Effective October 18, 2026

Privacy notice

Reunion Portal is operated by Gem State Products LLC. This notice explains how we handle information on reunionportal.com, in the private family hub at hub.reunionportal.com, and in related emails and support.

Information we handle

Public website and launch updates

Our hosting and security providers process ordinary request information such as network address, browser details, requested page, time, and security events. If you accept Analytics, Cloudflare Web Analytics measures page traffic and performance, Google Analytics measures traffic sources and selected non-personal actions, and Microsoft Clarity measures interactions, heatmaps, and recordings on selected informational pages. Analytics is not connected to private family content, and Clarity is excluded from public forms, login, registration, the private hub, and administration pages.

We configure public analytics to avoid names, email addresses, form entries, account or family identifiers, card information, private family content, and URL query strings. Google Analytics and Clarity may assign pseudonymous browser or session identifiers after consent. Cloudflare states that its Web Analytics service does not track individual users across customer properties. See the Cookie Notice for provider, storage, and preference details.

The launch-update form collects the email address you submit, your adult affirmation and consent, the disclosure version and source, subscription status, and delivery, unsubscribe, deletion, bounce, complaint, suppression, and optional-verification records needed to operate that email service. Its short-lived abuse controls use a purpose-separated keyed hash instead of storing the raw network identifier in the subscriber ledger.

Accounts and family profiles

When account registration is available, we handle your name, email address, password credential in protected hashed form, birth date, account status, accepted terms version, and marketing choice. Within a family hub, you or an authorized family organizer may add profile and relationship information, contact details, photos, family groups, visibility choices, notification preferences, and profile-only records for relatives who do not have sign-in accounts.

Family activity and content

The hub stores the information people choose to add to family updates, private messages, discussions, calendars, reunions and other events, attendance, activities, lodging, meals, cleanup, contributions, reminders, recipes, photos, videos, and related reports. Optional location features handle the location or address information a person chooses to provide. Access depends on family membership, assigned permissions, content visibility, and the choices available for the feature.

Invitations, groups, and reminders

Invitations use the intended recipient’s contact details, the inviting family and assigned access, and invitation status and expiry information. A profile-only record is separate from a sign-in account. Family groups organize people within a family; managing a group in another family requires permission in that family. Event-related audiences may include authorized participants from more than one family.

A reminder can be delivered as an in-app notification, a family-feed item, email, or a combination selected by the sender. We process the message, selected audience and channels, related family or event, and delivery or failure records needed for those choices. Recipients can retain or forward messages they receive. Closing a feed, preview, or popup does not delete the underlying content or change who is allowed to receive it.

Media and recipe sharing

A photo or video may be associated with several galleries or families. Person tags and gallery filters help organize media; tagging someone does not by itself establish that person’s permission to publish the media. Authorized sharing controls can also create an expiring gallery link that people can open without a hub account. Anyone who receives or is forwarded a working link may be able to view the selected gallery and download its media. Public recipes may also be available outside the signed-in hub. Review the audience before creating a link or choosing public visibility.

Revoking or expiring a link limits future access through that link. It cannot recall screenshots, downloads, forwarded emails, printed reports, or copies someone has already kept.

Connected Google calendars

Connecting Google Calendar is optional. When you authorize a connection, we read the names and access roles of your Google calendars so you can choose one. If you choose to create a dedicated calendar, we create a secondary Google calendar on your behalf. We synchronize only the calendar you select. We access event titles, descriptions, locations, dates and times, time zones, recurrence and exceptions, and identifiers needed to keep corresponding events up to date. Depending on the direction you choose, we import events, send your authorized event changes to Google, or do both. We do not request Gmail, contacts, or calendar-sharing permissions, and we do not synchronize guest lists or attendance responses.

We store the selected calendar's connection details, protected authorization tokens, imported events and synchronization records in our hosted systems. Google Calendar data is used to provide and maintain the calendar features you choose. Imported event details are visible to people authorized on the destination Reunion Portal calendar; check that calendar's sharing before connecting a private Google calendar. Our hosting providers process these records to operate the service. Changes sent to Google are subject to the selected Google calendar's existing sharing settings.

We do not sell Google Calendar data, use it for advertising, or use it to train general-purpose AI models. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not allow staff to read that data except with your permission for support, when necessary for security or legal obligations, or as permitted for aggregated internal operations under that policy.

You can disconnect in Calendar settings and revoke Reunion Portal's access in your Google Account. Disconnecting stops synchronization and removes the stored connection credentials. Events already imported into Reunion Portal or sent to Google remain until removed using the applicable calendar or account controls. Contact [email protected] to request access, correction or deletion; shared-content and backup retention follow the Retention section of this notice.

Subscriptions and payments

Stripe processes card details and payment authentication. Reunion Portal receives billing identifiers and operational details such as plan, billing interval, subscription status, payment status, charge amount, card brand, last four digits, and expiration month and year. Reunion Portal does not receive or store a complete card number or card security code.

Family funds and manual contribution records

We handle fund names and purposes, audience and manager permissions, the recipient name and shared Venmo profile link supplied by an organizer, reported contribution amounts, optional notes, receipt-review decisions, recorded expenses, approvals, and audit records. Past reports keep the recipient details supplied when the report was created, even if an organizer later changes the fund's recipient. Members can see their own activity; authorized fund managers can review the fund's activity. Other fund details and totals follow the applicable audience and family permissions.

Opening the recipient link takes you to Venmo, which handles any payment under its own terms and privacy practices. Reunion Portal does not receive your Venmo password, bank details, balance, or automatic transaction confirmation. The organizer checks receipts outside the hub and manually confirms reports. Historical payment or transaction records may remain available to authorized people where applicable; financial and audit records are subject to the retention purposes described below.

Browser preferences and unsent drafts

The hub uses browser storage for requested calendar and feed preferences, accessibility choices, conversation-window state, and unsent message text or recipient selections. Message drafts and some display preferences use local storage, which can remain after a tab closes; accessibility choices and some window state use session storage. A saved draft is not a sent message. Clearing a draft after sending, discarding it, or clearing the site’s browser data removes the corresponding local copy where applicable. On a shared device, review saved drafts and clear site data when needed. See the Cookie Notice.

Security, support, and operations

When you use our contact or problem-report forms, we collect the contact details and description you submit. A problem report may also include screenshots you choose, your account and family association, subscription summary, app version, browser and device details, viewport, recent internal page paths, request identifiers, and recent app failures. The reporting tools are designed to exclude passwords, payment-card details, private messages, form contents, family files, precise location, cookies, and authentication tokens.

How we use information

• Provide accounts, family spaces, planning, communication, media, notification, and subscription features.
• Apply family roles, permissions, privacy choices, subscription allowances, and parent or guardian controls that the product supports.
• Process payments, renewals, plan changes, cancellations, and billing support.
• Deliver requested service, security, invitation, reminder, message, and marketing emails.
• Protect accounts and the service, diagnose failures, enforce our terms, respond to reports, and meet legal obligations.
• Answer support, accessibility, privacy, and account-deletion requests.
• Measure consented public-site traffic, performance, navigation, and general conversion events so we can improve useful content and page design.

Marketing consent is optional and separate from operational messages needed to provide or secure an account. Launch-update signup is also separate from account registration and does not promise a launch date, invitation, or priority access.

When information is shared

Private family information is shown to other authorized people according to the family, feature, role, and visibility involved. Family owners and administrators can manage areas allowed by their permissions. A site administrator does not automatically receive access to a family’s private content merely because that person administers the service.

We use SmarterASP for website, database, and email hosting; Cloudflare for DNS, delivery, security, and consented public-site analytics; Google Analytics for consented public traffic and conversion measurement; Microsoft Clarity for consented heatmaps and recordings on selected informational pages; Stripe for platform subscriptions; and Google Maps services for optional address and mapping features. Following a fund recipient's Venmo profile link opens an external service whose privacy practices apply to activity there. These providers process information needed to perform their services and operate under their own terms and privacy practices. We may also disclose information when required by law, to protect people or the service, or as part of a business transaction subject to appropriate safeguards.

We do not authorize selling personal information or using private family content for cross-context behavioral advertising.

Your choices and controls

• Update account and profile information and use available family-specific visibility settings.
• Change family-feed, event, message, and marketing email choices where those controls are offered.
• Download message history you are authorized to see.
• Unsubscribe from launch emails through a message link or request deletion of that subscription.
• Request access, correction, or deletion by using the account controls or contacting us.
• Accept, reject, or withdraw optional public-site analytics through Cookie preferences. Global Privacy Control is honored for marketing and targeted-advertising choices.

To delete a signed-in account, use Account & data deletion in the family hub. Family owners must first leave every active family with another owner, or choose to delete a family that has no other member with a sign-in account. See Account and data deletion for the process, timing, shared-content rules, and alternatives when you cannot sign in.

Planning tools and campaign measurement

The public planning tools calculate in your browser and do not save or transmit your worksheet entries. A download stays on your device unless you choose to share it. With Analytics consent, we measure general tool use, downloads, and the stages of requesting launch updates. We accept only predefined campaign labels, remember them in the current tab for up to 30 minutes without another consented page visit, and do not include arbitrary URL values or worksheet entries in those events. Email verification is optional and is measured separately from an accepted signup request.

Retention

We keep account and family information while it is needed to provide the service. A verified account-deletion request is normally completed within 30 days after ownership requirements are resolved. Screenshots attached to a closed problem report are removed after six months, and personal identifiers in a closed report are removed or anonymized after 12 months. Google Analytics event-level data is configured for two-month retention; this does not remove standard aggregated reports. Microsoft Clarity normally retains playback data for 30 days and heatmap, click, labeled, or selected session data for up to nine months. Cloudflare controls retention for its aggregated Web Analytics service. We may retain limited billing, transaction, consent, security, dispute, fraud-prevention, suppression, and audit information when reasonably needed for law, accounting, security, or enforcing rights. Shared family records may be transferred to the family, removed, or de-identified according to the deletion choice and the rights of other family members. Backup copies expire under the applicable backup cycle and are not restored to active use after deletion.

Security

We use administrative and technical safeguards designed for the sensitivity of the information, including encrypted transport, protected password credentials, session controls, optional two-step verification, family-scoped authorization, restricted administrative actions, and payment processing through Stripe. No online service can promise absolute security. Read Security and Trust for more detail.

Children

Public launch-update signup is for adults 18 and older. Hub accounts are for people age 13 and older, and Reunion Portal does not offer an under-13 parental-consent account path. An adult family organizer may create a profile-only record for a relative who cannot sign in. See the Children’s Privacy Notice.

Changes and contact

We will update the effective date and provide appropriate notice when this notice materially changes. Privacy and data-rights questions may be sent to [email protected]; service questions may be sent to [email protected].