GifKard Privacy Policy

1. Who we are

GifKard is run by [company legal name], [mailing address] ("we" and "us"). Questions and requests: hello@gifkard.app.

For review: Fill in the legal entity and address. Decide whether a privacy contact or representative is needed for EU/UK visitors.

2. What we collect

• Organizers (people who start a card): your email address to sign in; what you put on a card (the recipient's name, and their email or phone number if you add them; the occasion, title, message, closing date and your time zone); the people you invite by email; songs you upload; and the choices you make on the card.
• Contributors: the video you record or upload, which shows your face and voice; the name you give; an optional note; and an optional email address, used to send you the recipient's thank-you and, if the organizer invited you by email, reminders.
• Recipients: what the organizer entered about you; when you first pressed play; the thank-you video you record; for a gift, the email you give for a store gift card or a payout, and a shipping address for gifts from the shop. Your identity and bank details for a payout go to Stripe, not to us; Stripe tells us whether your account can receive money.
• People who chip in or buy a gift: the name you give, the amount, and a message if you add one. Card details are typed on Stripe's page and never reach us; Stripe tells us whether the payment went through.
• Vendors in the gift shop: your sign-in email, shop name, contact email, description, products and photos; your listing fee status from Stripe; whether Stripe can pay you; and the orders you receive.
• Visits, counted without cookies: the kind of page (for example "invite" or "recipient", never the link itself), how long it stayed on screen, the device type, system and browser, your browser's language, a rough region worked out from your phone's time zone (such as "US Central"), the website that sent you, and which recording effects were used. To count visitors without cookies we make a one-way code from your network address and browser together with a secret that changes every day (and another that changes every month); old secrets are thrown away, so the codes can't be traced back to you or linked across months. We don't store network addresses for counting. If your browser sends Global Privacy Control or Do Not Track, your visits aren't counted at all.
• Keeping the service safe and working: our hosting providers log requests, including network addresses, for a short time; we use network addresses briefly to limit abuse (for example, how many clips one address can start in an hour); and when something breaks we record the error, the kind of page and the browser, with private links removed.
• Only if you choose to: connecting Google lets you pick contacts to invite. We use Google's access only while you pick (it stays in a sealed cookie in your browser for about an hour, not on our servers) and keep only the addresses you choose. Turning on phone notifications gives us your browser's push address and keys.

3. Faces and face effects

Face effects (hats, masks, backgrounds) are worked out by your phone, inside your browser. The face points they use never leave your phone, and we never receive or store them. We don't use face recognition or make faceprints from anyone's video.

For review: Confirm this wording covers Illinois BIPA, Texas CUBI and Washington's biometric law (videos show faces; no biometric identifiers are extracted or stored).

4. How we use it

• To make, deliver and show cards and reels.
• To take gifts, send payouts, order gift cards and handle shop orders.
• To send the emails and notifications the service needs: sign-in, invites and reminders the organizer asks for, the reel being ready, and the thank-you. Each of these except sign-in has an Unsubscribe link, for that card or for all of our email; emails you ask for yourself, like a gift card's link, always come.
• To keep the service secure and prevent fraud and abuse.
• To understand use in total (for example, how many cards were made this week) and to show advertisers totals, never anything about a person.
• To meet legal duties, such as keeping payment records.

5. Who can see what

• The organizer sees the clips, names and notes added to their card, and who gave what. They don't see contributors' email addresses.
• The recipient sees the reel, the names and notes, the gift total and who gave.
• Anyone you give a card's links to can open them: the invite link lets people add a clip or a gift, and the recipient's link plays the reel.
• Shops in the gift shop see what they need to ship an order: the shipping address, and the giver's name and message.
• Service providers that run parts of GifKard for us, and may use the data only for that: Supabase (database, sign-in and file storage, in the US), Fly.io (servers, in the US), Cloudflare (domain, DNS, and storing and delivering videos), Stripe (payments, payouts and shop billing), Tremendous (store gift cards; it gets the gift card order and the recipient's email), Resend (sending email), Google (only if you connect Google contacts), and the push services run by Apple, Google, Mozilla and Microsoft (they carry encrypted notifications to your phone).
• Advertisers get totals only, such as visitors per month or the most popular occasions.
• Others when the law requires it, or to protect someone's safety or our rights. If the company is sold or merges, data moves with it under this policy.

We don't sell personal information, and we don't share it for advertising that follows people across sites or apps.

For review: Confirm data processing agreements with each provider, and whether any of them counts as a 'sale' or 'share' under state laws.

6. How long we keep it

• Cards, clips, the reel and the thank-you: until the organizer deletes the card [or a set time after it's sent, to be decided]. A contributor can delete their own clip while the card is still open. Original uploads are deleted once they're converted.
• Gift and order records stay after a card is deleted, for accounting, refunds and taxes [7 years, to confirm]. Shipping addresses are erased from orders 60 days after they ship.
• Visit counts: individual events for 100 days, then only monthly totals.
• Error reports: 30 days. The site owner's access log: 400 days.
• Sign-in accounts: until you ask us to delete yours at hello@gifkard.app.
• Addresses that unsubscribed, bounced or reported our email as spam: kept as a one-way code (a hash), not the address itself, so we don't email them again.

For review: Decide the retention period for videos (it drives storage costs, see COSTS.md) and how long payment records must be kept.

7. Security

We use HTTPS everywhere, private storage reached only through short-lived links, database rules that let each person reach only their own data, unguessable links for cards, and Stripe for card payments. No system is perfectly secure; if you find a problem, please tell us at hello@gifkard.app.

8. Your choices and rights

• Contributors can delete their own clip while the card is open; organizers can delete a whole card.
• Ask us to see, correct or delete your information, or to delete your account, at hello@gifkard.app. We'll check the request comes from you and answer within 45 days.
• Depending on where you live (for example California, Colorado, Virginia, or the EU and UK), you may have rights to access, correct, delete and take a copy of your information, and to opt out of its sale or targeted advertising (we do neither). You can appeal our answer by replying to it. We won't treat you differently for using these rights.
• You can turn off notifications, disconnect Google, or turn on Global Privacy Control at any time.

For review: Self-service account deletion isn't built yet (requests go by email). Confirm which state and EU/UK rights apply at launch.

9. Children

GifKard isn't meant for children under 13, and we don't knowingly collect their personal information. A parent or guardian may record or upload a video that includes their child. If you think a child under 13 has given us information, email hello@gifkard.app and we'll delete it.

For review: COPPA: contributors need no account, so the service can't check ages. Confirm this approach is enough.

10. Cookies and storage on your phone

We don't use advertising or analytics cookies. We use:

• Sign-in cookies, to keep you signed in.
• A gift card cookie, so the recipient's own phone can open their gift card.
• A Google connection cookie, while you pick contacts (up to an hour).
• A do-not-count cookie for the site's owner, which keeps the owner's own visits out of the numbers.

Your browser also remembers a few things on the phone itself: the name you used on a card, the effects you picked, and an upload in progress so it can finish later.

11. Where data is processed

In the United States. Videos may be delivered from servers near the viewer.

For review: If the service is offered in the EU or UK, add the transfer basis (for example, the EU-US Data Privacy Framework or standard contractual clauses).

12. Changes

We'll post changes here and update the date. For important changes we'll tell organizers by email or in the app.

13. Contact

hello@gifkard.app, [company legal name], [mailing address].