Wendus Privacy Policy

Last updated: October 13, 2026

Wendus is designed as a local-first wedding planning app. Wedding event data is stored on the user's device by default.

Data the App Handles

The app can store event details, event window names, schedule event names, guest and household names, RSVP status, meal choices, dietary notes, accessibility notes, contact details entered by the user or picked from Contacts, seating assignments, imported venue map or floor-plan files selected by the user, room layouts (floor size, areas, walls, exits, table positions), finalized plan versions, helper names and responsibilities, the event-day run sheet, QR pass records, check-in records, helper packets received from a couple, trusted helper device records, export previews, local CSV and spreadsheet import/export history, and audit history. Free Sample uses clearly fictional data generated inside the app.

Data Collection

The app does not transmit event data to a developer-operated server. It does not use advertising SDKs, analytics SDKs, tracking domains, guest accounts, or vendor accounts. The app's cloud features are the optional Digital Invitations, which use the couple's own iCloud account as described below (the developer cannot read that data), and the read-only venue hall list described under “Venue Hall List”. Feedback and hall requests are emails the user chooses to send from their own mail app (see “Contacting Wendus”). Premium is a one-time non-consumable purchase handled by Apple's App Store purchase system; payment card details are handled by Apple and are not stored in the app.

Website Analytics

This support and privacy site is a static page and uses no analytics, cookies, or trackers.

Camera

The camera is used only to scan a guest pass at check-in or a helper pairing code, and only while the scanner is open. Guest pass codes are opaque tokens used for local check-in.

Contacts

"Add from Contacts" opens Apple's contact picker. Wendus receives only the people the user taps in the picker; it has no access to the rest of the address book and does not request Contacts permission.

Local Network and Helper Packets

With Premium unlocked, the couple can send a helper packet to a nearby Wendus device over local peer-to-peer connectivity. A helper packet is prepared from a finalized version of the plan and contains the names of every invited guest with their reply (so a guest who hasn't answered can still be let in), how many plus-ones and children each is expected to bring, households, tables and arrival status, the room layouts and the floor-plan map image or selected PDF page used for them, the run sheet, the helper list and event instructions. Meal choices, dietary notes, accessibility notes and guest or helper contact details are included only when the couple switches them on for that packet; they are off by default. Each packet is encrypted with a key carried by the pairing QR code shown on the couple's device, or by the pairing text if the couple chooses to share it through another app, so only a device that has that code can open it. A pairing code works for 10 minutes. Helpers use a free, restricted workspace: they can search guests, scan or paste QR tokens, record and correct arrivals (including how many people came with a guest, and the name of someone not on the list who is let in at the door), and return only those arrival records to the couple. On the wedding day the couple can turn on live arrivals: while their phone and the helpers' phones are nearby, each arrival (the guest's name or a walk-in's name, how many came with them, the station name and the time) is exchanged directly between those phones over encrypted local networking, using a separate key per helper, so every door sees who has already arrived. On the same connection the couple's phone sends the doors changes made on the day (revoked passes, the guest list with only the fields chosen for that helper, and run-sheet task status), and helpers send back the task status they set. A helper's copy of the wedding is removed from their phone a week after their access ends, once the couple has every arrival recorded there. Helper mode can be locked with Face ID, Touch ID or the device passcode; this is handled by iOS, and Wendus never sees biometric data. Nothing passes through a server, and each phone keeps its own record if the connection drops. The couple can also save or print the plan as a PDF (the printed plan), which uses the same field choices. Wendus does not send packets through a developer-operated server.

Digital Invitations (iCloud)

Digital Invitations are off until the couple turns them on. When on, Wendus stores one invitation per household in the couple's own private iCloud database and shares it with that household through an iCloud link, which the couple can include in the RSVP message they send. An invitation contains only that household's guest names, their current reply, meal and dietary details, the couple's note, the invited events with their dates, places and addresses, the meal choices, the reply deadline, the household's guest pass code if one exists, and its table only if the couple chooses to show tables. If the couple also chooses to show the room, the invitation carries the room plan to find the table: the floor's shape, its areas and exits, and every table's position, with only that household's own table named and its chairs numbered, and no guest names. It never contains other households, the guest list, contact details, accessibility notes or notes about other guests. A guest who opens the link in Wendus (free, on iPhone) can see the invitation and send a reply (attending, declined or maybe, meal, dietary notes, a plus-one name and a note), which is stored as part of the same shared invitation in the couple's iCloud. The content of every invitation and reply is end-to-end encrypted by iCloud with keys held only on the couple's and the guests' devices, so neither the developer nor Apple can read it; Apple can see only technical details such as record sizes, dates, and who has joined a share. Wendus has no server and no access to users' iCloud data. The couple can withdraw any household's link, and turning the feature off with "Withdraw All Links", deleting the wedding, or purging its personal data deletes all of the wedding's invitations and replies from iCloud. On a guest's phone, received invitations are kept in an encrypted local file for offline use and are removed when the guest leaves the invitation or the couple withdraws it. Guests can always reply in the chat instead.

If the couple turns on guest self check-in, invitations also carry the times on each wedding day when the household can tap I've Arrived. The guest chooses who in their household has arrived, and their phone sends only those people, how many came with each of them, and the time. No location is collected or sent: the guest says they have arrived, and Wendus does not ask for location permission. The arrival request is stored in the couple's own iCloud as part of the same shared invitation, end-to-end encrypted like replies, so neither the developer nor Apple can read it. The couple's phone records the arrival with its other check-in records, passes it to the couple's helpers over live arrivals as described above, and writes back whether it was counted, which the guest's phone reads. If the couple has allowed notifications, their phone may show how many guests checked in, never a name. Arrival requests and these answers are deleted with the household's invitation when its link is withdrawn, and with all of the wedding's invitations when the couple withdraws all links or deletes or purges the wedding. On the guest's phone an arrival that hasn't been sent yet is kept in the same encrypted local file and dropped when that day's check-in ends.

The couple can also share wedding photos with invited households. Wendus uploads only a small preview of each photo: before it leaves the couple's iPhone, Wendus resizes it, removes its metadata (including location and camera details) and encrypts it with a key of its own; the key is kept in an end-to-end encrypted iCloud field, so neither the developer nor Apple can see the previews. The previews are stored in the couple's own iCloud, where they count toward the couple's storage, and are shown to guests through a read-only link carried in their invitations, only while the couple shares photos. A guest's phone joins the album only when the guest asks to see the photos, downloads the previews and leaves the album again straight away; the previews are kept in memory for that session and in iCloud's temporary download area, which iOS clears. For full-size photos the couple can add the link to a temporary shared album they make in Apple's Photos app; that album is Apple's service, holds only what the couple puts in it and ends 30 days after it is made, and Wendus only passes its link to guests. Guests can view the previews but not add or change them. Turning sharing off stops sending both links; deleting a photo, or all of them, deletes it from iCloud, and deleting all of them also stops sending both links; deleting the wedding, purging it or withdrawing all links deletes the album. Wendus never deletes photos on its own.

When the couple changes something on an invitation (a time, a place, the household's table or the reply-by date), the guest's iPhone works out what changed by comparing the new invitation with the copy it holds, shows it in the invitation and may post a notification on that iPhone; nothing about it is sent anywhere. In the ten days before a day of the wedding whose venue was picked from Maps, the guest's iPhone asks Apple Weather (WeatherKit) for that day's forecast at the venue: only the venue's coordinates and the date go to Apple, never the guest's own location. The forecast is shown with Apple Weather's attribution.

Venue Hall List (iCloud)

Wendus can start a room plan from a listed reception hall. The list of halls, with each hall's published size, ceiling height and capacity, is built into the app and is refreshed at most once a day from a single public, read-only record that the Wendus team publishes in the app's iCloud container (Apple's CloudKit public database). Reading it does not need an iCloud account, and the app sends no information about the couple, the wedding or its guests; the developer receives no personal data from it. Apple's iCloud servers handle the request as they handle any network request. Wendus never writes to that record. Choosing a hall copies its size into the room plan on the device.

Contacting Wendus

Settings → Send Feedback and Request Your Hall (also offered in Find Your Hall) open a message in the user's own mail app, addressed to the Wendus team at saba.aziz991@gmail.com. The user reads the message, can change it, and decides whether to send it from their own email address; Wendus sends nothing itself and has no server. A message contains only what the user writes, plus the app's version and the iOS version. It never contains the wedding, its guests or other data from the app. A hall request can include the venue and hall name, the city and country, the venue's website, the hall's measurements, notes, and a construction or floor plan the user picks from Files (plans only; Wendus doesn't ask for or accept photos of the hall). Before a plan is attached, an image is redrawn without its location, camera and other hidden details, and a PDF loses its author and app details. The Wendus team uses a request only to reply and to add the hall to the venue hall list, where only the hall's name, place and measurements are published, for every Wendus user; the plan itself is never published or shared. Messages are kept only as long as needed to answer them and add the hall, and anyone can ask for theirs to be deleted by replying.

Local Storage and Encryption

The app stores the event snapshot locally in SQLite and encrypts the stored snapshot with Apple platform cryptography. Imported venue map files are stored as protected local sidecar files and referenced from the encrypted event snapshot by metadata. Local CSV export files and encrypted archive files use iOS file protection.

Backup and Transfer

The optional Backup & Transfer feature creates a single backup file containing the event, encrypted with a passphrase the user chooses (PBKDF2 key derivation and AES-GCM encryption using Apple's built-in cryptography). The file is created locally and leaves the device only when the user shares or saves it. Wendus cannot read the backup without the passphrase and cannot recover a lost passphrase.

Sharing and Exports

The user can create local CSV records for vendors and a master guest list CSV for spreadsheet editing. Export previews show the purpose, included fields, excluded fields, row count, and sensitive-field warning before a vendor record is created. If the user imports a CSV from Files, the app reads that selected file locally to add or update guests, households, RSVP state, meal choices, table assignments, and check-in fields. If the user imports a venue map or floor-plan PDF/image from Files, the app reads that selected file locally to create a rough, optionally scale-calibrated sketch guide with measured table and item placement. Helper packets are intentionally started by the user and contain only the fields described under Local Network And Helper Packets; imported venue maps are never included in vendor CSV exports. Vendor CSV files can be shared from Settings through the iOS share sheet and are deleted from the device after their stated expiry. When the user taps Ask via SMS, Ask via WhatsApp, or Ask via Email for a guest, the app opens the user's own Messages, WhatsApp, or Mail app with that guest's saved contact detail and a prefilled RSVP request; the user decides whether to send it, and Wendus does not send messages itself, does not use a messaging service, and cannot read replies.

Retention

The app provides post-event closeout actions to archive the event, purge sensitive fields, keep aggregate counts, or delete local event data. Purge and aggregate-only closeout remove generated local CSV export files and imported venue map sidecar files, and also clear saved seating drafts, event rosters, helper packets, and trusted helper devices as applicable; delete closeout removes generated local CSV export files, imported venue map sidecar files, local encrypted archive files, and local backup files.

Contact

For help with Wendus, email saba.aziz991@gmail.com, use Settings → Send Feedback in the app, or see the support page.