Privacy Policy

This Privacy Policy explains how TortillaNet (“TortillaNet,” “we,” “us,” or “our”) collects, uses, and shares personal information when you use our website at tortillanet.app and related services (the “Service”). We built TortillaNet to help small communities organize in-person events, and we treat your information with that intent — respectfully and only as needed to run the Service.

As we add features we will update this policy and post the new effective date above. Material changes will be communicated via the Service or by email.

1. Information we collect

You provide it to us

• Account information: your email address and password (or magic-link verification), and optionally your phone number for future SMS notifications.
• Profile information: your display name and (optional) avatar.
• Community and event content: communities you create or join, event details, RSVPs, contribution items (e.g. “what I'm bringing”), announcements / broadcasts you send, messages you post in an event's group chat, and photos or captions you upload. If you join an event's waitlist, we also collect the names you give for anyone you're bringing.
• Billing information: if you host, your plan and billing status; if you contribute supporter credits, the amount, your display name, and any note you add, which are shown to the host you support. Card details are entered directly with Stripe and never reach our servers.
• Communications: messages you send us for support or feedback. If you call or text our phone line, we collect your phone number, the messages you send, and — if you leave a voicemail — a recording and automated transcript of your message.

Collected automatically

• Authentication cookies: required to keep you signed in. We do not use third-party advertising cookies or behavioral-tracking pixels.
• Server logs: standard request data (IP address, user agent, timestamp, requested URL) for security, debugging, and abuse prevention.

2. How we use information

• To operate the Service: authenticate you, store your communities, events, RSVPs, and uploads, and deliver announcements and reminders.
• To send transactional emails (account confirmation, password reset, RSVP confirmations, host broadcasts, and event reminders).
• To improve and secure the Service: detect abuse, prevent fraud, and fix bugs.
• To comply with legal obligations.

3. How we share information

We do not sell personal information. We share information only with service providers that help us run the Service, and only as needed:

• Supabase (database, authentication, file storage) — stores your account, communities, events, RSVPs, and uploads on our behalf.
• Resend — sends transactional emails on our behalf.
• Stripe — processes payments for host plans, supporter credits, tickets, and donations. Stripe receives the payment details you enter and your email address, and handles them under its own privacy policy.
• Twilio — provides our phone line: routes calls and text messages to and from us, records and transcribes voicemails you choose to leave, and processes the associated phone numbers and message content. Phone support is offered to members on current or past paid plans, so when you call, the number you call from may be matched against account phone numbers to route your call.
• Netlify — hosts the website.
• Embedded video players — when a host adds a video link to an event, the player is loaded directly from that service (YouTube, Vimeo, or Collectivision, whose videos are delivered by Bunny.net). Opening such an event page means your browser contacts that provider, which can see your IP address and may set its own cookies under its own privacy policy. We do not send them your account information, and no video player loads on an event that has no video.
• Law enforcement or legal process — when required by law, or to protect the safety, rights, or property of TortillaNet or others.
• In a business transfer — if TortillaNet is acquired or assets are transferred, your information may be transferred under the same protections described here.

Within the Service, content you create is visible according to context: event details and photos are visible to members of the community where they're posted; broadcasts you send go only to the audience you select. Other users do not see your email address or phone number unless you choose to share them. Each event's host decides whether guests may add photos and videos to it; where that is switched off, only the host, co-hosts and community staff can add to those galleries, and everyone who can see the event can still view what is already there. An event's group chat is visible to members of its community and, unless the host turns this off, to anyone else who can open the event page, including people without an account. A host may also let people without an account post in the chat; their messages appear under the name they gave when they RSVP'd.

4. Your choices and rights

• Access & update: you can view and update your profile from the dashboard at any time.
• Delete your account: contact us at the address below to permanently delete your account and associated personal information. Some information may be retained where required by law or for legitimate business purposes (e.g. anti-abuse logs).
• Communications: transactional emails (event reminders, host announcements) are part of the Service. You can leave a community to stop receiving its announcements, or delete your account to stop all email.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA) or the EU General Data Protection Regulation (GDPR), including the right to know, delete, correct, or port your information, and to non-discrimination for exercising those rights. To exercise these rights, contact us at the address below.

5. Children

TortillaNet is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

6. Data retention

We retain account information for as long as you have an account, and content (events, RSVPs, photos) for as long as the community it belongs to exists. Backups may be retained for a limited additional period for disaster recovery. When you delete your account or content, we remove it from our active systems within a reasonable period.

7. Security

We use standard administrative, technical, and physical safeguards designed to protect your information. No system is perfectly secure; please use a strong password and notify us promptly if you suspect any unauthorized access to your account.

8. International users

TortillaNet is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other jurisdictions where our service providers maintain facilities.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of the Service after an update constitutes acceptance of the revised policy.

10. Contact us

Questions or requests? Email privacy@tortillanet.app. TortillaNet is based in Eugene, Oregon, USA.