Skip to content

Privacy Policy

Effective October 6, 2026

Who this covers

SignupSavant is volunteer signup scheduling software. Two kinds of people use it: organizers, who create accounts and run events, and volunteers, who sign up for those events without an account. This policy describes what we collect from each, what we do with it, and what we never do with it.

What we collect

From organizers

  • Your name, email address, and organization name.
  • A password (stored only as a bcrypt hash) or a passkey — we cannot read either.
  • Billing details are handled by Stripe. Card numbers never touch our servers.
  • Text you type into the AI event builder, which is sent to Anthropic to construct your event.
  • API keys you create, stored only as SHA-256 hashes.

From volunteers

  • Your name and email address when you sign up for an event.
  • A phone number, only if the event sends text reminders and only with your explicit opt-in.
  • Your answers to any questions the organizer added to the signup form.

Automatically

  • Standard server logs (IP address, browser type) kept for security and troubleshooting.
  • If you create an account after following a shared event link, we record which event referred you.
  • Product analytics on our marketing pages and in the organizer app: which pages are viewed and which buttons are clicked, collected with PostHog so we can see what works and what confuses people. If you are signed in as an organizer, this is tied to your account (user ID, name, email, organization). It is never collected on volunteer signup or cancellation pages.

What we never do

  • We do not sell or rent your data, and we never have.
  • We do not show ads.
  • We do not use advertising trackers. There is no Google Analytics, no Facebook pixel, nothing of the kind on any page.
  • Our one analytics tool, PostHog, is used only to improve SignupSavant. It runs without cookies or local storage, records no session replays, is never loaded on the pages volunteers use, and its data is never sold or used for ads.
  • We do not use volunteer email addresses for marketing. Volunteers receive event mail only: confirmations, reminders, and changes for events they signed up for.

Who can see volunteer information

The organizer of the event you signed up for can see your name, email, phone number (if you provided one), and your answers to their questions. That is the point of the product: the organizer needs to know who is coming. Other volunteers cannot see your contact details. Signup counts shown publicly (such as "3/5 volunteers") contain no personal information.

Service providers we rely on

These companies process data on our behalf, each for one narrow job:

  • Stripe — payment processing for paid plans. Receives organizer billing details.
  • Twilio — SMS delivery. Receives volunteer phone numbers and reminder text, only for volunteers who opted in.
  • Anthropic — powers the AI event builder. Receives the event descriptions organizers type. Volunteer data is never sent to it.
  • Resend — delivers confirmations, reminders, and account email. Receives recipient addresses and message content.
  • Laravel Cloud — hosts the application and its database.
  • PostHog — product analytics for our marketing pages and the organizer app, as described above. Receives no volunteer data.
  • Cloudflare — DNS, network protection, and Turnstile, the "verify you are human" check on signup, registration, and contact forms. Turnstile is used only to tell people from bots.

Cookies

We set first-party cookies only, all of them functional:

  • Session cookie — keeps you signed in during a visit. Encrypted and signed.
  • XSRF token — protects forms against cross-site request forgery.
  • Remember-me cookie — set only if you tick "remember me" at sign-in.

There are no advertising or analytics cookies (our analytics runs cookieless), so there is no cookie consent banner — nothing on this site requires one. Your browser's local storage holds minor interface preferences (such as whether the sidebar is collapsed) that never leave your device.

Text messages

A phone number on file is not permission to text it. We send SMS only to volunteers who ticked the opt-in box for a specific event's reminders. Reply STOP to any message and every SignupSavant text to your number stops, across all events, even if you sign up again later. Reply START to opt back in. Message and data rates may apply.

Security

Practices currently in place, stated plainly:

  • All traffic is encrypted in transit with TLS (HTTPS).
  • Passwords are bcrypt-hashed; passkey sign-in is supported and stores only public keys.
  • API keys are stored as SHA-256 hashes and shown to you once, at creation.
  • Outbound webhooks are signed (HMAC-SHA256) so receivers can verify them; inbound SMS webhooks are signature-verified before we act on them.
  • Database backups are automated by our hosting provider and expire after a limited retention window.

We are a small operation and do not hold formal certifications such as SOC 2. If you find a security problem, email support@signupsavant.com and we will respond as fast as we can.

Retention and deletion

  • Organizer accounts and their events are kept until you delete them or ask us to.
  • Volunteer signups are kept as long as the organizer keeps the event. Cancelling a signup removes you from the active list immediately.
  • Deleted data can persist in encrypted backups until they expire, at most 30 days.
  • To have anything deleted — a signup, a phone number, an entire account — email support@signupsavant.com. There is no in-app account deletion yet, so email is the reliable path.

Your rights

Wherever you live, we honor the substance of GDPR- and CCPA-style rights: you can ask what we hold about you, get a copy (organizers can export event data as CSV in-app), correct it, or have it deleted. Email support@signupsavant.com and we will verify the request belongs to you before acting on it.

Children

SignupSavant is not directed to children under 13, and organizer accounts require the age of majority. If a child under 13 has signed up for an event, a parent or guardian can email us to have the signup removed.

Changes and contact

If this policy changes, the effective date above changes with it, and material changes will be announced to organizers by email. Questions: support@signupsavant.com.