Privacy

The short version. VOW has no account and no readable copy of your wedding anywhere but your phones. Everything you put into VOW is kept on your iPhone. When you link your phones with your partner, each change is locked on your phone before it's sent, and only your two phones can unlock it. Our postbox just passes locked changes along; it can't read them, has no accounts, and deletes everything once it's been quiet for 90 days. We can't see your wedding, we don't sell it, we don't show ads, and VOW has no analytics or tracking. Your written Heart answers and your photos never leave your phone. Feedback and diagnostics are sent only when you tap Send.

Who we are

VOW is made by Driftwood Labs Pty Ltd (ACN 703 905 293, ABN 27 703 905 293), a company based in Victoria, Australia ("we", "us"). This policy covers the VOW iPhone app and vowmaison.com. Questions about your information: welcome@myspencer.ai. We follow the Australian Privacy Principles in the Privacy Act 1988.

What's on your phone

VOW keeps everything in its own storage on your iPhone. There's no sign-up: we never ask for your email address or a password. On your phone, VOW holds:

• Your wedding: your two names and the date.
• Your Heart: your answers to the private reflection.
• Your plan: everything you write in the planning sections, such as the venue, guest list, budget, suppliers and run sheet.
• Photos you add, such as mood boards and venue photos.

Your guest list may include other people's names and details. Please only add what you need to plan the day.

What we hold

Nothing we can read. We have no readable copy of your wedding, your plan, your photos or your Heart, and no way to see them. If your phones are linked, our postbox briefly holds your latest changes in locked form (see below), and only your two phones have the key. If you email us, we have your email and whatever you choose to tell us, and we use it only to reply.

What passes between your two phones

You can keep your phones in step two ways.

• Scanning each other's code, in person. Each phone scans a code shown on the other's screen. The information goes straight from one phone's screen to the other phone's camera, without the internet. The code also carries your link key, so scanning links your phones.
• Linked phones. Once linked (by scanning, or by an invite with a short code that you text your partner), every change either of you makes reaches the other phone straight away, even when you're apart. Each change is locked on your phone with a key that only your two phones hold, then passed through our postbox to your partner's phone.

Either way, what's shared is:

• Your plan, your two names and the date.
• Once you have both finished your Hearts, only the multiple-choice Heart answers VOW needs to compare them. VOW then shows the two of you where you already agree and what's worth a conversation, never the answers themselves. Your written Heart answers, and a Heart you haven't finished, are never shared.

Photos aren't shared. They stay on the phone that added them.

Our postbox

Linked phones pass their changes through VOW's own postbox, which runs on Cloudflare. It only ever holds locked changes: it can't read them, and neither can we or Cloudflare. It has no accounts, no names, no list of couples and no way to search for anyone. It keeps your phone's latest locked copy of the plan, replaced with each change, and deletes everything once your phones have been quiet for 90 days.

To pass changes along, the postbox and Cloudflare see technical details such as random ids, sizes, times and your internet (IP) address, never what's inside. We don't use these details for anything else.

Invites by text. An invite you send your partner holds your link key, so send it only to your partner. If it includes a short code (like VW-7KQ2-M9PD), the postbox keeps a locked copy of the invite for 2 days so the code works, then deletes it.

Unlinking. Either of you can unlink in More, Linked phones. Your phone forgets the key, tells your partner's phone, and your locked copy is deleted from the postbox. Your partner's phone does the same. Both phones keep the plan as it was.

What you choose to share

• A PDF for a planner or supplier (More, Planners & suppliers): you choose the sections, and VOW makes a PDF of just those for you to send, by Mail, Messages, AirDrop or however you like.
• Hand it over: the whole plan as a PDF, for whoever runs the day.
• A send-off or the after-party: that party's plan as a PDF, for its organiser.

A PDF goes only to whoever you send it to, through the app you choose to send it with. Your Hearts are never included in any PDF.

Read-only links

You can give a planner, venue or supplier a link that shows only the sections you choose, kept up to date as you plan. They open it in a web browser at vowmaison.com/v; they can't change anything, and your Hearts and photos are never included.

• Locked like everything else. Your phone locks a copy of just those sections before it goes to our postbox. The key is part of the link itself, after the # sign, which browsers never send to any website, so neither we nor our postbox can read it. Their browser unlocks it.
• Anyone with the link can read it, so send it only to the person it's for.
• You stay in control. In More, Read-only links, you can change which sections a link shows, give it a last day, or turn it off. Turned off (or after its last day), it stops working straight away and the locked copy is deleted from the postbox. Links you make live on the phone that made them.
• Opening the page, like any web page, means our website host and postbox see technical details such as the time and the internet (IP) address, never what's inside. The page loads nothing from anyone else.

Reminders and the widget

If you turn on reminders, your iPhone sets them itself from your milestones, fittings and wedding date; nothing is sent anywhere. The VOW widget shows a short summary (days to go, how far along you are, the next milestone and the budget left) that the app keeps on your phone for it. The widget uses no internet.

The camera

VOW uses your camera only to scan QR codes (your partner's code when you link phones) and to take photos you choose to add to your plan.

Help and diagnostics

If something goes wrong, VOW has a Help and diagnostics screen (More, then Help & diagnostics, or five taps on the version number at the foot of More). Nothing leaves your phone unless you tap Send. A report contains the app version and build, your iPhone model and iOS version, language, time zone, the results of the app's health checks (storage, whether your wedding is saved, partner sync, the photos folder), the app's recent technical log (screens opened, errors and timings), whether a partner is linked and when you last synced, and how many plan sections are switched on. It never contains your wedding plans, guests, budget, Hearts answers or photos, or your partner's details. You see exactly what will be sent before it goes; it's sent by email from your own email app (or the share sheet) to welcome@myspencer.ai, used only to find and fix the problem, and deleted within 90 days.

Founders feedback

In More, Founders feedback has seven optional questions, such as what you like, what's missing and what you would pay. Nothing is sent unless you tap Send feedback. Then your answers go to our feedback inbox at founders-feedback.nickeaston25-989.workers.dev, which runs on Cloudflare, with the app version and build number and nothing else: no names, no email address, no device identifier and nothing from your wedding plan. The inbox adds the country the message came from and a scrambled form of your internet (IP) address that changes every day; that is used only to limit each phone to 10 sends a day and is never used to identify you. We use your answers only to improve VOW. If the send doesn't go through or your phone is offline, the answers wait on your phone and send themselves to the inbox when you're back online. They are never sent by email.

Backups

Your wedding is included in your normal iPhone backup. If you back up to iCloud or to a computer, that backup is Apple's or yours, and is handled under Apple's terms, not by us.

What VOW doesn't do

No account, no readable server copy, no advertising, no analytics, no crash-reporting service and no tracking across other apps or websites. The app doesn't use your location, contacts or Apple's advertising identifier. We never sell your information.

Deleting your information

In the app, go to More, then Delete everything on this phone, or delete the app. That removes the wedding from that phone. If your phones are linked, VOW unlinks them first and deletes your locked copy from our postbox (if you're offline, it's deleted the next time VOW opens with a connection; if you delete the app instead, your locked copy stays on the postbox, still locked, until your partner unlinks or both phones have been quiet for 90 days). Your partner's phone keeps its own copy until they do the same, and any PDF you've already sent stays with whoever received it. Your read-only links are turned off and their locked copies deleted too (if you delete the app instead, they stay on the postbox, still locked, until 90 quiet days have passed). There's no account and we hold nothing we can read, so there's nothing for us to delete on our side.

Your rights

You can ask us what information we hold about you, which, apart from any emails you've sent us, is none we can read. If you're unhappy with how we've handled your information, tell us first and we'll work to fix it. You can also contact the Office of the Australian Information Commissioner at oaic.gov.au.

Children

VOW is for adults planning a wedding and isn't meant for anyone under 18.

Changes

If we change this policy, we'll update the date at the top, and tell you in the app if the change matters to you.