Privacy at Ready, Set, Playdate

Ready, Set, Playdate operates Ready, Set, Playdate. This policy explains how we collect, use, disclose, retain and protect personal information when adult caregivers use our website, installable web app, events and support channels.

Information we collect

Account and contact information, including email, display name, optional mobile number and a broad home area.
Household information, including caregiver memberships and optional child nickname, age band and family symbol. We do not require a child’s last name, exact birthdate, school or home address.
Event activity, including RSVPs, party size, waitlist status, attendance, calendar actions, circles, meetup proposals and selected visibility choices.
Communications and safety information, including operational messages, delivery records, private feedback, moderation records, support requests and confidential safety reports.
Limited technical information needed for security and performance, such as IP-derived rate-limit identifiers, device/browser information, sanitized page paths and install or feature events. We remove arbitrary query strings, invite codes, sign-in tokens and email addresses from analytics URLs.

Why we use it

We use personal information to authenticate caregivers; provide household, RSVP, waitlist, circle and attendance features; reveal exact event details only to eligible signed-in members; send requested operational email or SMS; moderate community activity; respond to safety incidents; prevent abuse and fraud; operate support; improve reliability; and meet legal obligations. We do not sell personal information or use child information for targeted advertising.

Caregivers and children

Accounts are for adults who are at least 18. A caregiver supplies and controls any child-related information and must have authority to do so. Children should not create accounts or send information directly to us. If you believe a child has submitted personal information without appropriate caregiver involvement, contact us so we can investigate and delete it where appropriate.

How information is shared

Your display name and RSVP may be visible to signed-in members, selected circles or only your household according to the setting you choose. Approved event leads and operations staff receive the information reasonably needed to run an event, manage capacity or address safety. Contact details are shared between caregivers only after the product’s mutual connection flow and only in the channel each person selects.

We may disclose information when reasonably necessary to protect a person’s safety, investigate misuse, comply with law or legal process, complete a business transaction with appropriate safeguards, or work with professional advisers and insurers.

Service providers and processing locations

We use Supabase for authentication and data services, Vercel for hosting and privacy-filtered analytics, Google Maps Platform for venue search and maps, Resend for operational email, and Twilio for caregiver-requested operational SMS. These providers process information for us under their own security and privacy commitments. Although the primary database is configured in Canada, providers and their subprocessors may process or support information in Canada, the United States or other jurisdictions, where it may be subject to local law.

Email, SMS and device storage

Operational messages concern plans you joined or household activity. SMS is optional and requires an affirmative account choice; message and data rates may apply. You can turn SMS off in your account and use email instead. Your browser also stores essential authentication cookies and limited local preferences such as map/list view, install-prompt dismissal and the offline app shell.

Retention and security

We retain information only while it is reasonably needed for the purposes above. Account data is generally kept while the account is active. Event, attendance, moderation, audit and safety records may be kept longer when needed for platform integrity, insurance, fraud prevention, legal claims or legal obligations. When information is no longer required, we delete, aggregate or de-identify it; encrypted provider backups expire on their own backup cycle.

We use access controls, row-level database policies, encryption in transit, restricted service credentials, audit trails, rate limits and provider security controls. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected individuals and regulators as required by law.

Your choices and rights

You can update your profile and communication preference, choose RSVP visibility, withdraw optional consent, and request account deletion. You may also ask to access or correct personal information, ask how it has been used or disclosed, or raise a privacy complaint. We aim to complete verified deletion requests within 30 days, except for information we must retain for safety, fraud prevention, insurance, payment, legal claims or other legal obligations.

Changes and contact

We may update this policy as the service changes. We will post the revised date and seek fresh consent when a material change requires it.

Contact the privacy lead for Ready, Set, Playdate at support@readysetplaydate.ca. You may also complain to the Office of the Privacy Commissioner of Canada.