Privacy Policy

Last updated: 2026-10-02. Plain-English summary first, specifics below. We keep this short on purpose: we store very little.

The short version

Invitatu needs no account, no email and no personal details from children. Playing a game stores nothing about you except what your own browser keeps locally. Creating an invitation stores only the party details you type. Payments for the $5 share unlock are processed by PayPal; we never see or store card numbers.

What we store

Invitation data. When a creator builds an invitation we store the game configuration they entered: the birthday kid's first name (as typed), party date, time, location text and the chosen theme, plus a random invite code. This data exists to render the invitation and is automatically treated as expired - and no longer served - 2 days after the event date. It is never used for anything else.

Aggregate analytics. We log lightweight page/game events (page view, game played, share-gate shown, share completed, invitation created) with a page path, an optional attribution tag from a shared link, and coarse timing. Your IP address is used transiently to rate-limit abuse and is not stored alongside events or sold. No third-party ad trackers, no advertising pixels, no fingerprinting.

Payment records. If you pay the one-time $5 share fee, PayPal processes the payment. We store the PayPal order/transaction ID, amount and status so we can honor and re-honor the unlock. Card details never touch our servers.

Your browser's local data. The games save your highest unlocked level and a small signed unlock ticket in your browser's localStorage so progress and paid unlocks survive refreshes. Clearing site data removes them; that is your device's choice, not ours.

Cookies

We do not set tracking cookies. Functionality may use same-site cookies for rate-limiting only. No cross-site or advertising cookies exist on invitatu.app.

Children

Invitatu is a play-and-share tool for family use. Children's play sessions create no accounts and require no personal information; the only kid-related text is what a parent/creator voluntarily types into an invitation. We do not knowingly collect personal data from children beyond that creator-entered invitation text, which exists solely to display the invitation.

Hosting and subprocessors

The site is self-hosted on a single VPS. PayPal, Inc. handles payment processing. No analytics or advertising networks are involved.

Your choices

Ask us to delete an invitation (and its stored text) any time at support@invitatu.app, including before its automatic expiry. You can decline analytics by using browser privacy features; the games work regardless. Requesting removal never breaks a played game link that guests still hold before expiry, but the deleted invitation will stop loading.

Changes and contact

If this policy changes materially we will update the date above. Questions: support@invitatu.app.