Privacy Policy

Account details you give us: your name, your partner’s name if you invite them, and your email address. Your password is handled by our sign-in provider, which keeps only a one way hash of it. We never see it and never store it.

Wedding details you enter: your wedding date and city, and the content of your planning tools: checklist, budget, guest list and RSVPs, gift registry, and your wedding website.

Technical information: basic device, app, browser and usage data we need to run the service securely and fix problems. This includes crash and error reports from the website and from our iOS and Android apps.

In our iOS and Android apps you can build your guest list from your phone’s contacts. We ask your permission first, and the whole feature is optional: you can always add guests by typing their names instead.

If you allow it, your address book is read on your phone so we can show you a searchable list. We never upload your address book, and we never see the contacts you do not pick.

For each guest you choose to add, we save their name, the one phone number you select, and a reference that keeps that guest linked to the contact on your phone. That is what lets us tell you who has replied. You can unlink a guest from a contact at any time in the app.

When you send an invite over WhatsApp, the message is handed to WhatsApp on your phone and sent by you. Anything that happens after that is covered by WhatsApp’s own privacy policy, not ours.

To provide and personalise your planning tools, save your progress, and sync it across your devices.

To let you and any partner you invite plan together.

To keep the service secure, prevent abuse, and provide support.

To contact you about important changes to your account or the service.

We do not sell your personal information, and we do not use it for advertising or tracking.

The partner you invite to your wedding can see and edit your shared planning.

Anyone you give your wedding-website link to can view the details you choose to publish there.

We use a small number of service providers who process data only on our instructions: Supabase for your account, database and uploaded images; Railway for our application servers; Vercel for the website; and Sentry for crash and error reports.

We may disclose information if required by law or to protect the safety of our users.

Your account and planning data are stored in the European Union, in Frankfurt, Germany. Our servers and the providers listed above may process your data in the European Union and the United States, which means your information is handled outside Egypt.

Wherever it is processed, your data stays subject to this policy and to contracts that require our providers to protect it.

Wedding websites are unlisted and hidden from search engines, but anyone who has the link can open them. Only publish details you’re comfortable sharing with your guests, and use the privacy options for anything sensitive: a guest password, or hiding addresses until a guest RSVPs.

Your guest list is made up of other people’s details, so you are the one deciding what to collect about them. Please add only what you need for your wedding, and only for people who would expect to hear from you about it.

We use guest details to run your list, send the invites you ask us to send, and record RSVPs. We do not contact your guests for our own purposes and we never sell their details.

If a guest asks you to remove them, you can delete them from your list in the app, which removes their details from our records. A guest can also write to us at the address below and we will help.

We keep your data while your account is active. You can delete your account at any time: in the app from Settings, Account actions, Delete account, or on the web from Settings. This permanently removes your account and its planning data and cannot be undone. If you plan with a partner, they keep the wedding and you are simply removed from it.

Three things outlast a deletion, and we would rather say so plainly. Encrypted backups are kept for 90 days before they expire, so a copy of your data can sit in a backup for up to 90 days after you delete it. Technical error and usage records are kept for 90 days. If you sent us a bug report or a feature request, we keep the report itself but detach it from you, so it is no longer linked to your account.

You do not need the app to ask us to delete your account. Email us at hello@koshaapp.com from the address on your account and we will delete it for you.

We use industry-standard measures to protect your data, including encryption in transit. No method of storage is perfectly secure, but we work hard to keep your information safe.

You can access, correct, export or delete your information from within the app, or by emailing us. We will respond within a reasonable time.

Kosha is intended for people aged 18 and over and is not directed at children.

We may update this policy from time to time. We will post the new version here and update the date above; significant changes will be highlighted in the app.

Questions about your privacy, or a request about your data? Email us at hello@koshaapp.com.