Signup Hub

Privacy policy

Last updated: October 15, 2026

Who we are and what this policy covers

Signup Hub is operated by Sean McKenzie in the United States. Contact us at [email protected] about this policy or your personal information.

This policy explains how we handle information about website visitors, organizers, and guests, including people who sign up without an account. It covers our collection and use of information through Signup Hub and when you contact us. Our terms of service explain the rules for using Signup Hub.

We decide how information is used to operate accounts, maintain security, provide support, and administer the service. Where privacy law uses the term, we are the “controller” for those activities. Organizers decide why they collect information for their events. When we handle event information solely on an organizer’s instructions, we act on their behalf. This policy describes that handling, too; it does not replace a data processing agreement where one is required.

What we collect and why

Identity and access

Organizers provide a name and an email address or, when SMS is available, a phone number. We keep verification status, account preferences, and records needed to send and verify sign-in links and codes. If you enable passkeys or two-factor authentication, we store the credentials and settings needed to authenticate you. Passkey sign-in does not give Signup Hub your fingerprint or face scan.

Guests provide a name and an email address or phone number, their selected items or times, quantities, any contribution names, and optional notes. We record sign-up and cancellation history, reminder preferences, and relevant timestamps. We use this information to record commitments, update availability, deliver service messages, and let guests manage their sign-ups. A guest sign-up does not create an organizer account.

Guest identities are associated with an event. If you verify and link another contact method, we associate those methods with that event’s guest identity and may combine existing sign-ups for those verified methods in the same event.

Event content

We store event titles, descriptions, locations, dates, time zones, items, time slots, organizer details, display choices, and access settings. This includes drafts saved before registration. We use them to provide event creation, sharing, sign-ups, reminders, and management. Enter only information needed for the event. Do not include medical records, financial account details, or other highly sensitive records in descriptions or notes.

Billing

If you buy Pro, Paddle collects payment and billing information as merchant of record. Payment details are entered into Paddle’s checkout. Signup Hub does not store full payment card numbers or card security codes. We send Paddle the verified account email and identifiers needed to associate a purchase with your account.

We receive and store customer, subscription, and transaction information from Paddle to grant paid access and administer billing. This includes provider identifiers, status, amounts, currency, billing dates, and payment-method summaries where supplied. Stored billing notifications can also contain customer contact or address information. Paddle’s own use of purchase information is explained in its privacy policy.

Technical information and cookies

Our servers and infrastructure providers process technical information such as IP addresses, browser information, requested URLs, timestamps, and errors to deliver the service, prevent abuse, and diagnose problems. Diagnostic information can include account identifiers or information contained in a request. We do not ask your device for precise GPS location; an event location is information an organizer enters.

We use cookies and browser storage to keep you signed in, protect forms, remember access to password-protected events and your own sign-ups, continue drafts, and save appearance and navigation preferences. Some draft information is stored in your browser as well as on our servers. You can clear or block browser storage in your browser settings, but doing so can remove access to an unpublished draft or require you to sign in again. It does not delete information already saved on our servers.

When Cloudflare Turnstile is enabled, your browser sends technical signals to Cloudflare for bot detection, and our server sends your IP address and a verification token. Cloudflare also uses signals to improve its bot detection under its Turnstile privacy addendum. When you request checkout, we load Paddle’s script so you can complete your purchase. Paddle receives technical information while its script is active.

Signup Hub does not change its cookie behavior in response to browser “Do Not Track” signals. We do not use your information for advertising tracking across other websites. Embedded providers may collect technical information across visits or services under their own privacy policies, including the Paddle and Cloudflare policies linked above.

Messages and support

We process the recipient, content, and delivery information needed to send sign-in messages, confirmations, cancellation notices, recovery links, and reminders. We record SMS permission and opt-out preferences. Email bounce and spam complaint reports can stop reminders to an address across events. When you contact us, we use your contact information and correspondence to respond and keep a record of the issue.

AI-assisted support

We may use third-party AI tools to summarize support conversations, help draft replies, and troubleshoot reported problems. Those tools may receive relevant portions of your messages and account or event information needed to investigate the issue. We limit what we submit to the support purpose and avoid unnecessary personal information. AI providers may retain submitted information under the terms and settings of the service we use. Contact us if you have questions about AI-assisted handling of your support request.

Who can see event and sign-up information

People with an event link can see its published details, including the title, description, organizer name, location, schedule, requested items and times, and availability counts. Password-protected events require the password for those details, but display the event title before unlocking. A link or password may be forwarded. Search-engine exclusion is not an access control or a promise of secrecy.

The public event page does not display the guest list, guest contact details, or individual guest notes. Organizers can see counts and contribution labels while managing the event. Signup Hub stores guests’ contact details and commitments to provide event coordination and messages; do not treat a note submitted for an event as a confidential message to us.

Your private management link gives access to your guest details and sign-ups. Anyone you share it with may be able to see that information and change those sign-ups. Keep it separate from the public event link. Service emails may include the event contact’s name and email as a reply-to address, so a guest’s reply can go directly to that organizer.

An organizer’s independent collection or use of information outside Signup Hub is their responsibility. Copies recipients make, including emails or screenshots, are outside our control. Ask the organizer about their event practices and contact us about information held by Signup Hub.

When we access or disclose information

We access information as needed to operate the service, answer support requests, investigate errors or abuse, protect accounts, and meet legal obligations. Access should be limited to the information needed for the task.

We use service providers to operate Signup Hub. Depending on the features you use, the providers and information involved include:

  • Hosting and infrastructure providers: stored account and event information, databases, backups, and technical information needed to run the service.
  • Email and support providers: email addresses, message contents, correspondence, and delivery information for service emails and support.
  • Text-message providers and telecommunications carriers, when SMS is enabled: phone numbers, message contents, and messaging consent and delivery information needed to send texts.
  • Paddle: purchase and subscription information, and technical information received by its embedded script. Paddle also has its own responsibilities as the seller of your subscription.
  • Security and bot-detection providers: technical signals used to protect forms, detect bots, and investigate abuse, as described above.
  • Error-monitoring and performance providers, when used: diagnostic and performance information, which can include request and account information.
  • AI-assisted support providers, when used: relevant support messages and account or event information needed to help resolve a support issue, as described above.

We may disclose information when reasonably necessary to comply with applicable law or valid legal process, protect people’s safety, investigate fraud or abuse, or establish or defend legal claims. We limit disclosure to what the purpose requires. If the business is transferred or acquired, relevant information may transfer as part of that transaction, subject to applicable law and notice of material changes to its use.

We do not sell personal information or share it with advertisers for their advertising purposes, including cross-context behavioral advertising.

Mobile numbers and SMS consent information are not sold, rented, or shared with third parties or affiliates for their marketing or promotional use. They are shared only as needed to provide messaging, honor your choices, or meet legal obligations. SMS permission is not permission for unrelated marketing.

Your messaging choices

Guests can stop event reminders through their management page. Sign-up confirmations, cancellation notices, and messages you request for access or verification may still be sent. Stopping reminders does not cancel a sign-up.

SMS requires a separate affirmative choice. Reply STOP to stop texts to that number across Signup Hub, including verification codes. Text START to resume. We keep an opt-out record so we can honor that choice; closing an account does not automatically remove it. You can use email instead of SMS. To regain access after opting out, use an existing management link or previously linked email, or contact us.

Deletion and retention

We retain information for the purposes described in this policy, taking account of active events and accounts, support, security, billing obligations, and legal claims. Different records have different lifetimes. Canceling or hiding something in the interface is not always permanent deletion.

  • Unclaimed event drafts expire after 30 days of inactivity and are scheduled for cleanup. Browser-saved draft data may remain until you clear it. Older drafts containing stored image references require separate cleanup.
  • Canceling a sign-up keeps its cancellation history. Deleting an event hides its public page but retains the event and related sign-up records. There is currently no fixed automatic purge period for those deleted events while the organizer’s account remains open. Guests may still see their own history through their management link.
  • Successful profile deletion first archives the profile and personal events. Permanent cleanup becomes eligible after 30 days and also waits for any Paddle subscription to reach canceled status. This can take longer than 30 days, including when a paid period has not ended.
  • That cleanup removes the personal account and personal events and their related guest sign-ups. Events owned by an organization remain. Guest records in someone else’s events are separate and are not erased just because the guest deletes an organizer account.
  • Billing records and payment notifications, SMS consent and suppression records, support correspondence, authentication history, and operational logs may remain separately. A sign-in link or code expiring does not mean its record has been erased. Backup copies and provider records have their own retention arrangements.

For records without a fixed automatic deletion period, retention depends on whether the information is needed for ongoing service, an unresolved support issue, security or fraud prevention, opt-out enforcement, applicable recordkeeping requirements, or a dispute. Backup and provider retention can differ from retention in the main application. Contact us to ask about a particular record or request deletion; the 30-day profile cleanup rule does not mean every copy of every record is erased within 30 days.

To request erasure beyond the available controls, contact us. We may need to retain limited information for legal obligations, fraud prevention, opt-out enforcement, or legal claims. We will explain applicable exceptions when responding to a request. Deletion can make an account or sign-up unavailable. Information others have independently copied may need to be requested from them separately.

Security

We use access controls and verification to protect accounts and event management. Sign-in and guest recovery tokens are stored as hashes, and verification codes expire. These measures reduce risk but cannot guarantee that information will never be lost or accessed without authorization.

Protect your email account, phone, and private links. Contact us if you suspect a security problem. We will provide breach notices where required by applicable law.

Your rights and requests

You can update available profile settings and use your guest management link to edit available details, cancel sign-ups, or stop reminders. You can also contact us to request access, correction, a copy, or deletion of your personal information, even if you never created an account.

Depending on your location and applicable law, you may have rights to restrict or object to processing, obtain portable information, withdraw consent, use an authorized agent, appeal a denied request, and complain to a privacy regulator. Withdrawing consent does not undo processing already lawfully performed. We do not penalize you for exercising applicable privacy rights, although removing information needed for a feature can prevent us from providing it.

Send requests to the contact email at the beginning of this policy and describe the account or event involved. Do not send passwords or verification codes. We may reasonably verify your identity and an agent’s authority before disclosing or changing information. We respond within the time required by applicable law and explain a denial and any available appeal process. Where an organizer controls the information, we will help direct the request to them and assist as required; you can still contact us directly.

Where information is processed

Signup Hub is operated from the United States. Our service providers may process information in the United States and other countries where they operate, which may have different privacy laws. Limiting use of Signup Hub to U.S. adults does not mean that every provider processes information only in the United States. We remain responsible for complying with transfer requirements that apply to our handling of your information.

Children

Signup Hub is offered to adults age 18 and older in the United States. Children must not create accounts or submit their own information. An adult organizing or joining a family or school event should use their own contact details and avoid submitting children’s personal information. If you believe a child has provided personal information, contact us so we can investigate and take appropriate steps, including deletion where required.

Changes and questions

We will update this policy when our practices change. For material changes, we will provide notice through the service or an available contact channel and state the effective date. We will obtain consent where required before using previously collected information for a new purpose. Contact us using the details at the beginning of this policy with questions or concerns.

Adapted from the 37signals policies, licensed under CC BY 4.0. Substantially modified for Signup Hub. 37signals does not endorse Signup Hub.