Privacy Policy

This policy explains what personal information Wrap Party collects through its web application at wrappartyapp.com, why we collect it, and what happens to it. It applies to anyone who creates an account, is invited into a family’s Wrap Party account, or connects a service like Google to Wrap Party.

Wrap Party helps a family organize what someone else will eventually need to know or access — account inventories, personal wishes, and important documents — and store it somewhere it can be reached by the right people at the right time. Because of that purpose, some of what we collect is unusually sensitive, and this policy is written with that in mind rather than as a generic template.

Account information. Your email address, and if you sign in with Google, the name and email address Google shares with us. We don’t require a password to sign in — accounts are accessed through a passkey, a one-time emailed link, or Google sign-in.

Family and invite information. Who you’ve invited into your Wrap Party account, who has invited you, and the relationship between connected accounts.

The Keep. Anything you or a family member chooses to store — account inventories, credentials, personal wishes, and documents such as identification or death certificates. This is the core purpose of the product, and it is the most sensitive category of data we hold.

Payment information. If you subscribe to a paid plan, our payment processor, Stripe, collects your card details directly. Wrap Party never receives or stores your full card number.

Technical and error data. We use Sentry for error monitoring so we can find and fix bugs. Session replay is turned off — we do not record or reconstruct what you saw on screen.

Wrap Party’s “footprint reveal” feature is optional and requires you to actively connect a Gmail account. If you do, we request read-only access to your Gmail messages and settings, which we use only to identify which online accounts and subscriptions are tied to that inbox — for example, by scanning for confirmation and billing emails from services you use. We do not read, store, or display the content of your emails; we extract account-identifying signals and discard the rest.

You can disconnect this access at any time from your Wrap Party account settings, or directly from your Google Account permissions page. Disconnecting stops all further access immediately.

• To create and secure your account, and connect family members you invite
• To store and display what’s in the Keep to the people you’ve explicitly granted access to
• To run the footprint-reveal scan you’ve chosen to connect, and show you the results
• To process payments for paid plans, through Stripe
• To find and fix bugs, through error reports that exclude Keep contents and credentials
• To contact you about your account, security, or changes to this policy

We do not sell personal information. We do not use Keep contents or Gmail data to serve you or anyone else advertising.

Wrap Party’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: the use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. In practice, this means:

• We do not sell Gmail data to any third party
• We do not use Gmail data to serve advertising, of any kind
• We do not use Gmail data to determine creditworthiness or for lending decisions
• We do not transfer Gmail data for use in training general-purpose AI or machine-learning models
• No human at Wrap Party reads your Gmail data, except with your specific, affirmative agreement for that instance — for example, if you ask our support team to help debug a scan that isn’t working correctly

We share information only with the service providers who help us run Wrap Party, each bound to use it solely to provide their service to us:

• Supabase — hosts our database, handles authentication, and stores Keep documents
• Vercel — hosts the Wrap Party web application
• Stripe — processes payments for paid plans
• Google — provides sign-in and, if you connect it, the Gmail footprint-reveal scan
• Sentry — provides error monitoring, with session replay disabled

We share information with people you explicitly invite into your Wrap Party account, at the access level you set. We do not otherwise sell, rent, or share personal information with third parties for their own marketing purposes.

Database access is governed by row-level security, so an account can only reach data it has explicitly been granted access to. We log access to the Keep and changes to account permissions. We are actively working to strengthen encryption protections for Keep contents specifically, and will update this section with the finished details as that work is completed.

While your account is active, we keep your information for as long as the account exists, so the Keep and footprint-reveal results stay available to you and the people you’ve given access to.

If you delete your account, it’s deactivated immediately and removed from the systems you and your family interact with day to day. We keep it recoverable for 30 days, in case of a mistake, a change of mind, or a compromised account being restored by its rightful owner — after that window, it’s permanently deleted from our active database. Encrypted backups, which exist purely for disaster recovery, are purged on a rolling basis and fully cleared within 90 days of the original deletion.

If you ask us to delete your data directly rather than through the account-deletion flow, we’ll complete the request within 30 days.

Releasing the Keep after a death works differently from ordinary deletion, because releasing it — not deleting it — is the point. A contact you’ve designated in advance reports the death. For an account connecting more than one person, that report must also come with either an uploaded death certificate or a second, independently designated contact confirming it — a report alone is never sufficient. An account with only one designated contact always requires both the report and a certificate. We do not treat account inactivity, on its own, as evidence of death. A death certificate is reviewed by a member of our team on every submission and validated with the certificate’s issuing authority — never automated, never outsourced to a third party. Wrap Party only releases Keep contents to the specific people an account holder designated in advance.

If a death report is rejected — the certificate doesn’t verify, or the report doesn’t otherwise meet our requirements — we keep a record of the report, the evidence submitted, and the reason for rejection for two years, to guard against a repeat bad-faith attempt and to be able to account for the decision if it’s ever questioned. We always notify the account holder that a report was filed against their account, the same way we’d notify them of a suspicious login.

If you believe a release happened wrongfully — including a mistaken report or something you believe was fraudulent — the account holder or another of their designated contacts can file an appeal, which we review within 48 hours. Filing an appeal before a release completes immediately pauses the process. If Keep contents were already accessed before an appeal was filed, we cannot undo what was already seen or downloaded — we will lock down any further access, investigate, and notify everyone involved.

You can disconnect a connected Gmail account at any time, with immediate effect. You can ask us to close your account and remove your data by contacting us at the address below.

Wrap Party’s primary database is hosted by Supabase in a Canadian data center (Canada Central region). If you are located outside Canada, your information will be transferred to and processed there.

Wrap Party is intended for adults managing their own or a family member’s affairs. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If we learn that we’ve collected information from a child, we will delete it.

If we make a material change to this policy, we’ll notify account holders by email before it takes effect. The date at the top of this page will always reflect the most recent update.

Questions about this policy or your data can be sent to legal@quietmagicsoftware.com.