty minutes while you finish, and never keep the login. We never fetch Instagram or Facebook pages on our own.
• Unsplash — inspiration photos on pack boards. These are loaded by your browser directly from Unsplash, so Unsplash sees your IP address for those image requests, the same as if you visited their site; we configure those requests not to tell Unsplash which page you were on.

We would rather tell you the real shape of this than a tidy fiction. A few things delete themselves; most things we keep until you or we delete them.

• Deleted automatically: sign-in codes and the IP recorded with them (15 minutes), a business profile read from a connected Instagram or Facebook account (30 minutes), rate-limiting entries keyed on your IP or email (minutes to a day), analytics (about thirteen months), and payment-webhook bookkeeping (90 days).
• Kept until deleted: your account, profile, parties, guest lists, listings, packs, reviews, and most everything else. Purchase records are kept indefinitely on purpose, as financial records.
• A push notification token is kept while that phone stays signed in: signing out on the phone removes it, deleting the account removes every one, and one Apple reports as dead is removed the first time we try to use it.
• A text we sent is recorded on the guest-list row it went to (when, the message ID, the delivery status) and goes when that row does. The date a number was last shown how to opt out is deleted 30 days later. A number that replied STOP stays on the do-not-text list until it replies START, as “Text messages” explains.
• A pack's brainstorm transcript lives exactly as long as the pack does: deleting the pack deletes the conversation with it, and a pack that changes hands takes the conversation along. A block lasts until you lift it or until either account is deleted.
• Vendor inquiries, rental requests, coordinator requests, seller applications, and feedback have no automatic cleanup. Deleting your account takes your name, email and phone off the inquiries and requests you sent, deletes your seller application, and unlinks your feedback from you; the business or coordinator keeps the rest of the record. If you want one of these gone without closing your account, email us and we will delete it by hand.
• “Delete” on a party or pack in the app hides it and makes it restorable; it is not erased from the database until it is permanently deleted. If you want a party actually gone, delete its invitees and ask us for a hard delete. Deleting your account is the exception: the parties you host alone and your private packs are erased outright, guest lists included.

You can delete your account yourself, from the bottom of your profile page. It takes effect immediately, signs you out everywhere, and needs no email. Here is exactly what happens, because “delete” means different things for different kinds of record:

• Deleted outright: your profile (name, email, phone, avatar, social handles, location), your taste profile and its vectors, your saved packs, your coordinator access, your seller application, any outstanding sign-in codes, the push notification tokens of every phone you allowed notifications on, the bookkeeping behind your pending push notifications (and your name is withdrawn from anyone else's pending notification about something you did), and every block — the ones you made and the ones other people made about you, since a block means nothing once either side is gone.
• Your parties: a draft is deleted. A published party you host alone is deleted with its guest list, its wall, and any coordinator request. A published party with a co-host is handed to that co-host, and you leave its guest list.
• Other people's parties: your RSVPs, your bring-board claims, and your co-host and invite memberships are withdrawn. Comments you posted on their walls stay, attributed to “Former member” with no link back to you.
• Your Party Packs: private ones are deleted. Public approved packs, and any pack somebody has bought, move to Thrown's own house account so links and purchases keep working; a pack that was for sale stops selling. A pack that moves — to the house account, or to a co-host along with its party — takes its brainstorm transcript with it, so treat that conversation as part of the pack rather than as a private note to yourself.
• Reviews you wrote stay on the business or pack they were about, attributed to “Former member”; reviews other people wrote about you are deleted with your profile.
• Inquiries you sent to vendors, rental requests, and coordinator requests you filed on someone else's party keep the message and lose your name, email and phone. An open rental request is cancelled.
• Purchase records are kept as financial records; once your profile is gone nothing on them identifies you. A checkout you started but never finished is cancelled, and so is any unfinished checkout on a pack of yours. Stripe keeps its own records of payments and of any seller account under its own terms.
• Four things stop a deletion until they are sorted out, and the page tells you which: a business listing you own that is live in the marketplace (hide it or hand it to a co-manager first), a seller balance Stripe is still holding (wait for the payout), a payment that has gone through but not been recorded yet (a few minutes), and an admin role (another admin removes it first). If anything else is in the way, email hello@thrown.party and we will finish by hand.
• Also deletable on their own: your taste profile (instantly), a vendor listing that has never been published (from its manage page), individual guests from your own guest lists, and your parties, packs, and rental listings.
• You can see and correct your profile, parties, listings, and packs in the app. For a copy of everything we hold about you, email us.
• Renaming your profile updates your name across the app's live surfaces.
• You can block another person. That records one row — who blocked whom, and when — and does two things: their wall posts, comments and reviews stop appearing for you, and they can no longer leave or edit one on anything you own. It works in your direction only: blocking someone does not hide your posts from them. They are not told they were blocked, and you can lift it from the blocked list on your profile.

We do not sell personal information, and we do not share it for cross-context behavioral advertising — there is no advertising on Thrown at all. The disclosures that do happen (your details to a vendor when you inquire, to a coordinator when you ask for one, to a listing owner when you request a rental) happen because you pressed the button that does that thing, and the sections above describe each one.

Thrown is a small, new business, and some privacy statutes only kick in at thresholds we may not meet. We do not think your rights should depend on that. Whoever you are and wherever you live, you can ask us to tell you what we hold about you, correct it, or delete it, by emailing hello@thrown.party — and that includes people who never signed up. We will not treat you worse for asking. If California's rules on sensitive information apply to the party-address location path, the Location section describes exactly what that path does.

Thrown is built and hosted in the United States. If you use it from elsewhere, your information will be processed in the US.

Everything above describes information you chose to share by pressing a button. This section is about the one disclosure you do not choose: a government agency, police force, or court asking us for your information. We disclose personal information to a public authority only when we are legally required to, and only after someone at Thrown has reviewed the request and confirmed it is valid — that it really came from the authority it claims, that it is the kind of legal process that can compel us, and that it names the person and the information it is after. An email from an official asking nicely is not legal process, and we do not act on it.

When a request is overbroad, has no legal basis, or asks for more than the law requires, we push back: we ask for it to be narrowed, and where it is warranted we challenge it with our lawyers. When we do have to disclose, we disclose the minimum — the specific information the request compels, about the specific people it names, and nothing else. We never hand over a database, and we take particular care with guest lists, because most of the people on one never signed up for Thrown and a request about a host is not a request about their guests.

We keep a record of every request we receive: who asked, what they asked for, what we decided and why, and what, if anything, we disclosed. We will tell you before we disclose your information unless the law forbids it or someone is in immediate danger, and if we are forbidden from telling you at the time, we will tell you once we are allowed to. The one exception is an emergency: if we believe in good faith that disclosing information is necessary to prevent imminent death or serious injury, we may do so without waiting for legal process, and we record that decision like any other.

Thrown accounts are for adults 18 and up. Parties for children are welcome; accounts for children are not.

Because of what Thrown is, hosts do give us children's information — a kid's birthday party's guest list is mostly children's names, supplied by the adults hosting it — and we treat it accordingly: we use it only to run the party, we never put guest names into AI prompts, and when a party's intake says the audience is children we additionally use that fact to keep AI-generated party art age-appropriate (for example, no alcohol imagery).

A parent or guardian can have a child's information removed by emailing us, whether or not they have an account. We do not knowingly collect information directly from children under 13; if you believe a child has created an account or submitted their own information, tell us and we will delete it.

There are no passwords on Thrown, so there is no password of yours to breach — sign-in is by emailed link or code, by Google, or in the Thrown app by Apple, which means your Thrown account is as safe as the account you sign in with, so protect that. A sign-in link or code works once, expires after fifteen minutes, and we store only a hash of it. A session lasts 7 days in a browser and 30 days in the Thrown app, and is extended while you keep using Thrown, so you are signed out only after that long without a visit. The session cookie is signed and cannot be read by scripts in your browser.

Guest invite links are private capabilities: anyone holding one can open the invite it belongs to, so guests should treat their link like a ticket, and hosts should share the general party link rather than a specific guest's. We record the IP a sign-in code was requested from, for 15 minutes, to fight abuse, and briefly key our rate-limiting on IPs and emails for the same reason.

No system is perfect, and we would rather tell you where the edges are than imply there are none — that is what the photos section above is for.

When we change this policy in ways that matter — new data, new sharing, new AI flows, or turning on a feature this policy says is off — we will update the date at the top and say what changed, and for significant changes we will tell signed-in users in the app or by email before the change takes effect. The current version is always at thrown.party/privacy.

Questions, requests, or something in here that worries you: hello@thrown.party. You can also reach a person through our About page.