Privacy Policy

This policy explains what personal information Wrap Party collects through its web application at wrappartyapp.com, why we collect it, and what happens to it. It applies to anyone who creates an account, is invited into a family’s Wrap Party account, or connects a service like Google to Wrap Party.

Wrap Party helps a family organize what someone else will eventually need to know — personal wishes, what exists, where it’s kept, and who to call — and keep it somewhere the right people can reach at the right time. Wrap Party is built to hold directions, not secrets: we don’t ask for passwords, account numbers, or copies of your documents. Because of what the product is about, what we collect is still personal, and this policy is written with that in mind rather than as a generic template.

Account information. Your email address, and if you sign in with Google, the name and email address Google shares with us. We don’t require a password to sign in — accounts are accessed through a passkey, a one-time emailed link, or Google sign-in.

Family and invite information. Who you’ve invited into your Wrap Party account, who has invited you, and the relationship between connected accounts.

The Keep. What you or a family member chooses to write down: personal wishes, a bucket list, notes about which accounts and services exist, where important things are kept, and who to contact. The Keep is designed for directions, not the things themselves. Please don’t store passwords, account numbers, or copies of identity documents in it.

Payment information. If you subscribe to a paid plan, our payment processor, Stripe, collects your card details directly. Wrap Party never receives or stores your full card number.

Technical and error data. We use Sentry for error monitoring so we can find and fix bugs. Session replay is turned off — we do not record or reconstruct what you saw on screen.

• To create and secure your account, and connect family members you invite
• To store and display what’s in the Keep to the people you’ve explicitly granted access to
• To process payments for paid plans, through Stripe
• To find and fix bugs, through error reports that exclude Keep contents
• To contact you about your account, security, or changes to this policy

We do not sell personal information. We do not use Keep contents to serve you or anyone else advertising.

Wrap Party’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Wrap Party uses Google only for sign-in: we receive your name and email address, and we do not request access to your Gmail, Drive, contacts, or any other Google data.

We share information only with the service providers who help us run Wrap Party, each bound to use it solely to provide their service to us:

• Supabase — hosts our database, handles authentication, and stores Keep contents
• Vercel — hosts the Wrap Party web application
• Stripe — processes payments for paid plans
• Google — provides sign-in, if you choose to sign in with Google
• Sentry — provides error monitoring, with session replay disabled

We share information with people you explicitly invite into your Wrap Party account, at the access level you set. We do not otherwise sell, rent, or share personal information with third parties for their own marketing purposes.

Database access is governed by row-level security, so an account can only reach data it has explicitly been granted access to. Information is encrypted in transit and at rest by our hosting providers. We log access to the Keep and changes to account permissions.

The strongest protection is not holding the most sensitive information in the first place. Wrap Party is designed so you never need to give us a password, an account number, or a copy of an identity document. The Keep records where those things are and who to ask, and the things themselves stay with your family.

While your account is active, we keep your information for as long as the account exists, so the Keep stays available to you and the people you’ve given access to.

If you delete your account, it’s deactivated immediately and removed from the systems you and your family interact with day to day. We keep it recoverable for 30 days, in case of a mistake, a change of mind, or a compromised account being restored by its rightful owner — after that window, it’s permanently deleted from our active database. Encrypted backups, which exist purely for disaster recovery, are purged on a rolling basis and fully cleared within 90 days of the original deletion.

If you ask us to delete your data directly rather than through the account-deletion flow, we’ll complete the request within 30 days.

Releasing the Keep after a death works differently from ordinary deletion, because releasing it — not deleting it — is the point. A contact you’ve designated in advance reports the death. For an account connecting more than one person, that report must also come with either an uploaded death certificate or a second, independently designated contact confirming it — a report alone is never sufficient. An account with only one designated contact always requires both the report and a certificate. We do not treat account inactivity, on its own, as evidence of death. A death certificate is reviewed by a member of our team on every submission and validated with the certificate’s issuing authority — never automated, never outsourced to a third party. Wrap Party only releases Keep contents to the specific people an account holder designated in advance.

If a death report is rejected — the certificate doesn’t verify, or the report doesn’t otherwise meet our requirements — we keep a record of the report, the evidence submitted, and the reason for rejection for two years, to guard against a repeat bad-faith attempt and to be able to account for the decision if it’s ever questioned. We always notify the account holder that a report was filed against their account, the same way we’d notify them of a suspicious login.

If you believe a release happened wrongfully — including a mistaken report or something you believe was fraudulent — the account holder or another of their designated contacts can file an appeal, which we review within 48 hours. Filing an appeal before a release completes immediately pauses the process. If Keep contents were already accessed before an appeal was filed, we cannot undo what was already seen or downloaded — we will lock down any further access, investigate, and notify everyone involved.

You can ask us to close your account and remove your data by contacting us at the address below.

Wrap Party’s primary database is hosted by Supabase in a Canadian data center (Canada Central region). If you are located outside Canada, your information will be transferred to and processed there.

Wrap Party is intended for adults managing their own or a family member’s affairs. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If we learn that we’ve collected information from a child, we will delete it.

If we make a material change to this policy, we’ll notify account holders by email before it takes effect. The date at the top of this page will always reflect the most recent update.

Questions about this policy or your data can be sent to legal@quietmagicsoftware.com.