Une version française est disponible. Lire en français
Privacy Policy
Last updated October 15, 2026
This policy explains what personal information TheBowList collects, why, who we share it with, and the choices you have. It applies to hosts who create registries and to guests who visit them.
1. Our privacy officer
Our privacy officer is responsible for protecting your personal information and answers every privacy question and request.
- Privacy officer: Renee Courtney
- Email: privacy@thebowlist.ca
- Business: The Bowlist
- Address: 75 Bayly St W, Suite 15 #871, Ajax, ON L1S 7K7, Canada
2. What we collect
- Hosts: your email address, a password if you set one, the names and event details you enter (such as the occasion, date and province), and everything you add to a registry.
- Guests who mark a gift as bought: the name, email and message you enter, so the hosts know who to thank.
- Guests who give to a registry fund: your name, email, message and the amounts. Stripe collects your card details directly; we never see or store them.
- Reports: what you tell us when you report a registry, and your email if you choose to give it.
3. Why we use it
We use this information only to run TheBowList: to sign you in, show registries to the people they're shared with, tell hosts about gifts, send guests their confirmations, process registry fund payments, prevent abuse, and answer your questions. We don't sell personal information, and we don't send marketing emails without your separate consent.
4. Cookies
We use only the cookies the site needs to work: one that keeps you signed in, one that remembers a registry password you entered, and one that remembers your language. We don't use analytics, advertising or tracking cookies. If we ever add them, they'll stay off until you turn them on.
Some store links on a registry carry an affiliate tag, such as for Amazon.ca. When you follow one, that store's own privacy policy and cookies apply on its site.
5. Your registry's privacy
New registries are private by default: only people with the link can see them, and they don't appear in search. A host can choose to make a registry public or add a password at any time.
6. Who we share it with
We share personal information only with the service providers below, and only what each needs to do its job for us. Some of them store or process information outside Quebec and outside Canada, where local laws may let governments access it. We assess each provider's safeguards before sending information to it, and our contracts require them to protect it.
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | Stores accounts, registries and gift records, and handles sign-in. | Canada (Montreal) |
| Vercel | Hosts the website and runs the code that serves each page. | United States and other regions |
| Resend | Sends our emails, such as sign-in links and gift notices. | United States |
| Stripe | Takes card payments for registry funds and pays hosts. Stripe also verifies hosts' identity under its own privacy policy. | United States, Canada and other regions |
Hosts see the names, messages and gift amounts that guests leave on their registry. We may also disclose information when the law requires it.
7. How long we keep it
We keep your account and registries until you ask us to delete them. Records of registry fund payments are kept for seven years because tax law requires it. Everything else is deleted or anonymized once it's no longer needed.
8. Your rights
You can ask to see the personal information we hold about you, correct it, get a copy in a common format, withdraw your consent, or have it deleted. Email our privacy officer and we'll answer within 30 days. If you're not satisfied, you can complain to the Commission d'accès à l'information du Québec if you live in Quebec, or to the Office of the Privacy Commissioner of Canada.
9. Security and incidents
Data is encrypted in transit, access is limited to the people who run TheBowList, and database rules stop one person from reading another person's private records. If a breach puts you at risk of serious harm, we'll tell you and the privacy regulators promptly.
10. Changes
If we change this policy in a way that affects you, we'll update the date above and email hosts with an account before the change takes effect.