Privacy Policy

This website (hurdhalloween.com) is operated by Brook Hurd for the annual Hurd Family Halloween Party — a private, invitation-only event. It is not a commercial service.

Data controller:Brook Hurd — [email protected]

We collect only what is needed to run the party:

• Name — used to identify you on ballots and the guest list.
• Email address — used to send you a magic login link. We do not send marketing email.
• Age group — adult, teen, or kid — used only to place costume contest entries in the correct category.
• Costume photos and video — uploaded by contestants for the contest gallery and voting. Visible to other logged-in guests.
• Votes cast — stored against your account so you can update them before voting closes. Individual votes are not shown publicly; only aggregate results are announced.
• IP address — captured transiently by the server for rate-limiting (e.g. limiting login attempts). Not stored in the database.

Your data is used exclusively to:

• Let you log in securely via a one-time email link
• Display your name on the RSVP list and ballot cards
• Show your costume entry to other logged-in guests during the contest
• Record and tally costume contest votes
• Display winners on the results board

We do not use your data for advertising, profiling, or any purpose beyond running this party.

• Other guests — can see contestant names and uploaded photos/video on the voting pages.
• Party admin (Brook Hurd) — can see all submitted data including email addresses for event management.
• Third parties — we do not share, sell, or transfer your data to any third party. Email is delivered via our own server; no external email provider processes your address.

This site sets exactly one cookie:

This is a strictly necessary cookie required for the site to function. It contains only a random session ID — no personal data is stored inside the cookie itself. Your session data (name, email, role) lives in our database, looked up by that ID.

We use no tracking cookies, no analytics cookies, no advertising cookies, and no third-party cookies of any kind. Because only strictly necessary cookies are used, no cookie consent banner is required under GDPR or the ePrivacy Directive.

All personal data is retained for up to 12 months after the party date, then deleted. Contest photos and videos are deleted on the same schedule.

If you would like your data deleted sooner, contact us at [email protected] and we will remove it within 30 days.

If you are in the European Economic Area or United Kingdom, you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data (“right to be forgotten”)
• Restriction — ask us to limit how we use your data
• Objection — object to our processing of your data
• Portability — receive your data in a machine-readable format

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

All data is transmitted over HTTPS. Session cookies are marked HttpOnly and Secure so they cannot be read by JavaScript or sent over unencrypted connections. Database access is restricted to the application server. Media files require an authenticated session to access.

If we make material changes to this policy we will update the “Last updated” date at the top of this page. Since this is a private party site, changes will be minor and infrequent.

Questions about this policy or your data: [email protected]