Last updated —
Privacy policy
On this page
1. Who we are
Stitch Events LTD (“Stitch”, “we”, “us”) runs stitchevents.app, a web app for creating events, inviting people, and keeping track of who is coming. We are the data controller for the information described in this policy.
Stitch Events LTD is registered in England and Wales, company number 17443614. Registered office: 128 City Road, London EC1V 2NX, United Kingdom.
Contact: [email protected].
Stitch is for people aged 18 and over.
2. How we think about your information
We believe the information you give us should be used for one thing, which is making Stitch better for the person it came from. Knowing who you invited last time is how we put them at the top of the list next time. That is our sole intention for it.
What we don’t do with your personal information:
- We do not sell your personal information, and we do not share it with anyone for their own advertising.
- We do not put advertising pixels in Stitch. Optional usage analytics run only if you allow them.
- We do not read your contacts or your calendar without asking you first, and saying no leaves Stitch fully usable.
- We do not make your events or your attendance public unless you choose to.
- We do not store your card or bank details ourselves. If we add payments, a regulated payment provider handles them.
Stitch will grow, and new features will need information this policy does not mention yet. When that happens we will update this policy before the feature goes live, say what changed in section 12, and collect only what the feature actually needs.
3. Information we collect
Information you give us
Phone number. Required. It is how you sign in and how we identify your account.
Your name and username.
Optional profile details: short bio, gender, profile photo, and email address where we offer it.
Events you create: name, description, date and time, time zone, venue name and address including its coordinates, poster image, capacity, cost per person, and settings such as whether guests need approval.
RSVPs and invitations: whether you are going, how many guests you bring, approval status, who invited you and how (host, another guest, or a shared link), and any note you add.
Groups: groups you create or join, their name, bio and image, your role, and your notification settings.
Polls: your votes and the availability you mark.
Comments and reactions you post on events.
Images you upload as a profile photo, group image or event poster.
Information we collect automatically
A session cookie. One cookie, named “session”, keeps you signed in. It is essential and lasts 30 days.
Data stored on your own device. Your browser keeps a cached copy of your profile, your theme and view preferences, your recent searches, and any unfinished RSVP. This stays on your device.
Your IP address. When you sign in or change your phone number, our network passes us your IP address and we send it to Twilio, our SMS provider, so they can block abuse of the code system. We do not store your IP address in our database. It can appear in our security firewall logs, which we keep for 14 days.
An approximate location from your IP address. Our network estimates roughly where you are from your IP address, and we use that to put nearer places first when you search for a venue. This is not GPS, it is not precise, we never ask your device for it, and we do not store it.
Error reports. When something breaks, a report goes to Sentry, our error monitoring provider. It contains your user ID and which part of the app failed. It does not contain your IP address or anything you typed.
Optional usage analytics. After you finish signing up, we ask whether you want to help improve Stitch. If you allow analytics, PostHog receives your internal account ID, the types of screens you open, clicks, basic browser and device information, and counts of errors. It also receives information about actions such as creating or updating an event, responding to an invitation or poll, posting a comment, or creating a group. Action details are limited to settings, yes/no flags and counts, such as event visibility or the number of invited guests.
We remove page titles, URL query strings, fragments and event, group, profile and checkout identifiers from analytics URLs. We do not send names, messages, comment text, event descriptions, contact lists or raw error messages to PostHog. We do not record your screen or session. PostHog receives your network IP address when your browser connects to it, as any website provider does; we configure analytics not to use it for location enrichment.
Information about you that comes from other people
If someone invites you to an event or a group before you have a Stitch account, they give us your phone number so that the invitation is waiting for you when you sign up, and we store it against that invitation. We do not text you on their behalf. If they send you a message about it, it comes from their own phone. If you never sign up, that phone number stays attached to the invitation until the invitation or the event is deleted. You can ask us to remove it at any time, see section 8.
4. Why we use your information, and our legal basis for it
| What we do | Information used | Legal basis |
|---|---|---|
| Create your account and sign you in, including sending one time codes by SMS | Phone number, name, session, IP address | Performance of a contract with you |
| Run the service: events, invitations, RSVPs, groups, polls, comments, reactions, in app notifications, and text reminders about events you have said yes to | Your profile and all event, RSVP, group and social data, and your phone number for texts | Performance of a contract with you |
| Suggest venues when you are creating an event | What you type in the search box, approximate location from your IP address | Performance of a contract with you |
| Keep the service secure and stop abuse and fraud | IP address, firewall logs, session data | Our legitimate interest in protecting the service and the people using it |
| Find and fix faults | Error reports containing your user ID | Our legitimate interest in keeping the service working |
| Understand which parts of Stitch people use and improve them | Optional usage analytics described in section 3 | Your consent |
| Promote Stitch and public events, for example on our website and social media | The title, poster, date, area or venue name, and description of events their hosts have made public, never the full address | Our legitimate interest in promoting Stitch and the events on it |
| Reply when you contact us | Your message and contact details | Our legitimate interest in answering you |
| Meet our legal obligations, or establish or defend legal claims | Whatever is relevant | Legal obligation, or our legitimate interest in defending claims |
The optional parts of your profile, meaning your bio, gender, photo and email address, are based on your consent. You can remove them at any time in your profile, and that does not affect anything we did with them beforehand.
You can refuse analytics and keep using all of Stitch. You can withdraw consent at any time through Settings → Privacy → Usage analytics. We save your choice against your account, along with when you made it and the version of the consent wording. It applies across devices. Withdrawing consent stops new collection on the device you are using immediately. Other open tabs and devices keep their current preference until you reload the app or sign in again, when we load your saved account preference. If we cannot confirm your preference, analytics stay off. Withdrawal does not delete data already collected. To request deletion, contact us using section 8.
5. Who we share it with
Our service providers. They act on our instructions and cannot use your information for their own purposes.
| Provider | What they do | What they receive |
|---|---|---|
| Twilio | Sends the one time codes you use to sign in, and text reminders and updates about events you are part of | Your phone number, the content of those texts, and your IP address when you sign in |
| Amazon Web Services | Hosts the app, the database and uploaded images, delivers the app through its content delivery network and security firewall, and powers venue search | Everything stored in Stitch, and your IP address when you use the app |
| Sentry | Error monitoring | Your user ID and which part of the app failed |
| PostHog | Optional product analytics | The account ID, screen types, interactions, action metadata, error counts and browser/device information described in section 3, after you opt in |
Other people using Stitch. This is the main way your information is seen by others, so it is worth reading. Your name, username and photo are visible to people you share events or groups with. Guests at an event can see the other guests’ names and RSVP status. If you make an event public or share a link to it, anyone with that link sees what you put on the event. If you make an event public, we may also feature it when we promote Stitch, as our Terms of service explain. We ask first before featuring anyone’s profile, name or photos of identifiable people in our advertising. Comments and reactions are visible to everyone who can see the event.
If the law requires it, for example a court order, or to protect someone’s safety.
If the business is sold or merged, in which case your information moves with it and this policy continues to apply until we tell you otherwise.
We do not share your information with anyone for marketing or advertising.
6. Where your information is kept
The Stitch app, database and uploaded images are hosted in Ireland, on Amazon Web Services in the eu-west-1 region. Optional analytics are processed in PostHog’s EU cloud.
Two things involve the United States:
- Twilio is a US company, so your phone number is sent to the US each time we text you, along with your IP address when we send you a sign in code.
- Our security firewall logs are stored in the US for 14 days, and can contain your IP address.
Error reports go to Sentry in Germany.
Where information leaves the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of our agreements with these providers. You can ask us for details of the safeguards we use.
7. How long we keep it
| Information | How long |
|---|---|
| Your account and profile | For as long as your account exists, then deleted when you ask us to close it |
| Events, RSVPs, groups, polls, comments and reactions | For as long as your account exists. Events you delete and comments you remove stop being visible straight away |
| Uploaded images | Until you replace or remove them, or your account is deleted |
| Sign in session | 30 days, then deleted automatically |
| In app notifications | 90 days, then deleted automatically |
| Phone number change requests | 10 minutes, then deleted automatically |
| Security firewall logs | 14 days |
| Server logs, which hold your user ID but not your IP address | 30 days |
| Optional usage analytics | Until you request analytics deletion or account closure, or the analytics provider’s retention period expires, whichever happens first |
| Phone numbers of invited people who never signed up | Until the invitation or event is deleted, or you ask us to remove it |
8. Your rights
Under UK data protection law you can ask us to:
- give you a copy of the information we hold about you
- correct anything that is wrong
- delete your information
- limit how we use it
- send you or another provider a portable copy of it
- stop using it where we rely on legitimate interests
- withdraw your consent to the optional parts of your profile and to usage analytics
Email [email protected] and we will reply within one month. There is no charge.
Deleting your account. Email [email protected] and we will delete your account and the personal information we hold about you within one month. Some things stay visible after your account goes, such as an event you created that other people are still attending, and we will tell you what those are when you ask.
Complaints. If you are unhappy with how we have handled your information, email [email protected]. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.
You can also complain to the Information Commissioner’s Office:
- ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
9. Cookies and storage on your device
We use an essential cookie, named “session”. It keeps you signed in, lasts 30 days, and is essential to the service, so we do not ask for consent to it and there is no cookie banner.
We also store a few things in your browser to make the app usable: a cached copy of your profile, your light or dark theme, your home view, your recent searches, and an unfinished RSVP. Clearing your browser data removes all of it.
We save your analytics choice in our database. If you turn analytics off, we also save a temporary local storage marker with a name starting stitch-analytics-withdrawal:. It keeps collection off on that browser while we save the change to your account, including after a reload. We remove the marker once the change succeeds. If browser storage is unavailable, this safeguard lasts for the current visit. Only after you opt in and have a completed account, PostHog uses a first-party cookie and browser storage (with names starting ph_) to recognise your account, browser and session. It may also store an opt-out flag with a name starting __ph_opt_in_out_. Turning analytics off removes PostHog’s persistent tracking identity; your account preference stays so we can remember your refusal. Signing out also stops analytics.
We do not use advertising cookies or third-party cookies. Clearing browser data does not remove the analytics preference saved against your account.
10. People under 18
Stitch is for adults. You must be 18 or over to create an account. If we find out that someone under 18 has signed up, we will delete the account and the information attached to it. If you think a child has given us their information, email [email protected].
11. How we protect your information
Everything runs over HTTPS. Your session cookie cannot be read by scripts in your browser and is only sent over a secure connection. Data is encrypted in storage. Access to the production database is limited to the people who need it. A web application firewall sits in front of the service to block common attacks. No system is perfectly secure, but we take this seriously, and if there is a breach that affects you we will tell you and the ICO.
12. Changes to this policy
If we add a feature that changes what we collect, such as payments or push notifications, we will update this policy before the feature goes live, change the date at the top, and list the change here. We will tell you in the app if the change is significant.
Version history:
- 20 October 2026: added optional PostHog analytics, opt-in controls, analytics storage and deletion information.
- 15 September 2026: first version.
13. If you live in the United States
Stitch is a UK service, but if you are in a US state with its own privacy law you may have the right to know what we collect, get a copy, correct it, delete it, and not be treated differently for asking. Use the contact details in section 14.
In the past twelve months we have collected these categories of personal information: identifiers (your name, username, phone number, and email if you give us one); information under the California Customer Records statute (your name and contact details); protected classification characteristics (gender, if you choose to give it); geolocation data (an approximate location from your IP address, and the coordinates of venues you add to events); images (photos you upload); and internet activity within Stitch if you opt in to usage analytics.
We have not collected biometric information, commercial or payment information, browsing or search history across other sites, professional or employment information, education information, inferences used to profile you, or sensitive personal information as those laws define it.
We have not sold or shared any personal information, and we do not use it for targeted advertising. Because we do not sell or share, there is nothing to opt out of.
14. Contact us
Email: [email protected]
Post: Stitch Events LTD, 128 City Road, London EC1V 2NX, United Kingdom.